Privacy Policy

PART A — ENGLISH (operative version — prevails in case of conflict with the French text below)

1. Who is responsible for your data

Freyja Creative Limited (company no. 11954617), a company registered in England and Wales at 3rd Floor, 45 Albemarle Street, London, W1S 4JL, trading as Bangerz Army (bangerz-army.com) ("we", "us"), is the data controller for the personal data described in this Policy.

Contact for privacy matters: [email protected].

2. What personal data we collect

We collect the following categories of personal data about you as a Member, matching Terms §13's summary exactly:

2.1 Account data. Name, email address, username, password (stored hashed, never in plain text), country/region, and any profile information you choose to add.

2.2 Payment metadata (via Stripe). We use Stripe, Inc. as our payment processor. We do not store your full card number, CVV, or full payment credentials ourselves — these are collected and stored directly by Stripe under its own PCI-DSS compliance. We receive and store payment metadata from Stripe: subscription plan/tier, billing cycle, price paid, payment status (active, past due, cancelled, paused), invoice history, and a Stripe customer/subscription ID used to reconcile your account with your subscription.

2.3 Usage data. Downloads (which tracks, when, how many), playlists you create or save, Arsenal browsing/search activity, and your position on the usage/contribution ranking system described in Terms §3, plus standard technical data (IP address, device/browser type, log timestamps) generated by using the Service.

2.4 Cancellation-reason and feedback data (Terms §5.4). When you cancel, we ask you to select a cancellation reason from a list and, optionally, leave a free-text comment. This is stored against your account record and may be shared with Stripe or our analytics tooling in aggregate/pseudonymised form for churn analysis — see §5 below on who we share data with.

2.5 Communications data. Support requests, emails, or in-app messages you send us, and our replies.

2.6 Analytics and interaction data. Data generated by the analytics and advertising technologies listed in §4, including page views, clicks, referring source, approximate location derived from IP address, and — via our product-analytics provider — recordings of your interaction with the pages of bangerz-army.com (mouse movement, scrolling, clicks and page transitions).

3. Why we process your data and our legal basis (Art. 6 GDPR)

• Creating and administering your account — data: account data — legal basis: Art. 6(1)(b), performance of a contract with you.
• Processing subscription payments, billing, invoicing — data: account data, payment metadata — legal basis: Art. 6(1)(b), performance of a contract; Art. 6(1)(c), legal obligation (tax/accounting records).
• Providing the Service (downloads, playlists, ranking) — data: usage data — legal basis: Art. 6(1)(b), performance of a contract.
• Enforcing the pause/download-lock mechanic and cancellation terms (Terms §5–§6) — data: account data, usage data — legal basis: Art. 6(1)(b), performance of a contract.
• Understanding why Members cancel, improving retention and the Service — data: cancellation-reason/feedback data — legal basis: Art. 6(1)(f), legitimate interests — our interest in understanding churn and improving the Service, balanced against your interest in not having free-text feedback over-retained (see §6 retention); you can decline to give a reason beyond the required minimum selection.
• Fraud prevention, enforcing Acceptable Use (Terms §8) — data: account data, usage data, payment metadata — legal basis: Art. 6(1)(f), legitimate interests in protecting the Service and other Members from abuse; Art. 6(1)(c), legal obligation where fraud reporting is required.
• Responding to support requests — data: communications data — legal basis: Art. 6(1)(b), performance of a contract; Art. 6(1)(f), legitimate interests.
• Complying with tax, accounting, and consumer-law recordkeeping (e.g. cooling-off consent records under Terms §5.5) — data: account data, payment metadata — legal basis: Art. 6(1)(c), legal obligation.
• Analytics, audience measurement and advertising measurement — data: analytics and interaction data — legal basis: Art. 6(1)(a), consent, where required for the storage of or access to information on your device (see §4).
• Marketing communications (if you opt in) — data: account data — legal basis: Art. 6(1)(a), consent — see §3.1 below.

3.1. Marketing. We will only send you marketing emails about new content, features, or offers if you affirmatively opt in (e.g. at signup or in account settings). You can withdraw consent at any time via the unsubscribe link in any marketing email or your account settings, without affecting service-related emails (e.g. billing receipts, cancellation confirmations), which we send under §3(b)/(c) above regardless of marketing consent.

4. Cookies and similar technologies

4.1 Strictly necessary. We use strictly necessary cookies and local storage to keep you logged in and to operate core Service functionality (e.g. remembering your session, enforcing download limits during a pause per Terms §6.3), and our CDN provider sets a security cookie (cf_clearance). These do not require consent under PECR reg. 6(4) / Art. 5(3) ePrivacy Directive (strictly-necessary exemption).

