Privacy Policy
Data controller
Hugo Miguel Carvalho Lopes is the data controller for personal data collected through Soundbank.Studio. “Soundbank.Studio” is a trade name of this legal person.
Contact: hello@soundbank.studio
Address: Despacho 204, planta alta — CID ZAFRA Río Bodión, Avda. de los Cameranos 47,
06300 Zafra (Badajoz), España.
Purposes and legal bases
Fields required for a purchase and digital delivery are necessary to perform the contract. Newsletter, tester-pack and survey fields are voluntary; declining them does not prevent a purchase where applicable.
| Purpose | Legal basis | Data processed |
|---|---|---|
| Purchase and digital delivery | Contract (Art. 6.1.b GDPR) | Email, billing country, payment confirmation |
| Tax invoicing and accounting | Legal obligation (Art. 6.1.c GDPR) | Name, email, billing address, transaction amount and date |
| Newsletter subscription | Consent (Art. 6.1.a GDPR) | Email and consent timestamp |
| Monsta Fields tester-pack programme | Separate consent (Art. 6.1.a GDPR) | Email, consent and confirmation records, pack access and delivery records |
| Tester feedback survey | Consent (Art. 6.1.a GDPR) | Pseudonymous tester identifier, survey responses and submission date |
| Server security and error logging | Legitimate interest (Art. 6.1.f GDPR) | IP address, request metadata and timestamps |
| Limited cookieless audience measurement | Legitimate interest (Art. 6.1.f GDPR) | Pageviews and basic browser or request information without a persistent identifier. No email, purchase or tester data. |
| Optional website and product analytics | Consent (Art. 6.1.a GDPR) | Page and browser information, selected product interactions, technical performance and error data. No form contents, email addresses, payment information or survey answers. |
| On-demand YouTube demo playback | Consent through an explicit playback request (Art. 6.1.a GDPR) | IP address, browser and device information, page or referrer information, and playback interactions processed by YouTube after you select the demo. |
Processors and international transfers
| Provider | Purpose and data | Location | Transfer safeguards |
|---|---|---|---|
| Netlify, Inc. | Hosting, storage and site operations; request and security data, order records, consent evidence, tester signup and feedback records, and download records. | US / international subprocessors | Netlify DPA; EU–US Data Privacy Framework and EU Standard Contractual Clauses where applicable |
| Stripe Payments Europe / Stripe, Inc. | Payment processing and Stripe Tax; name, email, billing country, VAT or tax ID and fraud signals. Stripe is our processor for payment services and may act as an independent controller for fraud prevention and legal compliance. | IE / US | Stripe Data Transfers Addendum; EU–US Data Privacy Framework and EU Standard Contractual Clauses where applicable |
| Brevo | Transactional email and newsletter double opt-in; email, consent and order details included in messages. | EU primary storage / international subprocessors | Brevo DPA and applicable GDPR safeguards for subprocessors |
| PostHog, Inc. | Limited audience measurement and consented product analytics; pageviews, browser information, selected product events, technical performance and error data. No form contents, email addresses, purchase or tester identifiers, download tokens, payment information or survey answers. | EU Cloud (Frankfurt, Germany) | PostHog DPA; EU Standard Contractual Clauses and other applicable safeguards where required |
| Zoho Mail | Support and business mailbox; email addresses, message content and order or support details included in correspondence. | EU data centre with limited international access by Zoho group entities and subprocessors | Zoho's privacy information says it relies on EU Standard Contractual Clauses for cross-border transfers |
| Google Ireland Limited (YouTube) | On-demand playback of the embedded demo; IP address, browser and device information, page or referrer information, and playback interactions after you select the demo. | EEA / international processing | Google’s published transfer safeguards, including EU Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable |
Tester feedback is collected through this website and processed by Netlify as the hosting and storage provider identified above. Feedback is not sent to PostHog.
Copies of applicable transfer safeguards may be requested from hello@soundbank.studio.
PostHog analytics and consent choices
Before you make a choice in the cookie banner, PostHog is not loaded. With “Necessary only”, we use limited cookieless pageview measurement without cookies or a persistent browser identifier. With Analytics consent, PostHog may use a random, pseudonymous browser identifier for persistent website and product analytics, including selected interactions, technical performance and error data. We do not create profiles, use session recordings, advertising or cross-site tracking, or send form contents, email addresses, purchase or tester identifiers, download tokens, payment information or survey answers to PostHog. Withdrawing consent stops persistent analytics and returns measurement to the limited mode. See our Cookie Policy for storage and preference controls.
Embedded YouTube demo
No request is sent to YouTube until you select “Play demo”. The privacy-enhanced player limits personalisation, but YouTube still processes the request under Google’s Privacy Policy. Closing the demo removes the embedded player from the page. This playback request is separate from your site Analytics preference.
Data retention
We retain personal data only for as long as needed for the stated purpose or for a legal obligation. Tester feedback remains personal data while it can be linked to a tester.
| Data category | Retention period |
|---|---|
| Order / invoice / consent evidence | As required by applicable tax and accounting obligations |
| Download grants / access logs | Until expiry (30 days) + 30-day grace, then purged |
| Newsletter subscription and opt-in proof | Until unsubscription; suppression retained for as long as necessary to honour the opt-out and demonstrate compliance |
| Transactional email logs | Up to 6 months for support purposes |
| Server / security logs | For the period necessary for security and incident handling, subject to provider retention limits |
| Cookie-consent preference | Until you change your choice, clear your browser storage or the consent policy version changes |
| Tester signup, consent, access and linkable feedback | 12 months after the tester campaign closes, then identifying and linkable records are deleted. Irreversibly anonymised results may be retained. |
We may send one service reminder to a tester who has not submitted feedback. Newsletter subscription and its suppression record remain separate.
Your data-subject rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access — request a copy of the data we hold about you.
- Right of rectification — request correction of inaccurate or incomplete data.
- Right of erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention obligations.
- Right to restriction of processing — request that we limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interest, including limited audience measurement, server security and error logging.
- Right to withdraw consent — withdraw newsletter, tester or analytics consent at any time. This does not affect the lawfulness of prior processing.
- Right to lodge a complaint — with the Spanish Data Protection Agency (AEPD).
To exercise any of these rights, contact hello@soundbank.studio. We will respond within one month.