Privacy Policy

1. Data Controller

Beatmaker is operated by yufe99, an individual developer based in Zhaoqing, Guangdong, China ("we", "us", or "our"). We are the data controller for the personal data described in this policy. Our privacy contact is [email protected]. We have no Data Protection Officer: this role is not required for our processing.

2. What We Collect

We collect only what the Service needs:

• Account data (only when you sign in with Google to buy something): your name, email address, and profile picture from Google, plus your credit balance and purchase history.
• Content you create: your beat patterns, tempo, and settings, stored in your own browser (localStorage) unless you export a file.
• Support messages: the email address and content of messages you send to [email protected].

We do not collect or store card numbers. Payments are handled by Waffo Pancake; your card details go to them, not to us. We do not collect location data, and we run no analytics in v0.

3. How We Use Your Data

We use your data only for these purposes, each with its legal basis under GDPR Article 6:

• To provide the Service and tie purchases to your account — contract, Art. 6(1)(b).
• To process payments through Waffo Pancake — contract, Art. 6(1)(b).
• To reply to your support messages — legitimate interest, Art. 6(1)(f).
• To keep the Service secure and prevent abuse — legitimate interest, Art. 6(1)(f).
• To comply with tax and accounting obligations for transactions — legal obligation, Art. 6(1)(c).

We do not use your data for marketing in v0, and we do not sell your personal data.

4. Cookies and Tracking

We use browser localStorage (not third-party cookies) to store your session, patterns, and credit balance on your own device. This is strictly necessary for the Service to work and cannot be turned off. We use no analytics tools and no marketing pixels in v0. If we add analytics in the future, we will name the tool here and give you a way to opt out of non-essential tracking.

5. Sharing and Disclosure

We do not sell your personal data. We share it only with these processors, and only as needed to run the Service:

• Google — sign-in (authentication).
• Waffo Pancake — payment processing (PCI-DSS). Your card data never touches our servers.
• Cloudflare — hosting and content delivery.

We may also disclose data if required by law or to protect the Service against abuse.

6. Data Security

We protect your data with TLS encryption in transit, JWT-based authentication for signed-in sessions, and access-controlled server-side storage for account records. We store no passwords: sign-in is handled by Google. In the event of a data breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay and within 90 days of becoming aware of the breach.

7. How Long We Keep Data

• Account data (name, email, picture, credit balance, purchase history): kept while your account is active, and deleted within 90 days after you delete your account.
• Support emails: kept for 12 months after the conversation ends.
• Transaction records: kept for as long as required by applicable tax and accounting laws.
• Data in your browser (localStorage): stays on your device until you clear it.

8. Your Data Rights

Under the GDPR you have the right to access, correct, delete, restrict the processing of, and receive a copy of your personal data (portability); to object to processing based on legitimate interest; to withdraw consent where processing relies on it; and not to be subject to solely automated decisions with legal effect. To exercise any of these rights, email [email protected]. We will respond within 30 calendar days. You also have the right to complain to your local data protection authority.

9. Marketing and Unsubscribing

We do not send marketing emails in v0. If we introduce them, they will be opt-in only, and every message will include an unsubscribe link. Billing and security notices are not marketing and are not covered by unsubscribe.

10. International Data Transfers

Your data may be processed in the United States and the European Union by our processors (Google, Waffo Pancake, Cloudflare). Where data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses (SCCs) or another approved safeguard.

11. Children's Privacy

The Service is not directed at children under 13, and we do not knowingly collect personal data from children under 13 (US COPPA). Under the GDPR the relevant age is 16 in most member states. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

12. Third-Party Links and Services

The Service links to or uses third-party services (Google sign-in, Waffo Pancake checkout). Their privacy policies govern their own processing; we are not responsible for their sites or services.

13. Changes to This Policy

We may update this policy from time to time. For material changes we will give at least 15 days' advance notice on this page. The "Last updated" date at the top shows the current version.

14. Contact Us

For any privacy question, or to exercise your data rights, contact us at [email protected]. This inbox is monitored, and privacy requests sent here are routed to the person responsible.