Privacy Policy

This policy explains what personal data Ric Hertz collects when you use richertzstudios.com, why we collect it, who helps us process it, and how long we keep it. Ric Hertz is the data controller for that information.

What we collect

• Account details — your email address and display name (required), and optionally an artist name and timezone.
• Order information — the artist or project name, each track's title, and any reference link or notes you provide; the audio files you upload; and the masters we deliver.
• Messages — the plain-text messages you send through an order's message thread.
• Payment information — handled by Stripe. We receive confirmation that a payment was made and Stripe's reference; we never see or store your card details.
• Demo clips — if you attach a track to the contact form to ask for a free test master, we store that file so we can listen to it.
• Usage analytics — only if you accept analytics cookies, we collect aggregate usage data via Google Analytics 4. Nothing analytics-related loads until you opt in.
• Technical data — basic request information (such as IP address) needed to operate and secure the site, including anti-spam checks on the contact form.

How we use it

• To create and manage your account and deliver the work you order.
• To communicate with you about your orders and enquiries.
• To take payment and keep basic records of transactions.
• To operate, secure, and improve the site.
• To comply with our legal obligations.

Our legal bases are: performing our contract with you (delivering ordered work and running your account); your consent (analytics cookies, and any marketing use of sample audio as described in our Terms); and our legitimate interests in running and securing a small business.

Who processes your data

We use a small set of third-party providers to run the service. Each only processes data on our behalf for the purpose listed:

• Supabase — database and authentication, and the storage your audio files sit in when they are not held on our own server. Supabase also sends the sign-in and account confirmation emails.
• IONOS — the site's domain and DNS, the virtual private server the site runs on, where your audio files are held when they are not in Supabase storage, and the mail servers that send our order notifications and contact-form enquiries.
• Stripe — card payment processing.
• Google Analytics 4 — website usage analytics, loaded only with your consent.
• Cloudflare — anti-spam (Turnstile) on the contact form.
• Sentry — error and performance monitoring so we can fix problems.

We don't sell your personal data, and we don't share it with anyone else except where the law requires it.

Cookies

If you sign in, we set first-party cookies that keep you signed in; these are strictly necessary and there is no way to use an account without them. We also set a first-party cookie to remember your cookie choice. Analytics cookies are only set if you accept them in the banner; nothing analytics-related loads before you do, and you can change your mind at any time via “Cookie settings” in the footer.

How long we keep it

• Source files you upload — deleted 30 days after the order they belong to is closed.
• Delivered masters — kept, so that you can re-download them from your account. We don't delete them on a schedule; ask us and we will remove yours.
• Demo clips sent through the contact form — kept until we remove them, which we do once the enquiry is finished. Ask us and we will remove yours sooner.
• Grace period — a deleted file is recoverable for 7 days before it is erased for good, so that a mistake can be undone.
• Account and order records — kept while your account is active and for a reasonable period afterwards for our records and legal obligations; you can ask us to close your account.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict certain processing, to withdraw consent, and to receive a copy of data you provided. To exercise any of these, email us at the address below. You also have the right to complain to your local data protection authority.

Data location and transfers

Some of our providers are based outside the UK/EEA. Where data is transferred internationally, we rely on the providers' safeguards (such as standard contractual clauses) to protect it.

Children

The service isn't intended for anyone under 16, and we don't knowingly collect data from children.

Changes

We may update this policy from time to time; the “last updated” date above will change when we do.

Contact

For any privacy question or request, email hello@richertzstudios.com.