1. Who we are
This website (the "Site") is operated by UnD3ath (site owner) and Sout (co-founder), an individual business operating under the brand Aqua Sounds ("we", "us", "our"). We are the data controller for the personal data described
in this policy, except for payment and invoicing data collected at checkout, for which our Merchant of Record
(see section 6) acts as the seller of record and data controller. You can reach us at any time at und3ath@aqua-sounds.top.
2. What data we collect
Depending on how you use the Site, we process the following categories of personal data:
- Account data — when you register, we collect your email address and a password. The password is stored only as a salted cryptographic hash by our authentication provider; we never see or store the plain text.
- Authentication session data — signed, encrypted session tokens stored in first-party cookies, used solely to keep you signed in between requests.
- Purchase and entitlement data — which products you have purchased or been granted access to, so the Site can unlock full-track playback. Payment details themselves are not collected by us (see section 6).
- Technical log data — IP address, request time, URL and user-agent, processed automatically by our hosting provider for security, rate limiting and reliability. We do not use this data for advertising or profiling.
- Support communications — if you email us, we keep the correspondence and your email address so we can handle your request.
We do not use advertising or cross-site tracking cookies, and we do not sell or rent personal data.
3. Why we process your data (legal bases)
- Performance of a contract — creating and maintaining your account, providing purchased content, playback access and customer support (GDPR Art. 6(1)(b)).
- Legitimate interests — securing the Site, preventing abuse and fraud, keeping service logs (GDPR Art. 6(1)(f)).
- Legal obligation — retaining transaction records where tax or accounting rules require it (GDPR Art. 6(1)(c)).
- Consent — any optional communication we might ask permission for; you may withdraw consent at any time (GDPR Art. 6(1)(a)).
4. Cookies
The Site uses a strictly necessary session cookie (names beginning with sb-) that stores your
login session. It expires when you sign out or after the session lifetime set by our authentication provider.
Because it is strictly necessary, no consent banner is required for it. No analytics, advertising or third-party
marketing cookies are set by us.
5. Where your data is processed
Our database, authentication and file storage run on Supabase; our frontend is hosted on Vercel's global edge network. Depending on the regions these providers use, your data may be
transferred to and processed in countries other than your own (including the United States). Where required, such
transfers rely on the providers' EU Standard Contractual Clauses or equivalent safeguards. If you are located in
China or elsewhere, please be aware that your data will be processed internationally as described here.
6. Service providers
- Supabase (Supabase Inc.) — account authentication, database and file storage. Processes account credentials and content metadata on our instructions.
- Vercel Inc. — hosting and content delivery of the Site frontend; processes technical request logs.
- Cloudflare, Inc. — DNS, CDN/reverse proxy in front of the Site, and email routing for our @aqua-sounds.top addresses; processes technical request data and forwards support correspondence.
- Resend (Resend Inc.) — transactional email delivery used by our authentication provider to send account confirmation and other auth-related messages, sent from our @aqua-sounds.top domain on our instructions.
- Creem (Creem.io) — Merchant of Record for paid products. When you buy something, Creem processes your payment details, billing address, invoice data and applicable VAT/GST/sales tax, and becomes the data controller for that checkout and payment data under its own privacy policy.
We receive only the information needed to grant access (e.g. your order reference and email).
External links (e.g. to Dizzylab, Afdian or GitHub) may take you to third-party sites with their own privacy practices; this policy does not apply there.
7. How long we keep data
- Account data — for as long as your account exists. If you request deletion, we remove it within 30 days.
- Entitlement records — kept for as long as your account exists; anonymized order references may be retained to prevent refund abuse.
- Support emails — kept up to 24 months after your request is resolved.
- Technical logs — kept by our hosting provider for short periods (typically up to 30 days).
- Transaction records — retained where required by tax and accounting rules (typically 7–10 years, held by Creem as seller of record).
8. Your rights
Where GDPR or similar laws apply, you have the right to:
- access the personal data we hold about you;
- have inaccurate data rectified;
- have your data erased ("right to be forgotten");
- restrict or object to processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time (without affecting prior processing);
- lodge a complaint with your local data protection authority.
California residents have equivalent rights to know, delete and opt out of any "sale" of personal information —
note that we do not sell personal information. To exercise any right, email und3ath@aqua-sounds.top; we respond within 30 days.
We may ask you to verify ownership of the account email before acting on a request.
9. Security
Passwords are hashed by our authentication provider and never stored in plain text. Sessions use signed, HttpOnly
cookies. Audio content is served from private storage via short-lived signed URLs so direct links cannot be shared
or hotlinked. No system is perfectly secure, but we apply reasonable technical and organizational measures
appropriate to a small independent business.
10. Children
The Site is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.
11. Changes to this policy
If we change this policy in a material way, we will update this page, the "Last updated" date above, and, for significant changes, announce them on the Site.