Plain-English summary: We collect your name, email, and order brief to deliver your music. We store it securely on Cloudflare infrastructure. We don't sell it, share it with advertisers, or use it for anything beyond fulfilling your order. You can ask us to delete it at any time.
1. Who We Are
ΑΠΛΟ Audio is a sole-trader music production service operated by Thembinkosi Kweya, based in Lusaka, Zambia. For the purposes of data protection law, Thembinkosi Kweya is the data controller for personal information collected through this website (aplosaudio.com).
Contact: aploaudio@gmail.com
2. What We Collect and Why
When you place an order we collect:
- Name and email address — to identify your order, deliver files, and communicate about your project.
- Brand or agency name — to understand the context of the ad brief.
- Creative brief / vibe notes — to produce music that matches your requirements.
- IP address — collected automatically by our server to prevent abuse and rate-limit submissions. Not used for tracking.
- Payment confirmation — we receive a payment reference from Gumroad after a successful sale. We do not receive or store your card number, bank details, or any payment instrument data. All payment processing is handled by Gumroad under their own privacy policy.
We do not use cookies for tracking, advertising, or analytics. We do not run Google Analytics, Meta Pixel, or any third-party tracking scripts.
3. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area or United Kingdom, we process your personal data on the following legal bases:
- Contract performance (Art. 6(1)(b) GDPR) — processing your name, email, and brief is necessary to fulfil the order you placed.
- Legitimate interests (Art. 6(1)(f) GDPR) — retaining IP addresses to prevent fraudulent submissions and rate-limit abuse.
4. How We Store Your Data
Order data is stored in a Cloudflare D1 database (SQLite) hosted on Cloudflare's global infrastructure. Cloudflare is certified under the EU-U.S. Data Privacy Framework and processes data under standard contractual clauses where applicable.
Audio files you receive are delivered via Google Drive or similar. Files stored there are subject to Google's privacy policy.
We do not transfer your data to any country outside of Cloudflare's standard infrastructure regions without appropriate safeguards in place.
5. How Long We Keep It
We retain order records for up to 3 years from the date of the order for accounting and dispute resolution purposes. After that period, records are permanently deleted. You may request earlier deletion at any time (see Section 7).
6. Who We Share It With
We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly to operate the service:
- Cloudflare — infrastructure, database, and edge functions hosting.
- Gumroad — payment processing. Gumroad receives your email to issue a purchase receipt and send payment confirmation. Their privacy policy applies to data they collect.
- Resend — transactional email delivery (order confirmations). Your email address is passed to Resend solely to send the confirmation email.
We may disclose data if required by law, court order, or regulatory authority in Zambia or any jurisdiction with a valid legal claim over the data.
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — request deletion of your personal data ("right to be forgotten").
- Restriction — ask us to pause processing while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- California residents (CCPA) — you have the right to know what personal information is collected, to opt out of any sale (we do not sell data), and to non-discrimination for exercising your rights.
To exercise any of these rights, email aploaudio@gmail.com with the subject line "Data Request". We will respond within 30 days.
8. Children
This service is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted personal information to us, contact us and we will delete it promptly.
9. Security
All data is transmitted over HTTPS. Our database is not publicly accessible — it is only reachable through authenticated Cloudflare Functions. We apply rate limiting to prevent automated abuse. No system is perfectly secure; if you become aware of a security issue, please contact us immediately.
10. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. Continued use of the site after a change constitutes acceptance of the revised policy. For material changes, we will notify active clients by email where possible.
11. Contact
For any privacy-related questions, requests, or complaints:
Thembinkosi Kweya
ΑΠΛΟ Audio
Lusaka, Zambia
aploaudio@gmail.com
If you are in the EEA and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.