Privacy Policy

1. Introduction

Welcome to the official website of REAL FERM RECORDS LLC ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Submit & Queue System website and services (the "Service"), including when you sign in through Google OAuth.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account or use our Service, we may collect:

• Account Information: Username, email address, display name, and password (if not using Google OAuth)
• Profile Information: Bio and profile preferences
• Submission Data: Artist names, track titles, streaming links, and messages you submit to the queue; and for Audio Services: project file links, session preferences, scheduling windows, genre or style notes, and other intake form data you provide when booking a service
• Communication Data: Messages, feedback, and support communications

2.2 Information from Google OAuth

When you sign in with Google, we receive:

• Basic Profile Information: Google user ID, email address, full name, and profile picture
• YouTube Channel Data (Optional): Channel ID, channel title, subscriber count, and high-resolution avatar

2.3 Automatically Collected Information

We automatically collect certain information when you use our Service:

• Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns
• Device Information: Browser type, operating system, device type, and IP address
• Log Data: Server logs, error reports, and performance metrics
• Cookies and Tracking: Session cookies, authentication tokens, and preference settings, plus Google Analytics and Google Ads cookies on public pages (see Section 4.6)
• Audio Features: For the purpose of analysis, a 30 second clip of your audio submission is extracted and analyzed. The actual audio file clip is stored locally for analysis and will not be shared with anyone. The results are explicitly displayed after your submission is played on the live stream. Nothing personal is stored other than the artist name provided and the title of the track. The rest of the data points are abstract audio features such as genre tags, mood and character descriptors, key signature, spectral analysis, loudness and energy measurements. These stats are saved to the database. Qualitative results (such as genre classifications and mood or character descriptors) may be displayed publicly, attributed to your artist name and track title, on a FERM Lab analysis card and in aggregate community statistics and rankings (E.g. What the distribution of genre tags was for a given week). Technical mixing and mastering measurements (such as loudness, spectral, and stereo analysis) are never displayed publicly. You may request removal of your public analysis card at any time (see Section 5.3). This audio data is NOT used to train any generative models and is not sold or reported to any other entity.

2.4 Payment Information

When you make a purchase through the FERM Store (including Fast Pass tokens or Audio Services):

• We do not collect or store your credit card number, CVV, or full payment card details — this data is transmitted directly to and stored by Stripe, Inc.
• Fast Pass Transaction Records: We store a record of completed transactions including the Stripe session ID, purchase tier, amount, timestamp, and your account ID for order fulfillment, fraud prevention, and support purposes
• Audio Service Order Records: When you purchase an Audio Service, we store an order record including the Stripe session ID, service type, amount, order status, customer email, and the intake form data you submitted (e.g. project file links, notes, preferences). This data is used solely to fulfill your order, communicate with you about delivery, and provide support
• Custom Quote Inquiries: If you submit a project inquiry for a custom-quoted service (such as Full Mix & Master), we store your email address and the submission details you provide in order to respond with a quote. No payment information is collected at this stage
• Billing Details: Any billing name or address you provide to Stripe may be shared with us in tokenized or summary form as part of Stripe's payment confirmation

3. How We Use Your Information

3.1 Service Provision

• Queue Management: Process and display your music submissions in the live stream queue
• Account Management: Create, maintain, and authenticate your user account
• Personalization: Customize your experience and remember your preferences
• Communication: Send service-related notifications and respond to inquiries
• Audio Service Fulfillment: Use your order details and intake form data to deliver purchased Audio Services (track audits, mixing, consultations, session recordings, and custom-quoted projects), communicate about scheduling and delivery, and handle refund or support requests

3.2 Service Improvement

• Analytics: Analyze usage patterns to improve Service functionality and user experience, and measure which advertising and other channels bring artists to the Service (see Section 4.6)
• Performance Monitoring: Monitor Service performance, security, and reliability
• Feature Development: Develop new features based on user needs and feedback

4. Information Sharing and Disclosure

4.2 Limited Sharing

We may share your information only in the following circumstances:

• Public Display: Your chosen username, artist name, track titles, and any streaming links you submit may be displayed publicly on the Service — in the live stream queue, the FERM Lab (including the Feed, analysis cards, community rankings, and voting pools), the Hall of FERM, and public profile history. Qualitative audio analysis results may be displayed alongside these as described in Section 2.3
• Service Providers: Trusted third-party service providers who assist in operating our Service
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In the event of a merger, acquisition, or sale of assets

4.3 Payment Processor (Stripe)

We share limited information with Stripe, Inc. to process purchases (Fast Pass tokens and Audio Services):

• Your email address (for receipt delivery and fraud prevention)
• Transaction amount, currency, and product description
• Device and browser metadata used by Stripe for fraud scoring

Stripe's collection and use of your information is governed by Stripe's Privacy Policy, available at stripe.com/privacy. Stripe is PCI DSS Level 1 certified and we do not store payment card data on our servers.

4.4 Google OAuth Data

Information received through Google OAuth is:

• Used solely for authentication and profile enhancement
• Not shared with third parties beyond the scope described in this policy
• Handled in accordance with Google's OAuth policies and data protection requirements

4.5 YouTube API Services

The Service uses YouTube API Services to power the optional YouTube channel connection. By connecting your YouTube channel, you also agree to the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy.

