Privacy Policy

This policy explains what information Beat Protector collects, why, who can see it, how long it's kept, and the choices you have. Beat Protector lets music producers share beats behind their own license terms: artists agree to the terms before they can preview or download the producer's files, and the agreement is recorded for the producer.

Questions or requests: admin@beatprotector.com.

Who this covers

• Producers — people who create an account, connect Dropbox and publish license pages.
• Artists — people who open a producer's page, agree to the terms and get the files. Artists don't need an account.

What we collect

From producers

• Account details: your display name and email address. If you sign up with email and password, your password is handled by Google Firebase Authentication and is never visible to us. If you sign in with Google, we receive your name and email address from Google.
• Your landing pages: the producer name, license terms and Dropbox folder you choose for each page.
• Your Dropbox connection: when you connect Dropbox, we store an access token (encrypted) and your Dropbox account ID so we can list the folder you choose and deliver its files to artists who agree to your terms. Beat Protector only has access to its own app folder in your Dropbox, not the rest of your Dropbox.
• A rate-limit marker: the time you last created a page, used to prevent spam.

From artists

• The agreement: your legal name, artist or stage name, email address, the exact license terms you agreed to, and the date and time you agreed.
• The licensed files: the names, folders and sizes of the files in the producer's folder at the moment you agreed, and a fingerprint of each file provided by Dropbox, so there's a record of exactly what was licensed.
• Downloads: which file you downloaded and when. Previews (listening in the player) are not recorded.
• A download pass: a private link that lets you get the files for 7 days after agreeing.

Collected automatically

• Bot protection: we use Google reCAPTCHA Enterprise through Firebase App Check to make sure requests come from our real website and not from bots. Google may collect information about your browser and device for this purpose, under Google's Privacy Policy.
• Server logs: our hosting and cloud providers keep standard technical logs (such as IP address, browser type and time of request) to run and secure their services.
• Sign-in storage: if you're a producer, your browser stores your sign-in session so you stay logged in. This is needed for the site to work.

We don't use analytics, advertising or tracking cookies, and we don't collect payment information.

How we use it

• To run the service: create accounts, publish pages, record agreements and deliver files.
• To show producers who agreed to their terms, which files were licensed and which were downloaded.
• To send account emails, such as email verification and password resets.
• To keep the service secure and prevent abuse and spam.
• To comply with the law and respond to valid legal requests.

We don't sell your personal information, and we don't share it for advertising.

Who can see it

• The producer whose page you signed sees your agreement (legal name, artist name, email, terms, time, licensed files) and your downloads. That's the purpose of the agreement: it's the producer's record of who licensed their work. No other producer can see it.
• Service providers who run parts of Beat Protector for us, only to provide their service:
  • Google (Firebase Authentication, Cloud Firestore database, Cloud Functions, Secret Manager, App Check and reCAPTCHA Enterprise, Google Fonts, and Google Sign-In if you use it)
  • Dropbox (stores the producer's files and delivers them to artists)
  • Vercel (hosts the website)
• Legal requirements: if we're required to by law, or to protect the rights, safety or property of our users or others.

How we protect it

• All connections use HTTPS, and our providers encrypt stored data.
• Dropbox access tokens are additionally encrypted with a separate key, so a copy of the database alone can't be used to open anyone's Dropbox.
• Database rules make sure producers can only see their own pages, agreements and downloads. Agreements can't be edited after they're made.
• Files go directly from the producer's Dropbox to the artist; Beat Protector doesn't store copies of them.

No system is perfectly secure, but we work to protect your information and will notify affected users if a breach affects their personal information, as required by law, including New York's SHIELD Act.

How long we keep it

• Producer accounts, pages, agreements and download records are kept while the producer's account exists, because they're the producer's licensing records.
• Download passes are deleted automatically after they expire.
• Unfinished Dropbox connections and spam-prevention markers are deleted automatically within about a day.
• When a producer deletes their account, their login, pages, every agreement signed on their pages, download records and Dropbox connection are permanently deleted, and our access to their Dropbox is revoked.
• Our providers may keep technical logs for a limited time under their own policies.

Your choices and rights

Producers

• See your data on your Dashboard, My Pages, Agreements and Downloads pages.
• Download your data as a spreadsheet from the Account page.
• Delete your account and all its data from the Account page.
• Disconnect Dropbox at any time from the create page, or from Dropbox's own settings.

Artists

Email admin@beatprotector.com to ask for a copy of your information, or to have it corrected or deleted. We may need to confirm your identity first. Because an agreement is also the producer's record of a license, we may let the producer know about a deletion request before acting on it.

Everyone

Depending on where you live, you may have additional rights under privacy laws, such as the right to access, correct, delete or get a copy of your personal information, and the right not to be discriminated against for using these rights. You can use them by emailing admin@beatprotector.com. We aim to respond within 30 days.

Age requirement

Beat Protector is for people 18 and older. We don't knowingly collect information from anyone under 18. If you believe someone under 18 has used the service, contact us and we'll delete their information.

Where data is processed

Beat Protector is based in New York, United States, and our providers may store and process information in the United States and other countries. By using the service, you understand your information may be processed outside your home country.

Changes to this policy

We may update this policy as the service changes. We'll change the "Last updated" date above, and for significant changes we'll give notice on the site or by email.

Contact

Beat Protector — admin@beatprotector.com