4.2 Non-essential. We also use the following non-essential technologies on bangerz-army.com. This is the full, measured inventory as at the last-updated date of this Policy:

• _ga, _ga_MBNFWQFK6P — set by Google Analytics 4 — audience measurement and site analytics.
• _gcl_au, and _gcl_ls in local storage — set by the Google Ads conversion linker — advertising and conversion measurement.
• test_cookie, on the .doubleclick.net domain — set by Google / DoubleClick — third-party advertising.
• ph_…_posthog, as a cookie and in local and session storage — set by PostHog — product analytics, heatmaps and session recording.

The pages you visit also contact googletagmanager.com, google-analytics.com, googleads.g.doubleclick.net, ad.doubleclick.net, us.i.posthog.com, us-assets.i.posthog.com and static.cloudflareinsights.com.

4.3 Your controls. You can block or delete any of these through your browser settings, and you can opt out of Google Analytics using Google's browser add-on (tools.google.com/dlpage/gaoptout) and of advertising personalisation at adssettings.google.com. Blocking non-essential cookies does not affect your access to the Service. You can also object to, or withdraw consent for, this processing at any time by writing to us at [email protected], and we will suppress it for you.

5. Who we share your data with

• Stripe, Inc. — payment processing (Stripe's own privacy policy governs the card data it holds directly: stripe.com/privacy).
• Cloudflare, Inc. — hosting, CDN and security for bangerz-army.com, plus aggregate traffic analytics (Cloudflare Insights).
• Amazon Web Services, Inc. — hosting, storage, content delivery (CloudFront), authentication and transactional email for the Bangerz Army application, in the AWS Europe (Ireland) eu-west-1 region.
• Google LLC — Google Analytics 4, Google Ads / DoubleClick, and Google Fonts.
• PostHog, Inc. — product analytics, heatmaps and session recording.
• Functional Software, Inc. (Sentry) — application error and crash reporting.
• Sendinblue SAS (Brevo) — transactional and marketing email.
• MXroute LLC — inbound email for our published contact addresses.
• Law enforcement or regulators, where required by law, court order, or to protect our legal rights.
• A successor entity, if Freyja Creative Limited's business or assets relating to Bangerz Army are transferred (e.g. sale, restructuring), subject to that successor being bound by materially equivalent privacy commitments.

We do not sell your personal data to third parties for their own marketing purposes.

6. How long we keep your data

• Account data: for as long as your account is active, plus a reasonable period after closure to handle disputes, comply with tax/accounting law (generally 6 years under UK Companies Act 2006 s.388 recordkeeping norms for financial records), and defend legal claims.
• Payment metadata: retained per Stripe's own retention rules and our accounting-recordkeeping obligations (typically 6 years from the end of the relevant tax year, per HMRC recordkeeping requirements).
• Usage data: retained for the life of your account for Service functionality (e.g. ranking history), and in aggregated/anonymised form thereafter for analytics.
• Cancellation-reason/feedback data: retained for up to 24 months from cancellation for churn-analysis purposes, then deleted or anonymised.

7. International data transfers

Our application's own data plane (accounts, content, payments reconciliation) is hosted in the European Economic Area, in the AWS Europe (Ireland) eu-west-1 region.

Some of our providers process data in the United States. Specifically, Google Analytics, Google Ads, PostHog (including session-recording data) and Sentry ingest data to United States endpoints, and Stripe may process payment metadata in the United States.

Where your data is transferred outside the UK or EEA, we rely on an adequate safeguard, such as:

• the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, under DPA 2018 s.119A and the ICO's IDTA (in force from 21 March 2022, per the Data Protection (International Data Transfer Standard Contractual Clauses) Regulations 2022); and/or
• the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for EU-resident data; and/or
• an applicable adequacy decision (e.g. the EU-US Data Privacy Framework / UK Extension to the EU-US Data Privacy Framework, where the recipient is DPF-certified).

You can check the current certification status of any of these providers on the Data Privacy Framework list at dataprivacyframework.gov.

8. Your rights

If you are located in the UK or the EU/EEA, you have the following rights under UK GDPR (Arts. 15–21, as incorporated by DPA 2018) and/or EU GDPR (Regulation (EU) 2016/679, Arts. 15–21):

• Access (Art. 15) — get a copy of the personal data we hold about you and information about how we process it.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure, the "right to be forgotten" (Art. 17) — ask us to delete your data, subject to exceptions (e.g. data we must keep for tax/legal-claim purposes under §6).
• Restriction (Art. 18) — ask us to limit how we use your data while a dispute about it is resolved.
• Portability (Art. 20) — receive your account and usage data in a structured, machine-readable format, or have it transferred to another provider where technically feasible.
• Object (Art. 21) — object to processing based on legitimate interests (e.g. our churn-analysis use of cancellation feedback under §3) or to direct marketing at any time.
• Withdraw consent (Art. 7(3)) — where processing is based on consent (e.g. analytics under §4, marketing under §3.1), withdraw it at any time without affecting past lawful processing.
• Not be subject to solely automated decision-making with legal or similarly significant effects (Art. 22) — we do not currently use fully automated decision-making of this kind (e.g. the ranking system in Terms §3 does not gate legal or similarly significant outcomes).

