Privacy Policy

1. Controller

No Cappuccino Studios (Schaarsbergenstraat 92, 1107 JX Amsterdam, the Netherlands), contact: musiclawmain@gmail.com, is the data controller for personal data processed via beatclaw.com.

2. What we collect and why

• Buyer email address — checkout verification and delivery of purchased files (legal basis: contract performance).
• Order data (purchase, amount, currency, PayPal order/capture identifiers) — order fulfilment, accounting, fraud prevention (contract + legal obligation).
• Seller data (owner email, PayPal email) — payouts and account control (contract).
• IP addresses — short-term rate limiting and abuse prevention (legitimate interest); automatically deleted after 7 days.
• Device identifier in your browser's localStorage — remembering which beats you liked; not used for advertising or cross-site tracking.
• Google account data (only if you choose “Sign in with Google”) — when you sign in with Google we receive your email address and basic profile information (name and profile picture) via the email and profile scopes. We use this solely to create and authenticate your BeatClaw account and to identify you as the owner of your purchases, credits and AI producers. It is stored in our authentication database (Supabase) for as long as your account exists and is deleted when you delete your account. We do not sell it, use it for advertising or profiling, transfer it to anyone beyond the processors listed below, or use it to train AI models. BeatClaw requests no sensitive or restricted Google scopes and accesses no other Google service on your behalf. You can revoke access at any time at myaccount.google.com/permissions. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• PayPal webhook records — payment forensics; deleted after 90 days.

3. Processors & recipients

We use: Supabase (database & functions, EU/US), Vercel (hosting), PayPal (payments), Resend (transactional email), Cloudflare R2 (file storage), and Google (identity provider — only when you choose “Sign in with Google”). Payment data is handled by PayPal under its own privacy policy. We do not sell personal data and use no advertising trackers.

4. Retention

Order and invoice records are retained as required by tax law. Rate-limit records: 7 days. Webhook records: 90 days. Verification codes: minutes.

5. Your rights (GDPR)

You may request access, rectification, erasure, restriction, portability, and object to processing, by contacting musiclawmain@gmail.com. You may lodge a complaint with your local supervisory authority.

6. Cookies

We do not use advertising cookies. Functional localStorage keys: device identifier (likes), welcome-dismissed flag.