Privacy policy

Last updated: 9 October 2026

This site (“Voidshop”) lets independent artists sell music and merchandise directly to fans. It is run by Voidshop. This policy explains what personal data is processed when you visit, buy, or run an artist page here, and why.

Who is responsible

• Voidshop operates the website and the technical systems and is responsible for the data described below, unless stated otherwise.
• When you buy from an artist, that artist is the seller. We process your order details so the artist can deliver, and the artist may use them for the sale (and, only if you ticked the box, for release news).
• Payments are processed by Stripe as an independent controller. Card and bank details are entered on Stripe's own pages and never reach our servers.

Contact for privacy questions and requests: privacy@voidra.ge

What we collect, and why

Data	Purpose	Legal basis (GDPR)
Buyers: email address, items bought, price, date, payment status, country/shipping address (merchandise only)	Deliver your purchase, send your receipt and download link, handle refunds and support, keep accounting records	Contract; legal obligation (bookkeeping)
Buyers (optional): email for the artist's mailing list	Release news from that artist. Every message contains an unsubscribe link	Consent (the unticked checkbox at checkout)
Download records: time, bytes transferred, a keyed hash of your IP address	Enforce the 3-downloads-per-purchase limit, detect abuse, support	Legitimate interest (protecting artists' work)
Artists: email, password (stored only as a salted hash), artist name, bio, links, uploaded files, sign-in and account-change log	Provide and secure the artist account	Contract; legitimate interest (security)
Security data: keyed hashes of IP addresses for rate limiting and audit entries	Prevent brute-force attacks and abuse	Legitimate interest
Technical logs: server access and error logs (IP address, requested URL, time)	Operate and secure the site	Legitimate interest

We do not use analytics, advertising or tracking tools, we do not sell personal data, and this site loads no third-party scripts, fonts or images. The only external service involved in a purchase is Stripe.

Who receives data

• The artist you buy from (your email, order details and, for merchandise, your delivery address).
• Stripe (payment processing and fraud prevention). See stripe.com/privacy.
• Our hosting and email provider, who process data on our behalf to run the site and deliver email.
• Authorities, when required by law.

Stripe may process data outside the European Economic Area under appropriate safeguards (such as Standard Contractual Clauses).

How long we keep it

• Order records (including the buyer's email): kept as long as accounting law requires (typically 7 years), then deleted or anonymised.
• Mailing-list entries: until you unsubscribe or the artist removes you.
• Rate-limit entries: a few days. Audit entries: up to 12 months.
• Artist accounts and files: until the account is closed. Order history connected to sales is retained as described above.

Security

Connections use HTTPS. Passwords are hashed with a modern algorithm. Original audio files are stored privately and only released through signed, rate-limited download links. Access to artist data is limited to the artist and the platform administrator.

Your rights

You can ask for access to, correction or deletion of your personal data, restriction or objection to processing, and a copy of your data. Where processing is based on consent you can withdraw it at any time (for example with the unsubscribe link). To exercise your rights write to privacy@voidra.ge. If you are unhappy with our answer you can complain to your data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

Some records cannot be deleted immediately because the law requires us to keep them (for example invoices and payment records).

Children

This service is not directed at children under 16, and we do not knowingly collect their data.

Changes

We will update this page when our processing changes. The date at the top shows the latest revision.