Privacy

This policy covers personal data processed for UNDERBPM, an independent global music marketplace operated under the DRFT808 brand.

The platform operator is responsible for its own processing; notagency.io’s role as developer does not by itself make it the operator or controller. Contact support@underbpm.com about data and rights.

Producers and payment providers may have their own responsibilities for information received in connection with a transaction. The categories below explain actual processing and the relevant grounds where GDPR applies; providing required transaction data is necessary to deliver the requested service, while analytics is optional.

We process account identifiers, email, authentication information and login/security events through Firebase Authentication, and profile names, handles, roles, avatars, biography and links through Firestore and Storage.

The purposes are registration, sign-in, account management, public studio display and security. Contract performance supports account services; legitimate interests support proportionate abuse prevention.

Public profile fields and published content are visible to visitors; authentication credentials are not public. These records are retained while needed for the account, with residual records reviewed after closure for security, disputes or legal obligations.

Avoid publishing information you do not want public.

We process Buyer and Producer identifiers, purchase email, country when supplied, ordered items, prices, discounts, Service Fees, payment and payout references, transaction status, license snapshots and digital-delivery consent including its text, language, server timestamp, version and withdrawal acknowledgement.

We also process subscription and custom-order payment records. These enable payment, delivery, proof of rights, accounting, fraud prevention and dispute handling, based on contract, applicable legal obligations and legitimate interests in transaction evidence.

Stripe/Stripe Connect processes payment details and seller onboarding; UNDERBPM does not store full card numbers or card security codes. Relevant parties receive information necessary for their transaction.

Records may outlast account closure for licenses, outstanding obligations, accounting and claims, with retention determined by the relevant legal period and continuing purpose.

Uploaded audio, separated tracks, covers, filenames, metadata, public Producer names and license settings are stored and processed using Firebase/Google Cloud for publication, previews and licensed delivery.

Contract performance and legitimate interests in operating and promoting the marketplace support these purposes within the permission granted in the Terms. Public listings are visible to visitors; purchased files are delivered to entitled Buyers.

Promotional materials may be shared with YouTube and, when enabled, Pinterest. Such services process published material under their own policies.

Storage continues while publication, delivery of existing licenses, rights verification or disputes require it; removing a listing is not automatic deletion of all originals, purchase records or external copies.

We process custom-order briefs, references, budgets, deadlines, offers, revision comments, previews and final files, and chat messages, participant identifiers and support requests.

They support collaboration, delivery, communications and resolving problems, based on contract and legitimate interests in service support and dispute handling. Relevant project or chat participants receive the shared materials; authorized support personnel may access records for these purposes.

Firebase/Google Cloud stores them and Resend delivers associated emails, including purchase confirmations and notifications. We retain these records for the active relationship and afterwards only as justified by unresolved work, support needs, applicable obligations or claims; expiry is not currently automatic across every collection.

Beat Protection processes subscription identifiers, selected beats, public YouTube video/channel details, search queries, candidate matches, license-check information, review status and notification details to provide monitoring and review.

Contract performance and legitimate interests in protecting rights support this processing. Candidate results are not conclusive infringement decisions and the service does not automatically impose legal penalties.

Google/YouTube, hosting providers and email delivery services receive data needed for the feature. Operational logs, network/device information and stream events may also be processed for delivery, statistics, security and diagnosing faults, on contract or proportionate legitimate-interest grounds.

Keep such records only while needed for the service, incident investigation or claims; provider log retention also applies.

Necessary cookies or browser storage support authentication, security, cart state, language and consent preferences.

Optional Google Analytics/Firebase Analytics measures usage and device/browser information only after analytics consent; where GDPR applies, consent is the basis for this optional processing. The consent-choice cookie is currently set for one year; other storage duration depends on its purpose and the provider configuration.

Use “Cookie settings” in the footer to accept or refuse analytics later. Withdrawal stops future optional collection and removes accessible analytics cookies; it does not erase data already lawfully processed or records required on other grounds.

Browser controls can clear local storage but may sign you out or reset your cart.

Recipients include Firebase/Google Cloud for authentication, database, storage and hosting; Stripe/Stripe Connect for payments and onboarding; Resend for emails; Google Analytics when consented; and YouTube or enabled Pinterest publication for the disclosed features.

Buyers, Producers, project participants and authorized support staff receive only information relevant to their roles. Legal authorities or advisers may receive data when required by law or necessary for legitimate claims.

We do not sell personal data. International providers and their subprocessors may process data outside your country, including outside the EEA.

Applicable transfer requirements still apply; the relevant mechanism depends on the provider, processing location and contractual arrangement. Contact support for information about the safeguards applicable to your data; no claim is made that all data remains in the EU.

Retention is determined by the service purpose, account status, license validity, unfinished orders, billing or accounting requirements, fraud/security investigations and limitation periods for claims.

There is no single fixed period for all data. Account deletion currently removes the authentication account, principal profile/user documents and selected order/sales subcollections; it is not an automatic purge of every chat, project, uploaded file, subscription or central order record.

Remaining data must be reviewed against its continuing purpose. Contact support for a broader erasure request; information no longer justified should be deleted or anonymized, while legally necessary records may be retained with restricted use.

Cancel paid subscriptions separately before closing the account. Deletion is not guaranteed to remove copies already received by transaction participants or published by third parties.

Where applicable, you may request access and a copy, correction, erasure, restriction, portability of eligible data, and object to processing based on legitimate interests, including direct marketing.

You may withdraw consent at any time without affecting prior lawful processing. Rights and exceptions depend on the applicable law and are not limited merely by where you currently browse from.

Contact support@underbpm.com; proportionate identity verification may be needed before disclosure or changes. We handle requests within applicable statutory deadlines.

You may complain to a competent supervisory authority, including where you habitually reside or work or where an alleged infringement occurred. You do not have to contact us first.

We use authentication, access controls and technical safeguards appropriate to the service, but no system can be guaranteed secure.

Authorized administrative access is used for account support, moderation, payment issues and security; uploaded files and messages should not be assumed to be end-to-end encrypted. Protect your credentials and report suspected unauthorized access to support.

Only provide materials you are entitled to share. Where legally required, relevant security incidents will be handled and notified under applicable law.

The service is intended for users aged 18 or over.

Contact support if you believe an ineligible person has supplied data. This policy is updated when processing changes, with notice or renewed consent where required.

A policy update does not itself authorize a new incompatible purpose or remove existing rights. For requests, privacy questions, retention details and information about provider safeguards contact support@underbpm.com.

Updated: 24 September 2026; version 2026-09-24.1.