LOADING…
0%
Back to home

Privacy Policy

Last updated: July 13, 2026

This Privacy Policy explains how [Company Legal Name] ("Grainstash", "we", "us") collects, uses, and shares personal data when you use the Grainstash platform (the "Service"). The data controller is [Company Legal Name], [Jurisdiction]. If you have questions or want to exercise your rights, contact us at support@grainstash.com.

1. Data we collect

Information you provide

  • Account data: your name, email address, profile details, avatar, and the identifier from the sign-in provider you use (such as Google).
  • Content you upload: audio files, artwork, pack and sample titles, descriptions, and tags.
  • Seller and payout data: information needed to onboard with our payments provider and receive payouts. Identity, bank, and tax details for payouts are collected and held by Stripe, not stored by us.
  • Communications: messages you send us, such as support requests.
  • Producer tag generator data: the email address and tag phrase you submit, the generated tags, and whether you choose to receive marketing emails. Marketing consent is optional and is not required to generate tags.

Information collected automatically

  • Usage and analytics data: pages viewed, previews played, purchases, and similar events, used to operate and improve the Service.
  • Device and log data: IP address, browser type, and timestamps, collected for security, debugging, and abuse prevention.
  • Cookies and local storage: used to keep you signed in and remember preferences. See the Cookies section below.

Information from third parties

  • Sign-in providers share basic profile information (such as name and email) when you authenticate.
  • Stripe shares transaction status and limited payout information so we can display your sales and earnings.

2. How we use your data

  • to provide, maintain, and secure the Service and your account;
  • to host, process, transcode, and analyze your content (including AI-assisted tagging, BPM/key detection, and similarity search) and generate previews and waveforms;
  • to process purchases, calculate marketplace fees, and pay out seller earnings;
  • to provide support and respond to your requests;
  • to generate your producer tags, save them behind a private link for seven days, and prevent abuse of the generator;
  • to send marketing emails about free sounds, production tips, and Grainstash updates only when you have opted in;
  • to detect, prevent, and investigate fraud, abuse, and security incidents;
  • to understand usage and improve features; and
  • to comply with legal obligations and enforce our terms.

3. Legal bases (GDPR)

Where the GDPR or similar laws apply, we rely on these legal bases: performance of a contract (to provide the Service and process your transactions); legitimate interests (to secure and improve the Service and prevent abuse, balanced against your rights); consent (for marketing emails and for non-essential cookies or analytics where required, which you can withdraw); and legal obligation (for tax, accounting, and compliance).

4. How we share data

We do not sell your personal data. We share it with service providers ("processors") who help us run the Service, including:

  • Stripe — payment processing, marketplace payouts, and fraud prevention;
  • Cloudflare R2 (object storage; MinIO in development) — hosting your uploaded files and assets;
  • OpenAI and Fal.ai — AI features such as tagging, descriptions, and pack generation, applied to relevant audio or metadata;
  • Resend — sending transactional emails and, when you have opted in, managing the marketing contact list and sending marketing emails;
  • infrastructure and observability providers that host and monitor the Service.

We may also disclose data to comply with the law or valid legal requests, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

5. International transfers

Some of our providers are located outside your country, including the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable.

6. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. After you close your account, we delete or anonymize your data within a reasonable period, except where we must retain it to comply with legal, tax, accounting, or dispute-resolution obligations, or where it remains in routine backups for a limited time. Transaction records may be retained longer to meet financial and regulatory requirements.

Producer tag audio and its private result link are retained for seven days. We retain the associated email address and phrase until you ask us to delete them, unless limited additional retention is required for legal, security, or abuse-prevention purposes. We may retain a record of consent and withdrawal as needed to honor your preferences and demonstrate compliance.

7. Cookies

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences, and operate the Service. Where required, we use analytics only on the basis of your consent. You can control cookies through your browser settings; blocking strictly necessary cookies may break parts of the Service.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data; to object to or restrict certain processing; to withdraw consent; and to lodge a complaint with your local data protection authority. To exercise these rights, email support@grainstash.com. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights. You can withdraw marketing consent at any time using the unsubscribe link in a marketing email or by contacting us. Withdrawing consent does not affect processing that occurred before the withdrawal.

9. Security

We use reasonable technical and organizational measures to protect personal data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, provide additional notice where appropriate.

12. Contact

For privacy questions or requests, contact us at support@grainstash.com.