Privacy policy
Last updated: 17 October 2026.
Who is responsible
The data controller is Giulio Poletti, Via dei molini 18, 33017 Tarcento (UD), Italy. Contact: music@everlightharmonies.com.
Hosting
This website runs on Cloudflare (Cloudflare, Inc., USA, certified under the EU-US Data Privacy Framework). To deliver pages and protect the site against attacks, Cloudflare processes technical data such as your IP address and browser details. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
The listening cookie
We set one cookie, eh_vid, containing a random ID. It counts how often a track has been played in your
browser (each track can be played a few times for free before we ask you to join the mailing list or buy it) and
remembers that you joined or bought something. It is stored for up to 400 days. We use it to provide the listening
service you request and manage access to your collection. We use no advertising cookies or third-party analytics.
Fonts are hosted on our own server.
Mailing list
If you join our mailing list, we store your email address and when you agreed and confirmed (double opt-in). We use it only to tell you about our music. Emails are sent with Brevo (Sendinblue SAS, France). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email or by writing to us. Joining the list is voluntary; a purchase does not subscribe you to newsletters.
Purchases
Payments are handled by Stripe Managed Payments, with Sold through Link, LLC acting as merchant of record, and the Stripe entities involved in processing the payment. See Stripe's privacy policy. We never see your card details. We receive and store your email address, what you bought, the amount and the time, so we can deliver your downloads and meet bookkeeping duties. Link sends payment receipts and tax invoices; Brevo sends our download-access emails. Legal basis: performance of the contract and legal obligations (Art. 6(1)(b) and (c) GDPR).
Service emails and contact
Brevo delivers confirmation, sign-in and download emails and records delivery and error information so we can operate the service and investigate delivery problems. Individual open and click tracking is disabled in our email settings; Brevo may still measure anonymous, aggregate opens and clicks using tracking pixels and redirected links. Messages sent to our contact address are forwarded by Cloudflare to our Gmail inbox, provided by Google. We use your message and contact details to answer your enquiry. Legal basis: steps related to a contract or our legitimate interest in responding to enquiries (Art. 6(1)(b) and (f) GDPR).
How long we keep data
We keep your mailing-list subscription while you remain subscribed. After you unsubscribe, we keep only the consent or suppression records needed to demonstrate your choice and prevent unwanted mail. Purchase and collection records are kept while needed to provide access to your music, resolve payment or product issues, and comply with applicable accounting and legal obligations. Enquiries are kept while needed to answer them and resolve any related issue. We assess deletion requests against these purposes and any applicable legal retention requirements; records no longer needed are deleted or anonymised.
International processing
Our service providers may process data outside the European Economic Area. Where required, transfers rely on an applicable adequacy decision, including the EU-US Data Privacy Framework for participating organisations, or the European Commission's standard contractual clauses. Their privacy information explains the safeguards: Cloudflare, Brevo, Google and Stripe.
Your rights
You can ask for access to, correction, deletion or restriction of your data, data portability, and you can object to processing. Just email us. You can also complain to the Italian supervisory authority, Garante per la protezione dei dati personali, or to the supervisory authority in the EU country where you live or work.
