Your data, in plain english.

1. Who we are

safenow is a one-person sample-pack and beat store. Contact [email protected] for the full controller details.

safenow is an independent music-producer's store operating at https://safenowcore.com. The data controller is the legal entity behind the @safenow brand. For data-protection requests — including any questions about who specifically holds your data — write to [email protected] and we will respond within 30 days as required by GDPR.

2. What we collect

Email, IP, device info, purchase history, optional name. Nothing more.

When you use the site, we collect:

• Email address (when you sign in to your account, subscribe to the newsletter, buy a product, or ask for a free beat download).
• Display name (optional, only if you set one in /account/settings).
• IP address and User-Agent string (for security, anti-fraud, and rate limiting).
• A short-lived login token sent to your email when you sign in (deleted after 15 minutes).
• A long-lived session cookie when you stay signed in (90 days; HttpOnly, Secure).
• Purchase records: which packs/beats you bought, when, the price you paid, the country code your payment processor returned, and the version of the license you accepted at checkout.
• License-name: the legal/business name you typed at checkout. We print it onto the per-purchase license certificate PDF as the licensee — that is its sole use, and the field is part of the licensing-contract record. You can change the name on future certificates by editing the field on the next checkout; we do not retroactively rewrite already-issued PDFs.
• Masked IP on certificates: the IP address from which you completed checkout is recorded in masked form (first two octets only, e.g. 203.0.xxx.xxx for IPv4) onto the license certificate PDF as a record of acceptance. The full IP is briefly held in a short-lived "pending order" row (one hour, deleted at capture) and never appears on the certificate itself.
• Download history: which file you downloaded, when, from which IP — kept as evidence for chargeback disputes.
• Anything you type into the on-site AI assistant chat (kept for up to 30 days for service improvement; never matched to your identity).
• If you comment a keyword under one of our Instagram posts or reply to our automated Instagram messages: your Instagram username, the account ID Instagram gives our app, and the comment. Section 10 describes exactly what and for how long.
• Anonymous usage totals: when a page opens, a preview plays (and plays past 30 seconds), or a license dialog, cart or checkout opens, we add 1 to a daily counter for that page or item. With the first page of a visit we also count where the visit came from (the referring site or campaign tag) and whether the device is a phone or a computer. No cookie, no IP address and nothing that identifies you is stored with these counts, so they cannot be linked to you.

We do NOT collect: full payment-card numbers, geolocation beyond country, your social-media profile or followers (the Instagram auto-replies in section 10 see only what you post under our posts or send to our accounts), or third-party tracking data.

3. Why we collect it

To deliver what you bought, fight fraud, and (if you opted in) email you about new drops.

We process your data on the following legal bases:

• Contract performance — we need your email and purchase records to give you access to the files you paid for, and your email to hand you a free beat download you asked for. Giving an email for a free download does not subscribe you to anything; the newsletter needs its own box ticked.
• Legitimate interests — we keep IP addresses and download logs to defend against payment fraud and abusive behaviour, both of which are real and constant for digital-goods stores. We also keep the anonymous usage totals described in section 2, to see which pages and previews people use.
• Consent — newsletter, optional cookies, and the AI assistant chat. You can withdraw consent at any time without affecting any other use.
• Legal obligation — we keep purchase records and tax-relevant data for the period required by tax law in our jurisdiction (typically 5–10 years).

4. Where it lives

Mostly on Cloudflare's European edge. Some processors are in the EU and US.

Our database (D1), file storage (R2), and serverless functions all run on Cloudflare. Our primary data location is "Eastern Europe", though Cloudflare may replicate to other regions for resilience. Specific third-party processors:

• PayPal (Luxembourg / global) — handles payment processing. Sees your name, email, and payment method.
• Cloudflare (US / global edge) — hosts the site and stores all our databases and files.
• MailerLite (Lithuania, EU) — manages newsletter subscriptions.
• Resend (US) — delivers transactional emails (sign-in links, receipts).
• Google Analytics (Google Ireland Ltd / Google LLC, US) — aggregate site analytics. Only active after you accept analytics cookies; see section 6.
• Anthropic (US) — runs the AI model behind the on-site assistant. Receives only the message text you type.
• Gravatar / WordPress.com (US) — provides the sender avatar shown next to our emails. Receives only the public hash of our own sending email, not yours.
• YouTube (Google) — plays the videos shown on our home page, through its privacy-enhanced (youtube-nocookie) player, and only after you press play on one. Until then no request goes to YouTube.
• Spotify (Sweden) — plays the track shown on our home page, only after you press play on it. Until then no request goes to Spotify.
• Meta Platforms (Ireland / US) — operates Instagram. Our Instagram auto-replies (section 10) receive comments and messages through Meta's official Instagram API.

