Privacy Policy

planeteast.co is operated by DM Studios AB, registered at Von Rosens Väg 54, 213 68 Malmö, Sweden. We are the data controller for the personal data described here.

This notice explains what personal data we collect, why we collect it, who we share it with, and what you can ask us to do with it. It applies to the website, your account, and the downloads and licences issued through them.

What you give us. When you create an account we collect your name and email address, and a password we store only as a hash. If you sign in with Google or Facebook, we receive your name, email address and profile picture from that provider instead of a password. If you contact support, we keep the correspondence.

What your use of the Service produces. Tracks you preview, save and download, your licence certificate records, your plan and billing history, and your language preference.

Technical data. IP address, browser and device type, and timestamps, collected automatically when you use the site. We use these for security, abuse prevention and to enforce fair-use download limits.

We do not ask for and do not want special category data — health, beliefs, biometrics or anything similar. Please do not send it to us.

• To run your account and provide the Service — authenticating you, streaming previews, issuing downloads and generating licence certificates in your name. This is necessary to perform our contract with you.
• To take payment and manage subscriptions — including renewals and refunds. Also contract performance.
• To keep the Service secure — detecting abuse, credential sharing and bulk scraping, and enforcing daily download allowances. This is our legitimate interest in protecting the catalogue and the artists in it.
• To pay artists — download counts feed the royalty calculations we owe to the artists whose work you download. These are aggregated; artists do not see who you are.
• To send service messages — receipts, renewal notices, security alerts and material changes to these policies. These are not marketing and you cannot opt out of them while you hold an account.
• To meet legal obligations — tax and accounting records, and responding to lawful requests.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

We do share it with service providers who act on our instructions:

• Stripe — payment processing and subscription billing.
• Google — sign-in with Google, and reCAPTCHA on the login and sign-up forms to block automated abuse.
• Meta — sign-in with Facebook, where you choose it.
• Our hosting and email providers — to run the site and send transactional email.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

Some of these providers operate outside the EU and EEA. Where data is transferred there, we rely on the transfer safeguards the GDPR requires — an adequacy decision for the destination country, or the European Commission's Standard Contractual Clauses.

Card payments are processed by Stripe. Your card number never reaches our servers — we receive only a payment reference, the last four digits, the card brand and the outcome, which is what we need to show you your billing history and to issue refunds.

Stripe processes your payment data as a controller in its own right for fraud prevention and regulatory purposes. See Stripe's privacy policy for what that involves.

We keep this deliberately small. We do not run advertising or analytics cookies, and there is no third-party tracking on the site.

• authToken — keeps you signed in between visits. Strictly necessary; without it you would have to log in on every page.
• lang — remembers whether you chose English or Arabic. Expires after a year.

Google sets its own cookies when reCAPTCHA runs on the login and sign-up forms, and Google and Meta set cookies if you use their sign-in buttons. Those are governed by their own policies.

You can block or delete cookies in your browser settings, and aboutcookies.org explains how for each major browser.

Blocking the authToken cookie will stop you from staying signed in, which means you will not be able to download.

• Account data — while your account is open, and for 30 days after you close it so the deletion can be reversed if it was a mistake.
• Licence and download records — kept after account closure, because a licence certificate you rely on must remain verifiable, and because artist royalty records depend on them.
• Invoices and tax records — for the period required by law.
• Security logs — a rolling short window, then deleted.

Under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (2018:218), you can ask us to:

• tell you whether we hold data about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, where we do not have a legal reason to keep it;
• restrict or object to a particular use;
• send your data to you or another provider in a portable form;
• withdraw consent, where we relied on consent — this does not affect what we did before you withdrew it.

Email privacy@planeteast.co. We respond within one month, and there is no charge unless a request is repetitive or excessive. If you are not satisfied with our response you can complain to the Swedish Authority for Privacy Protection (IMY), or to the supervisory authority in the EU country where you live.

The Service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, tell us at privacy@planeteast.co and we will delete it.

We may update this notice. When a change materially affects how we use your data we will email account holders before it takes effect.

The version in force when you place an order governs that order. See also the Terms of Use.

For anything in this notice, including access and deletion requests, email privacy@planeteast.co.

DM Studios AB
Von Rosens Väg 54, 213 68 Malmö, Sweden