Privacy Statement

Last updated: July 5, 2026 — placeholder version, pending legal review.

FluxAudio ("we") is the controller for the processing of personal data described in this statement.

• Business name: [BUSINESS NAME]
• Address: [STREET + NUMBER, POSTAL CODE, CITY, COUNTRY]
• Contact: [EMAIL ADDRESS]

1. What we collect

• Account data — email address, display name, a hashed password, and (only if you connect it) your Discord ID, username and avatar.
• Optional profile data — name, address and phone number, if you choose to fill them in.
• Order data — purchased products, amounts and PayPal order references. We never see or store card numbers or PayPal credentials.
• Messages and reviews — what you send us through the site.
• Visitor statistics — one record per IP address per day with an approximate location (country/city). These are kept for a maximum of 90 days and are deliberately not linked to accounts.
• Security data — email verification and password reset tokens (stored hashed) and, if you enable two-factor authentication, an encrypted TOTP secret.

2. Why we process it (legal bases)

• Running your account, delivering purchases and downloads — performance of a contract.
• Payment processing via PayPal — performance of a contract.
• Service email such as verification and password reset — performance of a contract.
• The newsletter — consent only: you choose when registering and can change it in your profile at any time.
• Security, fraud prevention and abuse protection (rate limiting, IP bans) — legitimate interest.
• Modest, anonymous-by-design visitor statistics — legitimate interest.
• Keeping order records — legal (tax) obligation.

3. Third parties

We share data only with parties needed to run the shop: our hosting provider, PayPal (payments — see PayPal's own privacy statement), Discord (only when you sign in with or link Discord, including automatic role assignment), our email (SMTP) provider, and GeoJS (turning an IP address into a country for statistics). Loading fonts and scripts from CDNs (Google Fonts, cdnjs, Tailwind, the PayPal SDK) shares your IP address with those services. We never sell personal data.

4. Retention

Account data is kept until you delete your account. Order records are kept for 7 years (Dutch tax law). Visitor statistics are deleted after 90 days. Messages are kept as long as your account exists.

5. Cookies

• Functional cookies — always active: session, cart, currency choice, your cookie preference itself, and admin security. The shop cannot work without them.
• Analytics cookies — currently none: our visitor statistics run server-side without cookies. If that changes, this category only activates with your consent.
• Third-party cookies — embedded content from YouTube, SoundCloud, X, Facebook or Discord can set its own cookies. Such content is only loaded after your consent.

Change your choice at any time via Cookie settings in the footer.

6. Security

Connections are encrypted (TLS). Passwords are stored with bcrypt hashing, two-factor authentication is available, download files and stored credentials are encrypted at rest, and administrative access requires a second verification step.

7. Your rights

Under the GDPR (AVG) you can request access, correction, deletion, restriction, portability of your data, and object to processing based on legitimate interest. You can withdraw consent (such as the newsletter) at any time. Send requests to [EMAIL ADDRESS] — we respond within one month and may ask you to verify your identity. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

8. Minors

FluxAudio is not directed at children under 16. We do not knowingly collect their data without parental consent.

9. Changes

We may update this statement. The current version is always available at /privacy.