This Privacy Policy explains how Dirty Disco Stars ("DDS," "we," "us," or "our") collects, uses, stores, and shares personal data when you use dirtydiscostars.com, the DDS Library, sample packs, Studio breakdowns, DDS Mastering, member community spaces, and related services (the "Services").
Controller contact: [email protected]. Questions about privacy, access, or deletion go to the same address.
If you are in the EEA/UK/Serbia (or another region with similar laws), DDS is the controller of personal data described here, except where a listed processor acts as an independent controller (for example, payment providers for their own fraud/compliance processing).
This Policy covers data processed through our website, account dashboard, checkout flows, Library playback/downloads, mastering orders, and the contact form.
Third-party sites we link to (Instagram, Traxsource, SoundCloud, Discord, Lemon Squeezy hosted checkout, etc.) have their own privacy policies. We are not responsible for their practices.
3.1 Account & profile
- Email address, password (hashed/handled by our auth provider), and optional display name / full name you provide.
- Account role and Library entitlement fields (for example subscription status, premium_until, subscription start, billing IDs).
- Session cookies and auth tokens needed to keep you signed in.
3.2 Billing & purchases
- Subscription and order metadata from our payment provider (for example Lemon customer/subscription/order IDs, variant, amount, currency, paid timestamps, cancel-at-period-end flags).
- We do not receive or store full payment card numbers. Card data is handled by the payment processor.
3.3 Library usage
- Video watch progress (position and progress percentage per video).
- Likes / engagement on Studio content where that feature is enabled.
- Download-policy acknowledgements (policy version and timestamp).
- Technical signals needed to authorize streaming and signed downloads (tokens, request timing, access checks).
3.4 Mastering orders
- Track metadata you submit (title, artist name, BPM, key, notes, reference links).
- Source mix links (for example WeTransfer/Drive URLs) and delivered master storage paths.
- Order status, revision counts/notes, admin operational notes, and related timestamps.
- Messages you send about an order through the dashboard.
3.5 Contact & support
- Name, email, and message content from the contact form.
- Emails we send or receive about Library access, mastering delivery, billing, or support.
3.6 Technical & security data
- Standard server/application logs (IP address, user agent, timestamps, error diagnostics) as needed to operate, secure, and debug the Services.
- We do not currently run third-party advertising pixels or behavioral ad trackers on the marketing site. If that changes, we will update this Policy.
3.7 Community
If you join a DDS member Discord or similar community space, that platform processes your Discord account data under its own terms. We may see your Discord username and messages in channels we administer.
- Create and secure accounts; authenticate sessions.
- Provide Library streaming, sample-pack downloads, tenure unlocks, and member benefits.
- Process subscriptions, mastering checkout, refunds/credits where applicable, and billing-portal access.
- Fulfill mastering orders, communicate status, and deliver files.
- Respond to contact and support requests.
- Enforce Terms of Service, prevent fraud, account sharing abuse, and unauthorized access.
- Improve reliability, content quality, and product features using aggregated or operational metrics.
- Comply with legal obligations and respond to lawful requests.
- Contract — to provide the Services you request (account, subscription, downloads, mastering).
- Legitimate interests — security, abuse prevention, service improvement, limited operational communications, establishing/defending legal claims (balanced against your rights).
- Consent — where required (for example certain non-essential cookies or marketing emails, if we introduce them).
- Legal obligation — tax, accounting, or regulatory requirements.
We share personal data with processors and service providers only as needed to run the Services, under appropriate contracts where required:
- Supabase — authentication, database, and related backend infrastructure.
- Lemon Squeezy (or successor payment provider) — checkout, subscriptions, invoices, tax handling as Merchant of Record where applicable.
- Bunny.net — video streaming and file/CDN delivery (including signed URLs for masters/packs).
- Resend — transactional and operational email delivery.
- Hosting / infrastructure providers that run the Next.js application.
- Professional advisers or authorities when required by law or to protect rights and safety.
No sale of personal data
We do not sell your personal data and do not share it with third parties for their own cross-context behavioral advertising.
- Essential cookies / local storage are used for authentication and session continuity (Supabase auth cookies).
- We may use similar technologies required for CSRF protection, load balancing, or playback.
- Because essential cookies are required to operate signed-in features, the Services may not work correctly if you block them entirely.
- If we add analytics or non-essential cookies later, we will update this Policy and obtain consent where required.
- Account and profile data — kept while your account is active and for a reasonable period afterward for security, billing disputes, and legal compliance.
- Subscription/billing records — retained as needed for accounting, chargebacks, and tax rules.
- Library progress, likes, and download acknowledgements — kept while useful for the product and account history, or until deletion is completed.
- Mastering orders and related files/messages — retained to deliver the service, handle revisions, and keep business records; source links you paste may also live on third-party hosts you control.
- Contact emails — retained as needed to handle the inquiry and for legitimate business records.
- Server logs — typically short-lived unless needed for security investigations.
Our providers may process data in the EU, UK, US, or other countries. Where we transfer personal data from the EEA/UK to countries without an adequacy decision, we rely on appropriate safeguards offered by providers (such as Standard Contractual Clauses) or other lawful transfer mechanisms.
We use industry-standard measures appropriate to the risk: encrypted transport (HTTPS), access-controlled databases, RLS where applicable, signed time-limited media URLs, and least-privilege service credentials on the server.
No method of transmission or storage is 100% secure. You are responsible for keeping your password confidential and for using a unique, strong password.
Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. Where processing is based on consent, you may withdraw consent without affecting prior lawful processing.
To exercise rights, email [email protected] from the address on your account and describe your request. We may need to verify your identity before acting.
You may also cancel a subscription via the billing portal linked in dashboard settings. Canceling membership does not automatically erase all historical records we must keep for legal or security reasons.
If you are in the EEA/UK, you may lodge a complaint with your local supervisory authority. In Serbia, that includes the Commissioner for Information of Public Importance and Personal Data Protection, where applicable.
The Services are directed to adults (18+ or the higher age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child provided data, contact us and we will take appropriate steps to delete it.
We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Material changes will be posted on this page and, where appropriate, communicated by email or in-product notice.
Dirty Disco Stars
Privacy requests: [email protected]
Contact form: /contact
Related: Terms of Service at /terms
See also our Terms of Service. Privacy questions → [email protected] or contact.