Privacy Policy
This page is a working draft. Sections marked like this are still open decisions, not finished policy.
1. Who we are
DiscographyVault ("we", "us") provides a self-serve website builder for musicians to publish their discography. This policy covers both: (a) you, if you're a DiscographyVault customer ("tenant"), and (b) your visitors, if they browse a site built on DiscographyVault.
2. What we collect
From tenants (customers):
- Email address and password (handled by Supabase Auth — we never see or store your raw password ourselves).
- Whatever content you upload: release/audio metadata, audio files, images, page text.
- Payment information: handled entirely by Stripe — we don't store your card details ourselves.
- If you connect Mailchimp (optional, your own choice): your Mailchimp API key, stored server-side, never exposed to your site's visitors or anyone but you.
From your visitors (if you run a DiscographyVault site):
- Standard web request data (IP address, browser type) via Cloudflare, our hosting provider.
- If your visitors use your Contact form: their name, email, and message, sent directly to your own email address.
- We do not run third-party analytics or advertising trackers on tenant sites today.
3. How we use it
- To provide the Service: hosting your site, authenticating your login, processing payments, sending transactional email.
- We don't sell your data or your visitors' data to anyone.
- We don't use your content for anything beyond displaying it on your own site as you've configured it.
4. Who we share data with (our subprocessors)
| Provider | What it handles |
|---|---|
| Supabase | Account login/authentication |
| Sanity | Your content storage (releases, images, audio, page content) |
| Cloudflare | Hosting, CDN, and the underlying infrastructure |
| Stripe | Payment processing |
| Resend | Transactional email (confirmation, password reset, contact form) |
| Mailchimp | Only if you connect it — your own list, your own relationship with Mailchimp |
5. Data retention
- While your account is active, your data is kept as long as you keep your subscription.
- If you cancel (or a payment fails and isn't recovered), your data is retained for 90 days, then permanently deleted.
- You can request export or deletion of your data at any time — currently a manual request, not yet self-serve.
6. Your rights
- Access, export, or delete your data: contact us (see §9). Not yet self-serve.
- If you're in a jurisdiction with specific data-protection rights (GDPR, CCPA, etc.), those rights apply here too. [jurisdiction-specific rights language not yet added]
7. Cookies & local storage
We use functionally necessary storage only: your login session and a small local cache of your site's theme colors, used only to avoid a flash of unstyled content on page load. Neither is used for tracking or advertising. We don't use third-party advertising or analytics cookies today.
8. Children's privacy
The Service isn't directed at children, and isn't intended for use by anyone under 13.
9. Contact
Questions about this policy, or to request your data: use our Contact form — no email address is published on this page.
10. Changes to this policy
We'll give at least 30 days' notice by email before material changes take effect.