Privacy Notice

FULKLORE is operated by Alexandru Bran. In this notice, "we" and "us" refer to Alexandru Bran, who acts as the data controller for personal data processed through the Service.

We collect and process the following categories of personal data:

• Account data (name, email, username, avatar, password hash) — to create your account and let you sign in. Legal basis: contract performance.
• Profile and studio content (bio, links, images, uploaded audio, artist notes) — to publish and operate your public presence on the Service. Legal basis: contract performance.
• Activity data (plays, favorites, follows, comments, mood votes) — to power discovery, statistics, and personal library features. Legal basis: contract performance and legitimate interests in operating the Service.
• Support and communications (messages you send us) — to respond to your inquiries. Legal basis: legitimate interests.
• Technical data (IP address, device and browser, log data) — for security, fraud prevention, and reliability. Legal basis: legitimate interests and, where required, legal obligation.
• Purchase and subscription data — order details, purchase history, and subscription status. Payment card details are processed by Paddle (see below), not by us. Legal basis: contract performance and legal obligation.

• Paddle.com — our Merchant of Record and reseller for all orders, subscription management, payments, tax compliance, and invoicing. Paddle collects payment data directly from you at checkout.
• Infrastructure providers — hosting, database, storage, and email delivery providers that operate the Service on our behalf under confidentiality obligations.
• Authorities — where required by law, court order, or to protect our rights, users, or the public.
• Professional advisers — accountants and lawyers, where reasonably necessary.

We do not sell personal data.

We keep personal data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations (for example, tax records) and to resolve disputes. When data is no longer needed, we delete or anonymise it.

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, port, or object to processing of your personal data, and to withdraw consent where processing is based on consent. If you are in the UK or EEA, you have these rights under the UK GDPR / GDPR and may lodge a complaint with your local supervisory authority. To exercise your rights, contact us through the in-app support channels. We aim to respond within one month.

Our providers may process data outside your country of residence, including in the United States and elsewhere. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

We use appropriate technical and organisational measures — including encryption in transit, access controls, and least-privilege database policies — to protect personal data. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you as required by law.

We use strictly necessary cookies and local storage to keep you signed in and remember preferences (for example, your chosen theme). We may use privacy-respecting analytics to understand overall usage. Where required by law, we ask for your consent before setting non-essential cookies.

We may update this notice. Material changes will be highlighted in-app.

Questions? Reach us through the in-app contact channels associated with your account.