Privacy & cookies

Dan Hulse trading as Bandicoot Studios is the controller of your personal information, which means we decide how it's used and are responsible for looking after it. Our address is 23 Cunningham Hill Road. You can contact us about anything in this notice at bandicootrecordings@gmail.com.

When you book a session or create a member account, we collect:

• Contact details: your name or artist name, email address and phone number.
• Booking details: the date, time and length of your session, the price, what you tell us you're working on, and whether your deposit and balance have been paid.
• Your music: any beats, instrumentals or stems you upload, links you paste (for example WeTransfer or Dropbox), and how you're getting your stems to us.
• Mix & master orders: the song names, notes and tracks or stems you send for each order, the finished files we deliver, the price, and whether the deposit and balance have been paid.
• Discount codes: if you use one, which code and how much it took off.
• Your member hub: your password (stored only as a one-way scrambled hash that nobody can read, including us), the mixes, masters and other files we deliver to you, your loyalty stamps, and when you last signed in.
• Notifications: if you switch on notifications in your member hub, a technical address for your phone or browser so we can send them, and which kinds you chose. You can switch them off at any time.
• Messages: copies of the emails we send you (confirmations, reminders, account codes, file notifications and mix & master updates), and anything you send us.
• Studio notes: short notes about your sessions that help us prepare, such as your preferred setup.

Payments: your card details go straight to Stripe, our payment provider. We never see or store your full card number. If you choose to pay with PayPal, Apple Pay, Google Pay or another method at checkout, that provider also handles your payment under its own privacy policy, and we only receive confirmation that you've paid.

Technical information: like any website, our hosting provider receives your IP address and basic browser details when you visit. We briefly use IP addresses and email addresses to block abuse (for example limiting uploads and repeated wrong passwords); this is held only in memory for up to an hour and isn't stored.

• To provide what you've asked for (contract): taking and managing your booking, deposits and balances, sending confirmations and a reminder 24 hours before your session, preparing for your session with the music you send, running your member hub, delivering your files, mixing and mastering the songs you order, applying discount codes, and the loyalty scheme.
• With your consent: push notifications to your phone, and separately the occasional “offers & reminders to book” notification if you tick it. You can withdraw consent at any time by switching them off in your hub or on your phone; this doesn't affect anything sent before.
• To meet legal obligations: keeping financial records for tax and accounting.
• For our legitimate interests: keeping the site and your account secure, preventing fraud and abuse, keeping notes that help us give you a better session, and handling any disputes. We balance these against your rights, and you can object (see Your rights).

We don't send marketing emails or newsletters. Every email we send is about a booking, your account or files you've asked for. In your member hub you can choose to get the odd “offers & reminders to book” notification (for example how close you are to a free session). These are off unless you switch them on, come at most once every two weeks, and you can turn them off in your hub at any time.

We only share what each service needs to do its job, and they're contractually required to protect it:

• Stripe: takes deposit and balance payments securely. Stripe also uses payment information to prevent fraud, under its own privacy policy.
• Our email provider (Resend): delivers the emails we send you.
• Our hosting provider (Render): runs this website and stores its database and files securely.
• Push notification services: if you switch on notifications, they're delivered through your phone's or browser's own service (Apple, Google or Mozilla). Messages are encrypted so only your device can read them.
• OpenStreetMap: shows the map in “Where are we?”. Loading it shares your IP address with OpenStreetMap's servers.
• Route finder services: if you use “Find my way”, the postcode, place or location you enter is sent to postcodes.io, OpenStreetMap (Nominatim) and the OSRM route planner to work out your route. We don't store it.

The Google Maps, Apple Maps, Waze and Citymapper buttons only open those apps if you tap them; their own privacy policies then apply. We may also share information if the law requires it, or with professional advisers (such as an accountant) where needed.

Some of our providers (such as Stripe, Resend and Render) may process information outside the UK, including in the USA. Where they do, the transfer is protected by UK-approved safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK's International Data Transfer Agreement.

• Booking and payment records: 6 years after the end of the tax year they relate to, as UK tax law requires. They're deleted automatically 7 years after the session or order.
• Unpaid bookings: if a booking is never paid for, it's deleted automatically after 90 days, with any music sent with it. If that was your only contact with us, your details are deleted then too.
• Copies of emails we send you: deleted automatically after 2 years.
• Your client details and member account: while you're a client. If you haven't booked or signed in for 6 years, or you ask us to close your account, we delete them (apart from records we must keep by law).
• Music you send and files we deliver: kept so you can always access them in your hub, until you ask us to delete them or your account is closed. We'll give you notice before deleting delivered files so you can download them first.
• Songs left in your cart: if you never check out, unpaid songs and the files sent with them are deleted automatically after 90 days. You can also remove them yourself at any time.
• Unsubmitted uploads: files uploaded on a booking form that was never completed are deleted automatically after 24 hours.
• Sign-in codes and links: work once and expire after 30 minutes, and are deleted soon after.

The live site uses an encrypted (https) connection. Passwords are stored as one-way hashes, your files can only be opened by you and the studio (finished mix & master files unlock for you once paid), accounts lock after repeated wrong passwords, and changing your password signs out every other device. Only the studio owner can access the admin area.

We only use cookies and browser storage that are strictly necessary for the site to work or that you've asked for, so we don't need to ask for consent or show a cookie banner. We don't use analytics, advertising or tracking cookies.

Stripe's secure payment page may set its own cookies, needed to take your payment safely and prevent fraud. You can delete cookies in your browser settings at any time; you'll just need to sign in again.

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that's wrong or incomplete;
• ask us to delete your information (unless we need to keep it by law);
• ask us to limit how we use it, or object to us using it for our legitimate interests;
• ask for information you gave us in a format you can take elsewhere.

To use any of these rights, contact us at bandicootrecordings@gmail.com. It's free, and we'll reply within one month. We may ask you to confirm your identity first.

Bookings and member accounts are for people aged 18 or over. If you're under 18, a parent or guardian needs to book for you. We don't knowingly collect information from children under 13.

If you have a question or concern about how we handle your information, please contact Dan Hulse trading as Bandicoot Studios at bandicootrecordings@gmail.com, or write to us at 23 Cunningham Hill Road.

If you're unhappy with our response, you can complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

We may update this notice from time to time; the date at the top shows when it last changed. See also our booking terms.