Privacy Policy

1. What we collect

• Order data: your email address, the product purchased, amount, currency, transaction ID, country and invoice data. Card details are never seen or stored by us — they are handled by our payment provider.
• Free download data: the email address you enter to unlock a free MIDI, plus which files you downloaded and when.
• Marketing consent: whether you opted in to emails, when, and the wording you agreed to.
• Usage data: pages viewed, clicks on key buttons, referrer and campaign parameters (utm_source and similar), and a randomly generated session identifier.
• Technical data: IP address, approximate country, device and browser information, and server logs used for security and fraud prevention.
• Support data: the content of messages you send us, including withdrawal and refund requests.

2. Why we use it

• To process your order, deliver your download and send your order confirmation and invoice.
• To provide customer support and handle withdrawal, refund and warranty requests.
• To deliver free MIDI downloads and enforce the daily download limit.
• To keep the shop secure and prevent fraud, abuse and chargeback fraud.
• To measure how the shop performs (visitors, conversions, sales) and improve it.
• To measure and improve our advertising, where you consented.
• To send marketing emails — only if you opted in.

3. Legal bases (GDPR)

• Performance of a contract, Art. 6(1)(b) GDPR — processing your order, delivering files and providing support.
• Legal obligation, Art. 6(1)(c) GDPR — tax and accounting records for invoices.
• Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG — non-essential cookies, advertising and analytics technologies, and marketing emails. You can withdraw consent at any time with effect for the future.
• Legitimate interests, Art. 6(1)(f) GDPR — security, fraud prevention and basic, aggregated measurement of how the shop is used.

4. Who we share data with

We do not sell your personal data. We share it only with service providers:

• Paddle.com (Paddle.com Market Ltd, UK) — Merchant of Record for all orders. Paddle processes your payment, billing address, tax data and refunds as its own controller under its privacy policy.
• Supabase / Lovable Cloud — database and backend hosting for order records, email list and analytics events.
• Bunny.net — file storage and CDN used to deliver downloads, previews and video.
• Email delivery provider — sends your order confirmation, download links and (if opted in) newsletters.
• Meta Platforms Ireland Ltd — Meta Pixel and Conversions API for advertising measurement, only with your consent. Purchase events are sent from your browser and from our server; your email address is transmitted only in irreversibly hashed form.
• Google Ireland Ltd — analytics and, where switched on, advertising, only with your consent.
• Professional advisors and authorities where the law requires it.

Some providers may process data outside the EEA, including in the United States. Those transfers are covered by the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

5. Advertising and measurement

With your consent we use the Meta Pixel and the Meta Conversions API to measure which ads lead to sales, and analytics to understand how the shop is used. No advertising or analytics technology is loaded and no non-essential cookie is set before you have made a choice.

• Data processed: IP address, browser and device information, the page you are viewing, advertising identifiers stored in cookies, the products you viewed or bought, the order value and a hashed version of your email address (from checkout or, if you requested a free MIDI, the email you entered there; it is also used to prefill the checkout).
• Server-side events are matched to browser events using the same event ID, so a purchase is only counted once.
• Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future.

You can review or change your decision at any time using the "Privacy choices" link in the footer or on the Cookie Policy page.

6. Email marketing

Marketing emails are opt-in. Every email includes a one-click unsubscribe link and unsubscribing never affects your purchases or downloads. We still send essential service emails such as order confirmations, download links and important policy notices.

7. How long we keep data

• Order and invoice data: 10 years, as required by German tax and commercial law (§ 147 AO, § 257 HGB).
• Email list entries: until you unsubscribe or ask for deletion, plus a short suppression record so we do not email you again.
• Free-download records: 24 months, to enforce download limits and detect abuse.
• Analytics events: 14 months.
• Server and security logs: up to 90 days.
• Support messages, including withdrawal requests: 3 years after the case is closed.

8. Your rights

You have the right to access, correct, export, delete or restrict processing of your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Write to hi@tuffmidi.com and we will respond within the period required by law (normally one month).

You also have the right to complain to your local data protection authority. For our location this is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

9. Security

Data is stored on managed cloud infrastructure with encryption in transit. Product files are held in private storage and served through signed, expiring download links. No system is perfectly secure — tell us at hi@tuffmidi.com if you suspect a problem.

10. Children

The shop is not intended for children. We do not knowingly collect data from persons under 16. If we learn that we hold such data, we delete it.

11. Changes and contact

We may update this policy; the date at the top always shows the current version. Contact: Dennis Buller (Einzelunternehmen), Paulinenstr. 14a, 32832 Augustdorf, Germany, hi@tuffmidi.com. See also our Imprint.