Privacy Policy

Mirakilouz Beatz ("we", "us", "our") provides an online marketplace and mobile app for browsing and purchasing beats, watching videos, and booking studio sessions. This policy explains what information we collect, why we collect it, and how you can control it.

Information we collect

• Account information: your name, email address, and phone number when you register or edit your profile.
• Password: stored only as a one-way cryptographic hash — we never store or have access to your plain-text password.
• Profile photo: optional, if you choose to upload one.
• Booking details: the studio session date/time, location, notes, and (if required by the package) an audio file you upload for the session.
• Purchase and order history: which beats, licenses and courses you've purchased, the amount, the payment method and the payment reference (for Google Play purchases: Google's order ID and purchase token, stored encrypted), for your records and ours.
• Google sign-in: if you choose "Continue with Google", we receive your name, email address and Google account ID from Google to create or sign in to your account.
• Course progress: which Academy lessons you have completed, and certificates issued to you.
• Content you post: comments, reviews and reports you submit, and support requests.
• Two-factor authentication data: if you enable 2FA, your authenticator secret is stored encrypted, and recovery codes are stored as one-way hashes.
• Preferences: your chosen language and currency, stored locally on your device.
• Push notification token: if you allow notifications, a device token issued by Firebase Cloud Messaging (Google) so we can send you order/booking updates and announcements. It identifies your device for delivery only — we never see or store your contacts, location, or any other Google account data through it.

What we do not collect

We do not collect your device's advertising ID, precise location, contacts, or camera/microphone access. We do not use any third-party analytics or advertising SDKs, and we do not run behavioral tracking of any kind. (Google's Firebase Cloud Messaging and Google Play services may process technical device information to deliver notifications and payments, under Google's own privacy policy.)

Payments

Payments are handled by licensed payment providers, never by us directly:

• Google Play: beats, licenses and Academy courses bought in the Android app downloaded from Google Play are paid through Google Play's billing system, under Google's terms and privacy policy.
• Paystack and Bachs: studio bookings, and purchases on our website, are paid on Paystack's or Bachs' own secure checkout page (other providers may be offered on the website when enabled).

We never see, receive, or store your card number, expiry date, or CVV. We receive only the payment status and reference needed to confirm your order.

Service providers we use

To run the service we share the minimum necessary data with these providers, who process it on our behalf or under their own terms:

• Google — Google Play billing, Google sign-in, and Firebase Cloud Messaging (push notifications).
• Payment providers — as listed under Payments.
• Bunny.net (Bunny Stream) — hosts and delivers Academy course videos.
• YouTube — music videos in the app are played with YouTube's player, under Google's privacy policy.
• Email and SMS delivery providers — to send order, booking and security messages to your email address or phone number.
• Our hosting provider — stores the website, app data and purchased files on our behalf.

How we use your information

• To create and manage your account.
• To process your orders and studio bookings.
• To send you transactional emails (order confirmations, password resets, security alerts).
• To keep your account secure (2FA, suspicious-login detection).

We do not sell your personal information to anyone, and we do not share it with third parties for their own marketing purposes.

Data retention

We keep your account data for as long as your account exists. When you delete your account (see below), we immediately erase your profile (name, email, phone, photo), sign-in details, notification tokens, saved preferences, favorites and notifications, remove your name from reviews and support requests, and sign you out everywhere.

We keep transaction records after deletion: orders, payment and Google Play purchase records, license agreements and studio booking records, including the name and email address recorded on each transaction. We need these for tax and accounting, to handle refunds and chargebacks, and as proof of the license granted to the buyer. They are used for no other purpose.

Deleting your account and data

You can permanently delete your account at any time directly inside the mobile app: go to Profile → Delete account, confirm with your password (or, if you signed up with Google, with your Google account), and your account is deleted immediately. If you no longer have the app installed, you can request deletion instead via our web-based account deletion page.

Security

Passwords are hashed, never stored in plain text. Two-factor authentication secrets are encrypted at rest. All traffic between the app and our servers is encrypted in transit (HTTPS/TLS). Your session token is stored on your device using Android's secure, encrypted keystore-backed storage, not in plain preferences.

Children's privacy

Mirakilouz Beatz is not directed at children and is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Contact us

Questions about this policy or your data? Contact us at market@mirakilouzbeatz.com.