Privacy policy
Who we are
4chordsStudios is the data controller for personal data collected via 4chords.studio and our mobile apps and plugins. Contact: [email protected]. UK Information Commissioner's Office registration: application submitted; reference number will be published once issued by the ICO.
What we collect
- Website: cookie consent state, anonymised analytics events (page views, button clicks), waitlist signups (email + source page), Gate download registrations (email + source page + registration timestamp), contact form submissions (name + email + message), artist release-news signups (email + which artist page + which purposes you ticked + the wording you agreed to).
- Store-button clicks on an artist or song page: a daily count per release and per streaming service. These are counts only. No cookie, identifier, IP address, browser type or time of an individual click is recorded, so these numbers cannot be traced back to you and we could not tell you what any one person clicked. When you tap through to a streaming service, our redirect passes on our own campaign labels from the link you arrived on (the “utm” tags that name the advert or post), and tells the service only that you came from 4chords.studio, not which page you were on. It never passes on an advert click reference or any other identifier. See “Release-news signups” for the only data on those pages that is personal.
- Mobile apps: nothing beyond on-device usage state stored on your device. We do not collect device identifiers, contact lists, or media unless you explicitly share them with a feature (e.g. uploading an audio file to a recorder).
- Plugin storefront (when live): name, email, billing address, payment method (handled by Stripe, so we never see your card number), licence activation history.
Lawful bases
- Contract performance (subscriptions, account management).
- Legitimate interests (basic, anonymised, first-party analytics that help us improve the Service without identifying you).
- Legitimate interests (measuring which of our adverts lead to visits and sales: if you reach us by clicking one of our adverts on Meta or TikTok and you have not clicked Decline on our cookie banner, our server tells that platform, and only that platform, what you then did here, such as landing on the page, playing a song or clicking through to a streaming service, signing up, or starting a checkout, trial or purchase. We send the click reference from that advert’s link, the page address, your IP address, browser type and any order value. No email address, name or other contact details are sent on this basis. The click reference is read from the advert’s link; we never store it or any other identifier on your device, so no cookies or device storage are involved. Clicking Decline stops it, and you can object at any time. See “Advertising measurement”).
- Consent (cookie-based third-party analytics and advertising, namely GA4 and the Meta Pixel, all gated behind our cookie banner).
- Consent (release-news emails, and separately, showing you release news on social media: each is its own unticked box on the signup form and neither is a condition of the other. See “Release-news signups”).
- Soft opt-in (PECR): if you start a checkout but don’t finish it, we may send you one follow-up email reminding you about it, with a link back to checkout to start the 7-day free trial of the same plugins (a card is required and held, not charged). Every such email carries a one-click unsubscribe and we stop immediately if you use it. See “Abandoned-checkout follow-up”.
Advertising measurement
- We use Meta’s and TikTok’s measurement tools to understand which of our adverts lead to visits and sales. This works in two ways, under two different lawful bases. We don’t run a TikTok pixel or any TikTok script on our site: TikTok only ever hears from our server.
- With your consent: if you accept cookies, the Meta Pixel runs in your browser and sets its identifiers (_fbp, _fbc), and we mirror those events to Meta, and our song-page events to TikTok, server-to-server to improve accuracy. With consent, when you sign up, start a trial or buy, these events also include a hashed, irreversible version of your email (and, for a trial or purchase, of your name, billing town, postcode, country and phone number) so the platform can match them.
- Without cookies, under legitimate interest: if you arrived by clicking one of our adverts and have not clicked Decline on our cookie banner, then when you land on our page, play or click through to a song, sign up, or begin a checkout, trial or purchase, our server sends a record of that action to the platform whose advert you clicked (Meta or TikTok), and to no other platform. It contains only the click reference from the advert’s link (read from the link, never stored on your device), the name and time of the action, the page address, your IP address and browser type, and any order value. No email address, name, phone number or other contact details are sent this way, nor any record of the other pages you visit. We also set the platform’s limited-data-use option where it offers one. We never send your card number, and if you did not arrive from one of our adverts nothing is sent this way. Our lawful basis is our legitimate interest in measuring the effectiveness of our own advertising; because nothing is read from or stored on your device, this operates outside the cookie-consent regime.
- Clicking Decline on our cookie banner stops this for you straight away, and we remember that choice on your device (the strictly necessary ‘4cs_consent’ setting). You can change your choice at any time via the link in the footer.
- You can also object to advertising measurement at any time by emailing [email protected], and we will exclude you from it.
- We keep no separate copy of the events we send. Our server’s troubleshooting logs record that an event was accepted (its name, its ID and the platform’s reference) and are rotated automatically.
Abandoned-checkout follow-up
- If you begin a checkout for the plugins but don’t complete it, we may send you a single follow-up email: a reminder, with a link back to checkout where you can start a 7-day free trial of all the plugins. The trial needs a card, which is held and not charged until the trial ends; cancel before then and you pay nothing. The email never issues a licence by itself. We rely on the PECR “soft opt-in”: you gave us your email while starting to buy a similar product, and every message has a clear one-click unsubscribe.
- Every follow-up email contains a one-click unsubscribe; using it stops all such emails immediately. You can also opt out any time by emailing [email protected]. We never share abandoned-checkout details with third parties for their own marketing.
Release-news signups
- Where we offer a release-news signup on an artist or song page, you can ask us to email you when there is new music. Each purpose is a separate box, unticked until you tick it, and you can tick one without the other.
- Release news by email: we email you about new music from that artist and nothing else. Every email has a one-click unsubscribe, and using it stops them immediately.
- Release news on social media: only if you tick that second box, we add a scrambled, one-way (hashed) version of your email address to our own audience on the social platforms we advertise on, so our release news reaches you there as well as by email. We do not send your name, your address in readable form, or anything else, the platforms may not use it for their own purposes, and leaving the box unticked means your address is never sent to a social platform at all. You can withdraw this at any time by emailing us.
- Double opt-in: after you sign up we email you a confirmation link, and we only add you to the list when you click it. The link lasts 7 days. If you never click it, you are never added, and the unconfirmed record is not used for anything else. We never add anyone to a list because they bought something, entered a competition or filled in another form. To come off the list, use the unsubscribe link in any email or email [email protected].
Third parties
We use Google (Analytics, GTM), Meta (Pixel and Conversions API), TikTok (Events API, server-to-server only), Apple (App Store billing), Google Play (Android billing), Stripe (plugin billing), Apple Push Notification Service, LANDR (music distribution for our label), and a UK VPS provider for hosting. Each receives only the minimum data needed for their function.
Retention
Website analytics: 14 months. Waitlist signups: until launch + 90 days, or until you unsubscribe. Release-news signups: until you unsubscribe; an unconfirmed signup is kept for 7 days while its confirmation link is valid. Store-button click counts on artist pages: 14 months, the same window as our website analytics (they are counts, not personal data). Contact form messages: 2 years. Subscription records: 7 years (HMRC requirement). Email marketing: until you unsubscribe.
International transfers
Some third parties (Google, Meta, Stripe) process data in the US. Transfers occur under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Your rights
Under UK GDPR you have the right to access, correct, erase, restrict, port, or object to the processing of your personal data, and to withdraw consent at any time. Email [email protected]. We respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Security
TLS everywhere. No payment card data is stored on our systems. Operational secrets are managed via the VPS host, encrypted at rest. We do not sell your data.
Children
We do not knowingly collect personal data from children under 13. Apps are rated 4+ on the App Store and do not include children-targeted advertising or social features.
Changes
Material changes will be announced 14 days in advance to active subscribers and via a website banner. Last updated: 2026-09-30.