Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Account data — email address, username, hashed password, profile information, account role
• Transaction data — purchase history, download activity, payout records
• Activity data — wishlists, purchases, written reviews, community posts, Album of the Month and Album of the Year picks, follows
• Technical data — IP address, browser type, session information
• Tour-alert location — an optional country (and, if you choose, a city) that you enter yourself in Settings when you turn on “tell me when bands I collect play near me”. We use it only to match announced tour dates to your country, and for nothing else. We never infer this from your orders or delivery addresses, never share it with sellers or anyone else, and clear it when you turn the feature off.

2. How We Use Your Data

• Operate your account and provide platform services
• Process and fulfil transactions
• Send transactional emails (purchase confirmations, download links)
• Send marketing emails (you may unsubscribe at any time)
• Personalise your experience on the platform
• Detect and prevent fraud
• Comply with legal obligations

3. Legal Basis for Processing

• Contract — processing necessary to provide our service to you
• Legitimate interests — security, fraud prevention, and platform improvement
• Consent — marketing emails, including your per-seller choice to let a specific seller email you, and your optional choice to be told when bands you collect play near you
• Legal obligation — tax records, DMCA compliance

4. Data Sharing

We share data with the following third-party processors only as necessary to operate the platform:

• Stripe — payment processing
• Resend — email delivery
• Cloudflare — file storage
• Neon — database hosting (EU servers)

We do not sell your data to third parties. We do not share your data with advertisers.

Sharing with sellers you buy from. We never give a seller your email address unless you explicitly ask us to. At checkout you may tick an optional, un-ticked box to let a specific seller email you about their future releases and offers. Only then — and only for that seller — do we share your email address with them, so they can contact you directly. This consent is per-seller: it never applies to any other seller, and you can withdraw it at any time in your settings, which removes you from that seller’s list immediately. Without this consent, no seller ever receives your email.

5. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to object — object to certain types of processing
• Right to data portability — receive your data in a portable format
• Right to withdraw consent — for marketing emails at any time
• Withdraw per-seller email consent — in Settings under “Sellers who can email you”, which removes you from that seller’s list immediately

To exercise any of these rights, email privacy@metal.club. We will respond within 30 days.

6. Data Retention

• Account data: retained while your account is active, plus 2 years after closure
• Transaction records: retained for 7 years in accordance with UK tax law
• Community content: anonymised on account deletion rather than removed

7. Cookies

We use only essential cookies required for the platform to function — session management and authentication. We do not use advertising cookies, tracking cookies, or third-party analytics.

8. Security

We protect your data using HTTPS encryption, bcrypt password hashing, secure token authentication, and regular security reviews. No system is perfectly secure; we will notify you promptly in the event of any breach affecting your data.

9. Changes to This Policy

We will notify registered users by email of any material changes to this policy before they take effect.

10. Contact and Complaints

For any privacy-related enquiries, email privacy@metal.club. If you are unhappy with our handling of your data, you have the right to lodge a complaint with the Information Commissioner's Office: ico.org.uk.