9. How to exercise your rights

There is no self-service data export or account-deletion tool in the Service today. Every request under §8 — including erasure and portability — is handled by us by email.

Email us at [email protected] with your request and the email address associated with your account. We will:

• verify your identity before acting on the request (to prevent account takeover via impersonated data requests);
• respond within one month of receipt (extendable by a further two months for complex or numerous requests, with notice to you, per Art. 12(3) GDPR); and
• not charge a fee, unless your request is manifestly unfounded or excessive (Art. 12(5) GDPR), in which case we will explain why before charging or refusing.

Note that cancelling your subscription in the app (Account → Membership → "Cancel your subscription") ends your billing and your access — it does not delete your account or your personal data. To have your data erased you must email us as described above.

10. Complaints

You have the right to lodge a complaint with a supervisory authority:

• UK residents: the Information Commissioner's Office (ICO) — ico.org.uk, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or telephone 0303 123 1113. Right of complaint under DPA 2018 s.165 / Art. 77 UK GDPR.
• EU residents: the supervisory authority of your EU member state of residence, work, or the place of the alleged infringement (Art. 77 GDPR) — e.g. for French residents, the CNIL (Commission Nationale de l'Informatique et des Libertés) — cnil.fr.

We would appreciate the chance to address your concern directly first, but you are not required to contact us before contacting a regulator.

11. Children

The Service is not directed at, and we do not knowingly collect personal data from, individuals under 18 (consistent with Terms §2's eligibility requirement). If we learn we have collected data from someone under 18, we will delete it.

12. Security

We use appropriate technical and organisational measures to protect your data (e.g. encrypted transport (TLS), hashed passwords, access controls on production systems), consistent with the Art. 5(1)(f) GDPR security principle and Art. 32 GDPR (security of processing).

13. Data breach notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO (and/or the relevant EU supervisory authority) within 72 hours of becoming aware of it, as required by Art. 33 GDPR, and will notify affected Members without undue delay where the breach is likely to result in a high risk to you, as required by Art. 34 GDPR.

14. Changes to this Policy

We may update this Policy from time to time. For material changes, we will provide reasonable advance notice (e.g. in-app notice or email), consistent with Terms §14's approach to changes in the Terms. The "last updated" date at the top of this page will always reflect the current version.

15. Contact

Bangerz Army / Freyja Creative Limited, 3rd Floor, 45 Albemarle Street, London, W1S 4JL (company no. 11954617) — [email protected].

PART B — FRANÇAIS (traduction de courtoisie — en cas de divergence, le texte anglais ci-dessus prévaut)

1. Responsable du traitement

Freyja Creative Limited (société à responsabilité limitée de droit anglais, n° 11954617), dont le siège social est enregistré au 3rd Floor, 45 Albemarle Street, Londres, W1S 4JL (adresse conforme au registre Companies House), exploitant le service Bangerz Army (bangerz-army.com), est responsable du traitement des données personnelles décrites dans la présente Politique.

Contact vie privée : [email protected].

2. Données que nous collectons

• Données de compte : nom, email, identifiant, mot de passe (haché).
• Métadonnées de paiement (Stripe) : nous ne stockons pas votre numéro de carte ; Stripe le conserve directement. Nous recevons formule, statut de paiement, historique de facturation, identifiant Stripe.
• Données d'usage : téléchargements, playlists, activité de navigation dans l'Arsenal, classement (voir CGV §3).
• Motif d'annulation et retour d'expérience (CGV §5.4) : motif sélectionné et commentaire optionnel lors de l'annulation.
• Données de communication : échanges avec le support.
• Données d'analyse et d'interaction : pages vues, clics, source de provenance, localisation approximative déduite de l'adresse IP, et enregistrements de votre navigation sur bangerz-army.com (mouvements de souris, défilement, clics) via notre outil d'analyse produit — voir §4.

3. Finalités et base juridique (Art. 6 RGPD)

Exécution du contrat (Art. 6(1)(b)) pour la gestion du compte, la facturation, et la fourniture du Service ; obligation légale (Art. 6(1)(c)) pour la comptabilité et la fiscalité ; intérêt légitime (Art. 6(1)(f)) pour l'analyse des motifs d'annulation et la lutte contre la fraude ; consentement (Art. 6(1)(a)) pour les traceurs non essentiels décrits au §4 et pour toute communication marketing, retirable à tout moment.

