Privacy Policy

Effective 29 September 2026

This policy explains what we collect, why, and what you can ask us to do about it. We have written it in plain language and kept it specific to this website rather than filling it with boilerplate.

Wonder Music Factory is the controller of this information. Contact us at [email protected] or by post at [BUSINESS MAILING ADDRESS].

The short version

• We never see or store your card details.
• We do not use advertising trackers or analytics, and we do not sell or rent your information.
• The only cookie we set is the one that keeps your cart and login working.

What we collect

When you contact us

Your first name, last name, email address, your message, and the IP address the message came from. We keep this so we can reply and refer back to the conversation.

When you join the mailing list

Your email address and the date you joined. Nothing else.

When you buy something

We store an order reference, the email address you gave Stripe, the items purchased, the amounts, any discount code used, the payment status, and identifiers that let us match the order to Stripe. We also store the download links issued to you and how many times they have been used.

We do not receive or store your card number, expiry date or security code. Those go directly to Stripe.

Automatically, for security

To prevent spam and password-guessing we briefly log IP addresses against actions such as sign-in and form submissions. These security logs are deleted automatically after 24 hours.

What we do not collect

No analytics, no advertising or social-media trackers, no profiling, no location tracking, and no accounts or passwords for customers.

Cookies

This site sets one cookie, wmfsid. It is a session cookie that remembers your shopping cart and keeps you signed in if you are an administrator. It contains no personal information, is marked HttpOnly and Secure, and expires when you close your browser. It is strictly necessary for the site to work, so it is not used for tracking.

Some pages include content from other companies, which may set their own cookies when that content loads:

• Stripe — on the checkout pages, for payment processing and fraud prevention.
• Spotify — the player embedded on our front page.
• Google Fonts — serves the typefaces used across the site, which involves your browser contacting Google’s servers.
• YouTube — only if you follow a link to our channel.

We do not control those cookies. You can block or delete cookies in your browser settings, though blocking our session cookie will stop the cart working.

Why we are allowed to hold this

• To perform our contract with you — taking payment and delivering your music.
• Our legitimate interests — replying to messages, keeping the site secure, and keeping accurate business records.
• Your consent — for marketing emails, which you can withdraw at any time.
• Legal obligation — retaining records needed for tax and accounting.

Who we share it with

Only the services needed to run the shop: Stripe (payments), our web hosting provider (which stores the site and its database), and our email provider (to send and receive messages). We do not sell, rent or trade your information, and we do not share it for advertising.

We may disclose information if the law requires it, or to protect our rights or someone’s safety.

How long we keep it

• Order records — for as long as tax and accounting rules require, typically seven years.
• Download links — 60 days from purchase, then they expire.
• Contact messages — while they are useful for supporting you, then deleted on request.
• Mailing list — until you unsubscribe or ask to be removed.
• Security logs — 24 hours.

Children

Our music is made for children, but the site is intended for adults to use and purchase from. We do not knowingly collect personal information from children under 13. If you believe a child has given us their details, contact us and we will delete them promptly.

Your rights

You can ask us to give you a copy of what we hold, correct anything wrong, delete it, restrict or object to how we use it, or send it to another provider. To unsubscribe from emails, use the link in any email or just ask us.

Email [email protected] and we will respond within 30 days. Depending on where you live, you may also have the right to complain to a data protection authority. We will never charge you a different price or refuse service for exercising these rights.

Security

The site is served over HTTPS. Administrator passwords are stored hashed, never in readable form. Purchased audio files are kept outside the publicly reachable part of the server and can only be retrieved through a private link tied to your order. No system is perfectly secure, but we take this seriously and review it.

Where your data is held

Our website and database are hosted in the United States. Stripe processes payments in accordance with its own privacy policy. If you are outside the United States, your information will be transferred to and processed there.

Changes

If we change this policy we will update the effective date above, and say so more prominently if the change is significant.