When you connect your channel, we perform a single read of your own channel's public identity and store only:

• Channel ID and channel title
• Channel avatar URL
• Subscriber count

This information is used to display your connected channel on your account and to recognize your identity in live chat on our streams (for example, crediting stream loyalty rewards to your account). We do not store Google access or refresh tokens, and we do not read your videos, playlists, watch history, or any private YouTube data.

You can revoke this access at any time: disconnect your channel in Account → Settings → YouTube Channel (which deletes the stored channel data), or revoke the app's access entirely via Google security settings.

4.6 Google Analytics and Google Ads

On our public pages we use Google Analytics and the Google Ads tag, both provided by Google LLC, to understand how artists find the Service and whether our advertising works. These tools use cookies and record the pages you visit, how you arrived (for example from an ad or a search), your approximate location, your device and browser, and when our servers confirm one of three actions: joining the live queue, creating an account, or completing a purchase. We also count clicks on links that take you from our site to our YouTube channel or live stream, noting only where on the site the link was.

• What We Never Send: Your name, email address, username, artist name, track titles, song links, account or submission IDs, or payment details
• Pages Never Measured: Sign-in, password-reset, submission-status, checkout, and admin pages do not load these tools
• Cleaned Addresses: Page addresses are reduced to the page itself plus advertising campaign tags before Google receives them
• Purchases: We report the product type and amount, not who made the purchase

Google's use of this information is described in How Google uses information from sites or apps that use its services. Your choices are listed in Section 6.3.

5. Data Security

5.1 Security Measures

We implement appropriate technical and organizational security measures:

• Encryption: Data transmitted using SSL/TLS encryption
• Secure Storage: Passwords hashed using industry-standard bcrypt encryption
• Access Controls: Limited access to personal information on a need-to-know basis
• Authentication: Secure JWT token-based authentication system
• Monitoring: Regular security monitoring and vulnerability assessments

5.2 Payment Data Security

For Fast Pass purchases:

• No Card Storage: We never store full payment card numbers, CVV codes, or magnetic stripe data on our systems
• PCI Compliance: Payment card data is handled exclusively by Stripe, Inc., which is certified as a PCI DSS Level 1 Service Provider
• Transaction Logs: We retain Stripe session IDs and transaction summaries for billing reconciliation, fraud prevention, and customer support

5.3 Data Retention

• Account Data: Retained while your account is active and for a reasonable period after deletion
• Submission History: Historical data may be retained for analytics and service improvement. If you upload audio to the submission form, it is stored for 3 days, then deleted from the server.
• FERM Lab Cards: Public analysis cards remain displayed until you request removal. You can unlist your own card from its page when signed in to the account that owns it, or contact us and we will remove it
• Queue Fairness Data: When you send a song to the live queue, we keep a scrambled code for the network you sent it from (not your IP address itself) for 30 days, so the host can tell when several songs come from the same place. Only the queue's staff can see it, and it is deleted automatically after 30 days
• Log Data: Server logs retained for up to 12 months
• Deleted Accounts: Personal information deleted within 30 days of deletion request

6. Your Rights and Choices

6.1 Account Management

• Access: View and download your personal information through account settings
• Update: Modify your profile information, preferences, and settings at any time
• Delete: Request deletion of your account and associated personal information
• Data Portability: Request a copy of your data in a machine-readable format

6.2 Google OAuth Management

• Account Linking: Link or unlink your Google account through account settings
• Revoke Access: Revoke Google OAuth access through your Google Account settings
• YouTube Data: Control YouTube data access through OAuth scope management
• YouTube Disconnect: Disconnect your YouTube channel in Account → Settings → YouTube Channel (deletes the stored channel data), or revoke access at myaccount.google.com/permissions

6.3 Analytics and Advertising Choices

• Global Privacy Control: If your browser sends a Global Privacy Control signal, our site does not load Google Analytics or the Google Ads tag at all
• EEA, UK, and Switzerland: Visitors in these regions are measured without analytics or advertising cookies
• Opting Out: Install the Google Analytics Opt-out Browser Add-on, manage ad personalization in My Ad Center, or block cookies in your browser settings

7. Regional Privacy Rights

7.1 California Privacy Rights (CCPA)

If you are a California resident, you have the following rights:

• Right to Know: Request disclosure of personal information collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information. We do not sell personal information, and we honor Global Privacy Control signals as an opt-out from Google Analytics and Google Ads measurement (see Section 6.3)
• Right to Non-Discrimination: No discriminatory treatment for exercising CCPA rights

7.2 European Privacy Rights (GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights:

• Access: Request access to your personal data
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Request transfer of your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for processing (where applicable)

8. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• Notification: We will notify users of material changes via email or prominent notice
• Effective Date: The updated Privacy Policy will include a new effective date
• Continued Use: Your continued use constitutes acceptance of the updated Privacy Policy

10. Contact Us

If you have questions about this Privacy Policy, please contact us:

Response Time

• General Inquiries: 5 business days
• GDPR Requests: 30 days (may be extended to 60 days for complex requests)
• CCPA Requests: 45 days (may be extended to 90 days for complex requests)
• Data Deletion Requests: 30 days