None of these processors sells your data; each is contractually bound to use it only for the purposes above.

5. How long we keep it

Active while your account is open; tax-relevant rows kept for the legal minimum.

• Account email and display name: as long as you have an active account.
• Sign-in tokens: 15 minutes maximum.
• Sessions: up to 90 days from last sign-in.
• Newsletter subscription: until you unsubscribe.
• Free-download requests: the email and the beat are kept with a one-hour download link and then deleted, unless you ticked the newsletter box (then as a subscription, until you unsubscribe).
• Purchases: as long as your account is open. If you ask us to delete your account, the purchase rows are pseudonymised — your email is replaced with a placeholder, but the records themselves are retained for the tax-law period applicable to digital sales.
• License certificates: the per-purchase PDF (containing the license name and masked IP you provided at checkout) is retained for the same period as the parent purchase row, since the certificate IS the licensing-contract evidence. Pseudonymisation of the parent row does not extend to rewriting the certificate's licensee name — once issued, a certificate is immutable so it can be relied on by either party.
• Pending-order rows: one hour. Created at "create-order" to bridge information PayPal cannot carry (license name, full IP); consumed at "capture-order" and deleted; opportunistically wiped on every new checkout.
• Download log: 365 days, then auto-deleted.
• Rate-limit counters: auto-expire (typically minutes to one hour).
• Chat transcripts: 30 days.
• Instagram auto-replies: activity log 90 days; conversation state and the list of answered comments 30 days (section 10).
• Anonymous usage totals: kept as long as the site runs; they contain no personal data.

6. Cookies and similar

Essential cookies and on-device storage always; analytics cookies only if you accept. Change your choice any time via "Cookie settings" in the footer.

Essential cookies — always on, strictly necessary for the site to function:

• A session cookie (safenow_session) issued when you sign in. Used solely to keep you signed in. HttpOnly, Secure, SameSite=Lax, 90-day lifetime.
• A sign-in-with-Google cookie (safenow_oauth_state) set only while you sign in with Google, to protect that sign-in against forgery. HttpOnly, Secure, 10 minutes, deleted as soon as the sign-in completes.
• A pending-claim cookie (safenow_pending_claim) set only when you open a purchase-claim link while signed out, so the purchase can be attached to your account after you sign in. HttpOnly, Secure, 30 minutes, deleted once used.
• Cloudflare's default bot-management cookie (__cf_bm) for security. Set automatically by our hosting platform.

On-device storage (your browser's localStorage) — never sent to us automatically, used only to remember choices on this device:

• your cart (safenow.cart.v1) and a promo code you entered (safenow.cart.couponCode);
• that you accepted the license / EULA before checkout (safenow.license.consent, safenow.eula.consent) and the license name you typed (safenow:licenseName);
• your cookie choice (safenow.cookie.consent), and player volume (safenow.player.volume);
• in the tab's session storage only, a flag (safenow.stats.session) so a visit is counted once; it disappears when the tab closes.

Clearing your browser's site data removes all of it.

Fonts are served from our own domain. The site does not load fonts or other files from Google or any third party before you have made a cookie choice.

Optional analytics cookies — off by default, loaded only after you click "Accept" on the cookie banner:

• We use Google Analytics 4 to understand aggregate traffic and how the site is used (which pages and packs are viewed, where visitors come from, how the checkout funnel performs). This sets Google cookies (e.g. _ga, _ga_*).
• Google Consent Mode is enabled: until you accept, the analytics script is not loaded and no analytics cookies are written. You can decline, and Google Analytics is never loaded. The anonymous usage totals in section 2 use no cookie and are kept either way.
• You can change your mind at any time with "Cookie settings" in the site footer. Declining there stops analytics and deletes the Google Analytics cookies already set on this device.
• Google Analytics is provided by Google Ireland Ltd; data may be processed by Google LLC in the United States under Standard Contractual Clauses. We do not enable Google advertising/remarketing features.

We do not use the Meta Pixel or any advertising/remarketing tracker, and we do not share data with advertising networks.

