Privacy Policy

This policy explains what Leonardo Rayner, doing business as StemSpace (“StemSpace”, “we”) collects when you use StemSpace, what we do with it, and what you can do about it. It goes with our Terms of Service.

1. What we collect

What you give us:

• Account details: your name, handle, email address, and a password (we keep only a scrambled version of it, never the password itself).
• Your profile: bio, picture, banner, social links and settings.
• Your content: releases, audio and image files, comments, messages, likes, follows, playlists, and the terms you set or agreed to.
• Reports and copyright notices you send us, including the contact details in them.
• Anything you write to us by email.

Billing: paid plans are handled by Stripe. Stripe collects your card details. We receive only your plan, billing period, status and a Stripe customer reference, never the full card number.

Collected automatically:

• Your IP address and browser details, which our servers receive with every request and keep in short-lived logs.
• A scrambled (hashed) fingerprint of your IP address and browser, used only so a repeat download within the hour is counted once.
• Records of sign-in attempts and password-reset requests, kept briefly, to block guessing attacks. These use scrambled versions of the email address and IP address.
• The date and release of each download, so creators can see how many downloads they have.
• The cookies described in section 4.

2. How we use it

• To run your account, show your profile and content, and deliver downloads.
• To sign you in and keep the site secure, including stopping attacks and abuse.
• To send emails that the service needs: confirming your address, password resets, security notices, billing notices, and replies to reports and notices.
• To take payments through Stripe and manage your plan and referral credits.
• To review reports and copyright notices, and to enforce our Terms.
• To fix problems and improve the site.
• To meet legal duties.

We do not use your content to train AI models, and we do not send marketing email you have not asked for.

3. Who sees it and who we share it with

Other people. Your profile, releases and comments are public unless you set them otherwise. If you follow or download from a creator, they can see your name and handle. If a creator asks for your email in return for a release and you give it, they receive it.

Companies that help us run StemSpace and may handle your data on our behalf:

• Amazon Web Services: hosting, the database, file storage and delivery.
• Stripe: payments and billing.
• Resend: sending our emails.

Others. We share data when the law requires it, when someone sends a valid copyright notice or counter-notice (the other party receives the contact details in it), to protect people’s safety or our rights, or if StemSpace is sold or merged (we would tell you first). We do not sell your personal information and we do not share it for advertising.

4. Cookies and browser storage

We use only the cookies the site needs to work:

• A sign-in cookie that keeps you signed in (up to 7 days). Page scripts cannot read it.
• A browser cookie (up to a year) that lets us recognise a browser you have already signed in from, so someone else guessing your password cannot lock you out. We keep only a scrambled version of it.

Some features also keep settings and data in your browser’s own storage on your device. We do not use advertising cookies or analytics trackers. You can clear cookies and storage in your browser at any time, which signs you out.

5. How long we keep it

• Account, profile and content: until you delete them or close your account.
• Sign-in attempt records: a few days.
• Server logs: about 14 days.
• Billing records: as long as tax and accounting law requires.
• Reports, copyright notices and counter-notices: as long as needed to meet legal duties and handle disputes.
• Backups: copies are removed on their normal schedule after you delete something.

6. Security

Connections are encrypted, passwords are stored hashed, sign-in is rate limited, and access to our systems is restricted. No system is perfectly secure, so please use a strong, unique password.

7. Your choices and rights

You can change your profile and settings in your account. You can ask us to give you a copy of your data, correct it, or delete it (and close your account) by emailing legal@stemspace.io. We answer within 30 days. We may keep what the law requires us to, such as billing records and copyright notices. Browser notifications can be turned off in your browser. Emails about your account and security cannot be turned off while you have an account.

US state privacy laws (such as California’s) give residents rights to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information for advertising, and we do not treat you differently for using these rights. Email us to use them.

If you are in the UK or European Economic Area, you also have the right to object to or restrict some processing and to complain to your local data protection authority. We handle your data because we need it to provide the service you asked for (contract), for our legitimate interests in running and securing it, to meet legal duties, and where you have given consent.

8. Where your data is

StemSpace is run from the United States and your data is stored on servers there. If you use it from elsewhere, your data is sent to the United States.

9. Children

StemSpace is not for children under 13, and we do not knowingly collect their data. If you think a child has made an account, email us and we will delete it.

10. Changes

We may update this policy. For important changes we will email you or show a notice on the site before they apply. The date at the top shows when it last changed.

11. Contact

Privacy questions and requests: legal@stemspace.io. Help with your account: support@stemspace.io.