Privacy policy

Who we are

BeatsOnDeck is the marketplace described in these pages, and is responsible for the personal data it collects through the site. If you want a copy of your data, a correction, or your account deleted, get in touch and we will deal with it.

What we collect

• • Account details: your name, email address, and a hashed password. We never store the password itself.
• • Whether your email address has been confirmed, and short-lived tokens used to confirm it or to reset a password. Those are stored hashed and expire.
• • Producer storefronts: display name, bio, profile picture, background image, social links, and the beats you list.
• • Uploaded files: the audio itself and any cover art, plus the title, genre, tags, BPM and key you enter.
• • Marketplace activity: purchases, play counts, balance history, withdrawals, refunds and featured placements.
• • Reports you send us about a listing or a producer: which one, the reason you picked, anything you type alongside it, and that it was you who sent it. Staff can see all of that; the producer you reported cannot.
• • Whether a staff member has confirmed who you are, when, and which member of staff did it. Producers who want their earnings to clear faster, or whose earnings pass the threshold that requires it, arrange this through support - whatever you send to prove it reaches us by email and is not stored on the site.
• • Moderation records: whether an account has been suspended and the reason given.
• • Short-lived counters used for rate limiting, so that signing in, resetting a password or uploading cannot be done thousands of times a minute. These are counted against an IP address, and for a password reset against the email address being reset. They expire on their own.
• • A record of significant actions - registering, signing in and out, failed sign-in attempts, uploading, listing changes, purchases, payments and staff decisions - with the time, the account involved, the IP address the request came from and the browser and device reported by it. This is what lets us investigate fraud, abuse and disputes, and hold staff decisions to account.

We do not use advertising or analytics trackers, and we do not build profiles of you for anyone else. IP addresses are recorded against actions for security and dispute resolution, not to track browsing.

Cookies

Reading the site sets none at all. Opening the sign-in page sets two, both needed for signing in to work: one that protects the form against being submitted from another site, and one that remembers which page to return you to. Signing in successfully sets a third, which holds your session so you stay signed in; it expires after a week or when you sign out.

That is all of them. There are no advertising or analytics cookies and no third-party scripts, so there is nothing here to opt into and no banner to click through. We do not use browser storage for anything either.

How we use it

To run the marketplace: showing listings, streaming previews, delivering purchased files, moving money between balances, confirming that an email address belongs to the person using it, letting you recover an account, and preventing fraud or abuse.

Your audio files

Preview audio is public - anyone can play it. The full file is served only to the producer who uploaded it and to people who have bought it. If you upload a beat without a separate preview, the full track becomes the preview and is therefore publicly playable.

What we share

Your public listing - producer name, bio, profile picture, beat titles, tags and play counts - is visible to anyone. Beyond that we share personal data only with the services needed to run the site:

• • A hosting provider, which runs the application.
• • A database provider, which stores the records described above.
• • An object storage provider, which stores uploaded audio and images.
• • An email provider, which delivers account emails such as password resets.
• • Payment providers, which receive what they need to move money.

These providers process data on our instructions. We do not sell personal data, and we do not share it for advertising.

Where data is held

Our providers operate internationally, so your data may be stored or processed outside your own country, including outside the UK and EEA.

Security

The site is served over HTTPS. Passwords are stored hashed, and reset and verification tokens are stored hashed as well, so the database contains no credential that can be used as-is. Downloads of purchased files are checked against the purchase record on every request rather than being handed out as public links.

Retention

Purchase and balance records are kept for as long as needed for accounting and dispute resolution. Because a purchase is a permanent download right, a sold beat's file is retained even after the producer delists it - that is what the buyer paid for, and deleting it would take away something they own. Verification and reset tokens are short-lived and are spent or expire.

The action record described above is append-only and is kept for as long as it is useful for security and accountability. Closing an account does not erase it: the entries stay, showing the email address as it was at the time, because a record of moderation decisions that can be deleted by the person they concern is not a record.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete your account. You can edit your details and listings from your dashboard and hide your storefront at any time. Depending on where you live you may also have the right to object to or restrict how we use your data, and to complain to your local data protection regulator.

Deleting an account does not remove records we are required to keep for accounting, or files that buyers are still entitled to download.

Changes

If this policy changes materially we will update the date at the top. Your continued use of the site after a change means you accept the updated policy.