This Privacy Policy explains how Dirty Disco Stars ("DDS," "we," "us," or "our") collects, uses, stores, and shares personal data when you use dirtydiscostars.com, sample packs, DDS Mastering, Mix & Mastering, and related services (the "Services").
Controller contact: [email protected]. You can delete your account from Dashboard → Settings. Other privacy, access, or deletion questions go to the same email.
If you are in the EEA/UK/Serbia (or another region with similar laws), DDS is the controller of personal data described here, except where a listed processor acts as an independent controller (for example, payment providers for their own fraud/compliance processing).
This Policy covers data processed through our website, account dashboard, checkout flows, catalog playback/downloads, mastering orders, and the contact form.
Third-party sites we link to (Instagram, Traxsource, SoundCloud, Creem or Lemon Squeezy hosted checkout, PayPal, etc.) have their own privacy policies. We are not responsible for their practices.
3.1 Account & profile
- Email address, password (hashed/handled by our auth provider), and optional display name / full name you provide.
- Account role and purchase records for digital products you buy.
- Session cookies and auth tokens needed to keep you signed in.
3.2 Billing & purchases
- Order metadata from our payment providers (for example Lemon order IDs, PayPal order IDs, variant, amount, currency, paid timestamps).
- We do not receive or store full payment card numbers. Card data is handled by the payment processor.
3.3 Catalog usage
- Download-policy acknowledgements (policy version and timestamp).
- Technical signals needed to authorize signed downloads (tokens, request timing, access checks).
3.4 Mastering orders
- Track metadata you submit (title, artist name, BPM, key, notes, reference links).
- Source mix links (for example WeTransfer/Drive URLs) and delivered master storage paths.
- Order status, revision counts/notes, admin operational notes, and related timestamps.
- Messages you send about an order through the dashboard.
3.5 Contact & support
- Name, email, and message content from the contact form.
- Emails we send or receive about purchases, mastering delivery, billing, or support.
3.6 Technical & security data
- Standard server/application logs (IP address, user agent, timestamps, error diagnostics) as needed to operate, secure, and debug the Services.
- We do not currently run third-party advertising pixels or behavioral ad trackers on the marketing site. If that changes, we will update this Policy.
- Create and secure accounts; authenticate sessions.
- Provide sample-pack downloads and purchased-catalog access.
- Process one-time digital checkouts, mastering checkout, and refunds/credits where applicable.
- Fulfill mastering orders, communicate status, and deliver files.
- Authorized administrators may access display name, email, and registration date to operate accounts and support.
- Respond to contact and support requests.
- Enforce Terms of Service, prevent fraud, account sharing abuse, and unauthorized access.
- Improve reliability, content quality, and product features using aggregated or operational metrics.
- Comply with legal obligations and respond to lawful requests.
- Contract — to provide the Services you request (account, purchases, downloads, mastering).
- Legitimate interests — security, abuse prevention, service improvement, limited operational communications, establishing/defending legal claims (balanced against your rights).
- Consent — where required (for example certain non-essential cookies or marketing emails, if we introduce them).
- Legal obligation — tax, accounting, or regulatory requirements.
We share personal data with processors and service providers only as needed to run the Services, under appropriate contracts where required:
- Supabase — authentication, database, and related backend infrastructure.
- Creem or Lemon Squeezy — digital-goods checkout, invoices, tax handling as Merchant of Record where applicable. One of them is active at a time.
- PayPal — mastering and Mix & Mastering checkout.
- Bunny.net — file/CDN delivery (including signed URLs for masters/packs).
- Resend — transactional and operational email delivery.
- Hosting / infrastructure providers that run the Next.js application.
- Professional advisers or authorities when required by law or to protect rights and safety.
No sale of personal data
We do not sell your personal data and do not share it with third parties for their own cross-context behavioral advertising.
- Essential cookies / local storage are used for authentication and session continuity (Supabase auth cookies).
- We may use similar technologies required for CSRF protection, load balancing, or download authorization.
- Because essential cookies are required to operate signed-in features, the Services may not work correctly if you block them entirely.
- If we add analytics or non-essential cookies later, we will update this Policy and obtain consent where required.
- Account and profile data — kept while your account is active. If you delete your account from Settings, we erase the login, profile, and any catalog usage data such as watch progress and likes.
- Paid mastering orders and digital-purchase records — retained after account deletion as business records (customer name and email snapshot, payment IDs, amounts, status, related messages, and pack download timestamps without IP/user-agent). Creem, Lemon Squeezy, and PayPal also keep their own invoices. We may keep redacted webhook identifiers for security and idempotency.
- In-app entitlements — deleting your account ends dashboard access to purchased sample packs. Creating a new account with the same email does not restore that access.
- Mastering files — retained to deliver the service and handle the included revision window; project audio may be deleted from active storage about thirty (30) days after final delivery (see Terms). If the account is gone, we may complete delivery by emailing the saved address. Source links you paste may also live on third-party hosts you control.
- Contact emails — retained as needed to handle the inquiry and for legitimate business records.
- Server logs — typically short-lived unless needed for security investigations.
Our providers may process data in the EU, UK, US, or other countries. Where we transfer personal data from the EEA/UK to countries without an adequacy decision, we rely on appropriate safeguards offered by providers (such as Standard Contractual Clauses) or other lawful transfer mechanisms.
We use industry-standard measures appropriate to the risk: encrypted transport (HTTPS), access-controlled databases, RLS where applicable, signed time-limited media URLs, and least-privilege service credentials on the server.
No method of transmission or storage is 100% secure. You are responsible for keeping your password confidential and for using a unique, strong password.
Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. Where processing is based on consent, you may withdraw consent without affecting prior lawful processing.
You can delete your account yourself from Dashboard → Settings (password confirmation required). That erases your login, profile, and catalog usage data. Paid order and purchase records we need for accounting, tax, and disputes are kept as described in section 8, and in-app access to Samples ends.
For access, correction, restriction, objection, or portability requests, email [email protected] from the address on your account and describe your request. We may need to verify your identity before acting.
Deleting your account does not erase invoices held by payment processors, or the order records we retain for legal, tax, and dispute handling.
If you are in the EEA/UK, you may lodge a complaint with your local supervisory authority. In Serbia, that includes the Commissioner for Information of Public Importance and Personal Data Protection, where applicable.
The Services are directed to adults (18+ or the higher age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child provided data, contact us and we will take appropriate steps to delete it.
We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Material changes will be posted on this page and, where appropriate, communicated by email or in-product notice.
Dirty Disco Stars
Privacy requests: [email protected]
Contact form: /contact
Related: Terms of Service at /terms
See also our Terms of Service. Privacy questions → [email protected] or contact.