Privacy policy

Who is responsible

The controller of your personal data is Widing Group AB, trading as Steerner, Malmen 13, 439 35 Onsala, Sweden. VAT number SE559369468901. Privacy contact: steerner@live.com. No data protection officer has been appointed, as none is required for processing of this kind.

What data is collected

• Project submissions: your name or artist name, email address, track or project name, notes you write, reference links you paste, and the audio or project files you upload or link to.
• Enquiries: your name, email address, your message, an optional reference link and an optional audio file.
• Payments: billing country and address, and where applicable a company name and VAT or tax ID. These are collected inside the payment provider’s checkout.
• Technical data needed to serve and protect the site, such as server logs and abuse counters. Card details are never collected or seen by this website.

No identity numbers, phone numbers, demographic data or marketing profiles are requested, and none of the forms ask for information that is not needed to deliver the service.

Why it is collected, and the legal basis

• Delivering your project and communicating about it — performance of a contract (GDPR Art. 6(1)(b)).
• Taking and confirming payment, and issuing accounting records — contract and legal obligation (Art. 6(1)(b) and (c)).
• Keeping the site secure, preventing abuse and answering general enquiries — legitimate interests (Art. 6(1)(f)).
• Any marketing email — only with your separate, freely given consent (Art. 6(1)(a)), which you can withdraw at any time.

How uploaded audio is handled

Uploaded audio, stems and project files are stored in private storage. They are never publicly accessible and are never given a permanent public URL. Access happens only through short-lived, signed links generated on the server after your unique order link has been verified. Files are stored under unpredictable, server-generated paths, and one customer’s link can never reach another customer’s files. Your audio is used only to carry out your project and is not used to train anything, resold, or shared with anyone beyond the processors listed below.

Accessing your order without an account

This site has no customer accounts, passwords or logins. Your order is reached through a unique, cryptographically generated link sent to your email. Treat that link as private — anyone holding it can view that one order. The link can be revoked and re-issued on request.

How long data is kept

• Uploaded project files: removed automatically 90 days after submission.
• Files attached to a general enquiry: removed automatically after 30 days.
• Order and payment records: retained for as long as bookkeeping and tax law requires [retention period to be confirmed with the company’s accountant].
• Enquiry correspondence that does not lead to an order: removed after 12 months.

Retention periods are configurable and can be shortened. Data that must legally be kept is never deleted on request.

Where data is stored, and third parties

The following processors are used. Each one has its own privacy terms, and transfers outside the EU/EEA rely on that provider’s standard contractual clauses.

• Hosting and application platform: Lovable / Cloudflare infrastructure.
• Database and private file storage: Supabase.
• Payments: Stripe. Stripe handles all card data; this website never receives it.
• Email delivery: Resend, for transactional email about your project.
• Hosting region and any further processors: [confirm and list before publishing].

Cookies and analytics

This site sets no analytics, advertising or session-recording cookies. There is no Google Analytics, Meta Pixel, Hotjar or similar tracker. A strictly necessary cookie is used only for the studio’s own admin sign-in, and the payment provider may set cookies inside its own checkout in order to process a payment and prevent fraud. Your booking progress is kept in your own browser’s session storage and never leaves your device until you submit.

Marketing

Buying a service does not sign you up to anything. Emails about your project are transactional and separate from marketing. Any marketing consent would be asked for separately, never pre-ticked, never required in order to buy, recorded with a timestamp, and withdrawable through the unsubscribe link in every such email.

Your rights

Depending on the situation and the legal basis involved, you may have the right to request access to your data, correction of inaccurate data, erasure, restriction of processing, portability, or to object to processing based on legitimate interests. Not every right applies in every case — for example, records that must be kept for accounting purposes cannot be erased on request.

To make a request, email steerner@live.com with your order reference. A response will be given within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Changes to this policy

This policy may be updated as the service changes. Last updated 8 January 2026.