Privacy Policy

Who we are

w8v is an underground electronic music marketplace operated by w8v, based in Spain. When this policy refers to "we", "us", or "our", it means w8v. When it refers to "the platform" or "w8v", it means the website and services available at w8v.io.

For any privacy-related matter, write to us at info@w8v.io.

What data we collect

We collect only what we need to run the platform:

• Account data:Email address, username, and display name when you create an account.
• Artist & label profiles:Name, biography, location, genre tags, social links, and profile photo — only if you set up an artist or label page.
• Purchase history:Records of what you have bought, including amounts paid and timestamps. This is required for your collection, for download access, and for tax and accounting purposes.
• Collection & wishlist:The tracks and releases you own and have saved to your wishlist.
• Follow relationships:Which artists, labels, and other users you choose to follow.
• Profile photo:If you upload an avatar, it is stored on Cloudflare R2.
• Payment data:We do not store card numbers or bank details. Payments are processed entirely by Stripe. We only receive confirmation that a payment succeeded and the amount paid.
• Usage data:Standard server logs (IP address, browser type, pages visited) retained briefly for security and debugging. We run no analytics tracker and set no advertising cookies.

Why we collect it and our legal basis

Under GDPR, we must have a lawful basis for each type of processing:

• Contract performance:We process your account data, purchase history, and collection to deliver the service you signed up for — your account, your music, your downloads.
• Legal obligation:We retain purchase records for seven years to meet Spanish tax and accounting requirements (Ley 58/2003 General Tributaria).
• Legitimate interests:We process server logs for security, fraud prevention, and platform stability. This does not override your rights — the processing is strictly limited and proportionate.
• Consent:If we ever introduce optional features that require additional processing (such as marketing emails), we will ask for your explicit consent at that point.

Third-party services

We use the following processors to operate the platform. Each has a Data Processing Agreement in place with us and handles your data only as instructed:

• Clerk:Handles authentication — sign-in, sessions, and email verification. Data is processed in the US under Standard Contractual Clauses.
• Stripe:Processes all payments. Stripe is the merchant of record for transactions. Subject to Stripe's own privacy policy and PCI-DSS compliance.
• Supabase / AWS:Our database is hosted on Supabase running on AWS eu-west-1 (Ireland) — within the EU/EEA. No data transfer outside the EEA for database storage.
• Cloudflare R2:Stores audio files and images (cover art, profile photos). Cloudflare operates under the EU-US Data Privacy Framework.
• Vercel:Hosts the web application. Vercel uses global edge infrastructure with Standard Contractual Clauses for data transfers outside the EEA.

We do not sell your data to any third party. We do not use your data for advertising or profiling.

Cookies

w8v uses only strictly necessary cookies — session cookies set by Clerk to keep you signed in, and payment cookies set by Stripe during checkout. These are required for the platform to function and do not require your consent under the ePrivacy Directive.

We do not use analytics cookies, advertising cookies, or any third-party tracking pixels.

Your rights

As a person whose data we process, you have the following rights under GDPR and Spanish data protection law (LOPDGDD):

• Access:Request a copy of the personal data we hold about you.
• Rectification:Ask us to correct inaccurate or incomplete data.
• Erasure:Ask us to delete your account and personal data. Note that we are required to retain purchase records for seven years for tax purposes — these cannot be deleted early.
• Portability:Receive your data in a structured, machine-readable format.
• Restriction:Ask us to limit how we use your data while a dispute is resolved.
• Objection:Object to processing based on legitimate interests.

To exercise any of these rights, email info@w8v.io. We will respond within 30 days.

Data retention

We keep your personal data for as long as your account is active. If you delete your account, we remove your profile data promptly. Purchase records are retained for seven years as required by Spanish tax law. Server logs are deleted within 90 days.

Supervisory authority

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Spanish data protection authority:

Agencia Española de Protección de Datos (AEPD)
www.aepd.es

Changes to this policy

If we make material changes to this policy, we will notify you by email or by a notice on the platform before the changes take effect. The "last updated" date at the top of this page reflects the most recent revision.