Privacy Policy

This Privacy Policy explains how Doxa Music Ltd ("Doxa", "we", "us") collects, uses and protects your personal data when you use the Doxa website, apps and services (the "Service"). We are the data controller for that data.

We are a company registered in England & Wales, and we process personal data in line with the UK GDPR and the Data Protection Act 2018.

1. The data we collect

• Account data — your email address and, if you choose, a display name. You sign in with a one-time link sent to your email, so we don't store a password.
• Payment data — when you subscribe or buy a track, payments are handled by Stripe. We receive confirmation and limited details (such as the last four digits and card type); we do not store your full card number.
• Listening and usage data — what you play, save and buy, and play counts (which we also use to pay artists fairly).
• Device and log data — IP address, browser/device type, and similar technical information needed to run and secure the Service.
• Artist data — for artist accounts, the profile, content and payout details needed to publish music and pay you (payout identity checks are handled by Stripe Connect).
• Communications — messages you send us for support.

2. How and why we use your data

We use personal data on these lawful bases:

• To provide the Service — create your account, stream music, give you access to tracks you buy, save your library (basis: performance of our contract with you).
• To take payment and pay artists — process memberships, purchases and artist payouts, and keep accurate, auditable financial records (basis: contract and legal obligation).
• To run, secure and improve the Service — diagnose problems, prevent fraud and abuse, and understand how the Service is used (basis: our legitimate interests).
• To contact you — service messages such as receipts and account notices (basis: contract), and marketing only where you have agreed (basis: consent — you can opt out at any time).
• To meet legal duties — tax, accounting and responding to lawful requests (basis: legal obligation).

3. Who we share data with

We do not sell your personal data. We share it only with service providers ("processors") who help us run Doxa, under contracts that require them to protect it:

• Stripe — payments and artist payouts.
• Supabase — database, authentication and file storage.
• Mux — audio streaming and delivery.
• Vercel — application hosting.
• Resend / Postmark — transactional email (receipts, account notices).
• Sentry — error and performance monitoring.

We may also disclose data where required by law, to protect our rights, or as part of a business sale or reorganisation.

4. International transfers

Some of our providers process data outside the UK. Where they do, we rely on appropriate safeguards (such as UK adequacy regulations or the International Data Transfer Agreement / Addendum) so your data stays protected.

5. How long we keep it

We keep personal data only as long as needed for the purposes above. Account data is kept while your account is active and for a reasonable period afterwards. Financial records are kept for as long as the law requires (generally six years for UK tax purposes).

6. Your rights

Under UK data-protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time (where we rely on consent).

To exercise any of these, contact us (see "Contact" below). You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to help first.

7. Cookies and similar technologies

We use cookies and similar technologies that are necessary to run the Service (for example to keep you signed in) and, with your consent where required, to understand usage. You can control non-essential cookies through your browser or any cookie settings we provide.

8. Children

The Service is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.

9. Security

We take appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and trusted providers. No system is perfectly secure, but we work to keep your data safe and to notify you and the ICO of any breach where the law requires.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date, and notify you of significant changes where reasonably practicable.

11. Contact

Questions about your data or this policy, or want to exercise your rights? Email us at hello@ecclesia.ventures. We aim to respond within a few working days, and always within the time the law requires.