4. Cookies

4.1 Strictement nécessaires. Cookies et stockage local strictement nécessaires au fonctionnement du Service (session, application du blocage de téléchargement pendant une pause, CGV §6.3), ainsi qu'un cookie de sécurité de notre CDN (cf_clearance) — pas de consentement requis (Art. 5(3) directive ePrivacy).

4.2 Non essentiels. Inventaire complet, mesuré à la date de mise à jour de la présente Politique :

• _ga, _ga_MBNFWQFK6P — Google Analytics 4 — mesure d'audience.
• _gcl_au, et _gcl_ls en stockage local — Google Ads — publicité et mesure de conversion.
• test_cookie, sur le domaine .doubleclick.net — Google / DoubleClick — publicité tierce.
• ph_…_posthog — PostHog — analyse produit, cartes de chaleur et enregistrement de session.

4.3 Vos moyens de contrôle. Vous pouvez bloquer ou supprimer ces traceurs via les réglages de votre navigateur, refuser Google Analytics via le module tools.google.com/dlpage/gaoptout, et désactiver la personnalisation publicitaire sur adssettings.google.com. Le blocage des traceurs non essentiels n'affecte pas votre accès au Service. Vous pouvez également vous opposer à ce traitement ou retirer votre consentement à tout moment en écrivant à [email protected].

5. Destinataires des données

Stripe (paiement), Cloudflare (hébergement, CDN et sécurité du site), Amazon Web Services (hébergement de l'application, région Europe/Irlande eu-west-1), Google (Analytics, Ads, Fonts), PostHog (analyse produit et enregistrement de session), Sentry (rapports d'erreurs), Brevo (emails transactionnels et marketing), MXroute (email entrant), les autorités si la loi l'exige, ou un repreneur en cas de cession de l'activité. Nous ne vendons pas vos données.

6. Durée de conservation

Données de compte : durée de vie du compte + délai raisonnable (obligations comptables, ~6 ans). Données de paiement : selon les règles de Stripe et les obligations fiscales. Motif d'annulation/retour : jusqu'à 24 mois, puis suppression ou anonymisation.

7. Transferts internationaux

Les données de l'application sont hébergées dans l'EEE (AWS, région Irlande eu-west-1). En revanche, Google Analytics, Google Ads, PostHog (y compris les enregistrements de session) et Sentry transmettent des données vers des points de collecte situés aux États-Unis, et Stripe peut traiter des métadonnées de paiement aux États-Unis. Ces transferts s'appuient sur des garanties appropriées : clauses contractuelles types de la Commission européenne (Décision d'exécution (UE) 2021/914), l'IDTA britannique, ou une certification au titre du cadre de protection des données UE-États-Unis (Data Privacy Framework), vérifiable sur dataprivacyframework.gov.

8. Vos droits

Conformément aux articles 15 à 21 du RGPD (Règlement (UE) 2016/679) : droit d'accès (Art. 15), de rectification (Art. 16), d'effacement (Art. 17), de limitation (Art. 18), de portabilité (Art. 20), d'opposition (Art. 21), et de retrait du consentement (Art. 7(3)).

9. Comment exercer vos droits

Aucun outil d'export ou de suppression de compte en libre-service n'existe actuellement dans le Service. Toute demande se traite par email à [email protected], avec vérification d'identité. Réponse sous un mois (prolongeable de deux mois pour les demandes complexes, Art. 12(3) RGPD), gratuitement sauf demande manifestement infondée ou excessive.

L'annulation de votre abonnement dans l'application met fin à la facturation et à l'accès, mais ne supprime ni votre compte ni vos données : pour un effacement, écrivez-nous.

10. Réclamations

Vous pouvez saisir la CNIL (cnil.fr) si vous résidez en France, ou l'autorité de contrôle de votre pays de résidence dans l'UE, ou l'ICO au Royaume-Uni (ico.org.uk), conformément à l'article 77 du RGPD.

11. Mineurs

Le Service n'est pas destiné aux personnes de moins de 18 ans (cf. CGV §2).

12. Sécurité

Mesures techniques et organisationnelles appropriées (chiffrement du transport, mots de passe hachés, contrôle d'accès), conformément à l'article 32 du RGPD.

13. Notification de violation de données

En cas de violation de données présentant un risque, notification à l'autorité compétente sous 72 heures (Art. 33 RGPD) et aux personnes concernées en cas de risque élevé (Art. 34 RGPD).

14. Modifications

Cette Politique peut être mise à jour ; les changements substantiels feront l'objet d'un préavis raisonnable, à l'image de l'article 14 des CGV.

15. Contact

Bangerz Army / Freyja Creative Limited, 3rd Floor, 45 Albemarle Street, Londres, W1S 4JL (n° 11954617) — [email protected].