7. Your rights

Access, correction, deletion, export, opt-out — email us and we will action within 30 days.

Under GDPR (and similar laws like CCPA in California), you have the following rights:

• Access — see what we hold about you.
• Rectification — correct anything that is wrong.
• Erasure — ask us to delete your data. Note that purchase rows are pseudonymised rather than wiped, because we are required to keep them for tax purposes; you can read more in section 5.
• Portability — get a copy of your data in a machine-readable format.
• Restriction / objection — limit how we use your data, or object to a specific use.
• Withdrawal of consent — for newsletters, analytics cookies, and the chat assistant.

To exercise any of these, email [email protected] from the address on file. We respond within 30 days.

You also have the right to lodge a complaint with your local data-protection authority if you believe we have mishandled your data.

8. Children

safenow is not intended for users under 16.

safenow is a commercial music-licensing store and is not intended for users under 16 years of age. We do not knowingly collect data from children. If you are a parent or guardian and believe your child has signed up, contact [email protected] and we will delete the account.

9. Changes

We update this page when we change how we handle data. Effective date stamped at the top.

We may update this policy when we add new processors, change retention windows, or adjust the legal basis for processing. Material changes are reflected by bumping the "Last updated" date at the top of the page. For active subscribers, we may also send an email summarising the change.

10. Instagram auto-replies

Our Instagram accounts answer keyword comments automatically. What that reads, what it keeps, and for how long.

Our Instagram accounts (@safenow.core and @valderway) use an automated assistant we built ourselves, connected through Meta's official Instagram API. When you comment a keyword under one of our posts, it replies under your comment and sends you a direct message with what you asked for, for example a download link. If a giveaway is for followers, it checks whether you follow the account.

What it processes:

• comments on our own posts: your Instagram username, the account ID Instagram gives our app, the comment ID and up to 80 characters of the comment text;
• direct messages and button taps you send to our accounts during a conversation with the assistant (other messages are ignored and not stored);
• whether you follow our account: a yes/no answer from Instagram, asked only after you tap a button in the conversation.

What it keeps, and for how long:

• an activity log (username, account ID, comment ID, comment excerpt, and what the assistant sent): 90 days, then deleted automatically;
• where you are in a conversation (account ID and step number): 30 days after your last interaction, removed in a weekly clean-up;
• the IDs of comments already answered, so nobody gets the same message twice: 30 days, same clean-up.

The assistant does not read your profile, followers or other posts, does not post or act on your behalf, and does not share this data with anyone or use it for advertising. The data is stored on Cloudflare (section 4). Legal basis: legitimate interests, namely answering the request you made by commenting the keyword.

To have this data deleted, see section 11.

11. Deleting your data

Email [email protected]. Website account, newsletter or Instagram data, deleted within 30 days.

To have data we hold about you deleted:

• Website account and purchases: email [email protected] from the address on your account. We delete the account; purchase records are pseudonymised as described in section 5.
• Newsletter: use the unsubscribe link at the bottom of any email, or email us.
• Instagram auto-replies: email [email protected] with your Instagram username and the account you interacted with (@safenow.core or @valderway). We delete the activity-log entries, conversation state and answered-comment records linked to that username and account ID.

We act on every request within 30 days and confirm by email when it is done. Deleting your comment on Instagram does not by itself remove our log entry, so write to us as well.

12. Co-producers

If you co-produced a beat or pack with us: what we keep to share sales with you and pay you.

If you co-produce a beat or sample pack sold on safenow and sign our Collaborator Agreement, we process:

• your credit handle and the email we invite you at;
• what you enter when signing: full legal name, PayPal email for payouts, and optionally your PRO, IPI number and country;
• the signature record: time, IP address and browser user agent, the agreement version and a fingerprint (SHA-256) of the texts you signed;
• your shares, every sale share, refund, payout and payout status.

We use it to run the agreement: to pay your share by PayPal Payouts (PayPal receives your PayPal email and the amount), to send you statements, and to keep accounting and tax records. Legal basis: contract performance and legal obligation.

Your credit handle is shown on the store page of your works. Your name as registered with your PRO (or your handle), your PRO and your IPI are printed on the license certificates buyers of your works receive, so they can credit and register you.

The signature record and payout history are kept for as long as accounting and tax law requires (typically 5 to 10 years); the rest while the agreement applies and then for the same period. The rights in section 7 apply; write to [email protected].