Privacy
How Loopember uses personal data when you browse, sign in, buy music or contact us. Last updated: 29 October 2026.
Controller and contact
Matikus, Lda.
Startup Madeira - EV 289, Campus da Penteada
9020-105 Funchal - Madeira
Portugal
Matikus is responsible for the personal data processed to operate Loopember. Contact loopember@matikus.com for privacy questions or to exercise your rights.
Our role and data processing agreements
For the current music shop, Matikus determines the purposes and means of processing account, purchase, download and support data as controller. Loopember does not process your customers' or audience's personal data on your behalf as part of the music purchase or licence. A business purchase or use of the music in client projects does not by itself create a controller–processor relationship between you and Matikus, so no customer data processing agreement (DPA / AVV) is needed for this service.
This is separate from Matikus's responsibility to put appropriate Article 28 GDPR agreements in place with service providers that process personal data on its behalf. Creem's own sale, payment, tax and invoice processing has separate privacy responsibilities, as described below.
Browsing and security
Our hosting infrastructure receives your IP address, requested URL, request time and browser/device information to deliver the website. Authentication sessions also contain IP address and user-agent information. Security and operational records may contain account, order and track identifiers, event times and error categories.
We process this information under Article 6(1)(f) GDPR for our legitimate interests in operating a reliable service, preventing abuse and investigating errors. We limit access and use security controls including encrypted connections, password hashing, access checks and request limits.
Accounts, purchases and downloads
Account data includes your name, email address, password hash, account dates and session information. Purchase records include selected music, order number, amount/currency, payment status and provider reference, the applicable licence and checkout consent, and their versions and timestamps. Download permissions connect your account to the music you bought.
We use these data to maintain your account, fulfil purchases and make your music and purchase documentation available under Article 6(1)(b) GDPR. Relevant accounting records are processed under Article 6(1)(c) to meet legal obligations. Where necessary, we retain limited evidence under Article 6(1)(f) to establish, exercise or defend legal claims.
Information needed to authenticate you, process your selected purchase and contact you about it is necessary for those services. Without it, we cannot provide the relevant account or purchase. Browsing does not require an account. Loopember does not receive or store your complete payment-card details.
Support and service emails
If you contact us, we process your email address, message and the information you choose to provide. We use it to answer your request or resolve a purchase issue under Article 6(1)(b), or Article 6(1)(f) for other enquiries. Requests concerning your GDPR rights are handled under Article 6(1)(c). Please do not send passwords or full payment-card details.
We send purchase confirmations and relevant service notices, including notices about music affected by rights claims. This requires your name/email, order and track information and delivery records. The basis is contract performance, applicable legal obligations, or our legitimate interest in addressing rights claims and informing affected customers. These messages are not an enrolment in promotional mailings.
Problem reports
You can report a software problem without an account. We process your description, any steps, expected behaviour and impact you provide, a coarse device platform and browser language, and an email address only if you choose to provide one. We use this information to investigate the problem, reply where requested and prevent abuse. This serves our legitimate interest in maintaining a reliable, secure service under Article 6(1)(f) GDPR; support required by your contract also relies on Article 6(1)(b).
Our hosted bug service, n8n automation and Vikunja issue tracker store and organise reports. Report text may be sent to OpenAI through our Codex runner for a preliminary technical assessment. The optional contact-email field is excluded, but personal data you put in the description may be included. A person reviews the assessment; it does not make decisions with legal or similarly significant effects. Please omit passwords, access tokens, payment details and other people's personal data. Reports detected as sensitive are held for private review before forwarding.
An internal Telegram alert contains the product, report reference, suggested urgency and restricted ticket link, without report text or contact email. The form uses request limits, a hidden anti-spam field and a short browser computation, without an external CAPTCHA provider. IP addresses are used temporarily for request limits and are not included in the report or analysis request.
Reports, optional contact details and assessments are removed six calendar months after the issue is completed. Reopening an issue restarts the period on its next completion. Vikunja retains deleted tickets in recovery storage for up to 30 additional days. Records that cannot be accessed or have been moved require operational review. Infrastructure backups rotate separately; delivered Telegram metadata is not automatically removed by deleting a ticket. For access or erasure, contact loopember@matikus.com and quote your reference. Provider processing and international transfers remain subject to the applicable provider arrangements.
Checkout reopening notice
While checkout is paused, you can ask me for one email when it reopens, without an account. I store your email address, the consent text you confirmed and the time of your request. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time by writing to me; I then delete the address. It is not added to any mailing list and I use it for nothing else.
I delete the address after that single message, and the shop deletes it automatically after 90 days at the latest. Request limits use your IP address temporarily in memory; it is not stored with the request. Infrastructure backups rotate separately.
Service providers and recipients
Hetzner Online GmbH provides hosting and S3-compatible object storage for the service, database and media. The website server and object storage are hosted in Helsinki, Finland. Requests for media also disclose connection information to the storage provider.
Brevo supplies transactional email delivery. We provide recipient details and the content of the relevant service message; delivery attempts, failures and provider message references help us resolve delivery problems.
Hostinger provides our support email mailbox. When you write to us, sender and recipient addresses, message content, any attachments and technical email metadata are processed through that mailbox to receive, answer and retain correspondence as described above.
Creem, operated by Armitage Labs OÜ in Estonia, handles checkout, payment, tax and invoices as Merchant of Record. We send the buyer email, order reference and purchase information and receive payment references/status. Creem also collects information directly in checkout and has its own privacy responsibilities, including payment and fraud-prevention processing. Its notice describes those purposes, roles and retention periods.
Where necessary, information may also be disclosed to authorised professional advisers, accounting providers or public authorities for accounting, legal compliance or resolving disputes. Access is limited to what is needed for the relevant purpose.
International processing
Providers may use group companies or subprocessors with access from outside the European Economic Area. A provider's EU address alone does not exclude such access. Creem describes international processing and safeguards in its privacy notice; provider information is linked above.
Where a transfer requires safeguards under GDPR, the applicable arrangement must be an adequacy decision or appropriate safeguards such as European Commission standard contractual clauses, with additional measures where required. Contact us for information about the countries and safeguards relevant to your data, or to request a copy of the applicable safeguards.
How long information is kept
Account and purchase-access information is kept while needed to provide your account, downloads and proof of the licence you acquired. Closing an account does not automatically erase records needed for legal obligations or a specific dispute. We assess deletion requests by purpose and tell you what must remain and why.
Accounting documents subject to Portuguese recordkeeping rules are generally retained for ten years. Other order/consent evidence is retained only while necessary for the relevant contractual or legal claim. This does not mean that passwords, sessions and all support messages must be retained for ten years.
Authentication sessions expire after up to 30 days and may be renewed while you use the account. Expiry prevents use of the session but is distinct from removal of the database record. Support correspondence, delivery records and security logs are retained only as needed to complete the request, investigate a problem or meet a specific legal requirement. Necessary records may remain longer during a dispute or legal hold. Backups require separate deletion handling. You can ask us about the criteria applying to your particular records.
Cookies and browser storage
Loopember uses first-party storage for security, sign-in, your selected cart, navigation and your preview volume. We do not install advertising or audience-measurement tools on the storefront. The storage listed here supports the service you request; it is not used to build advertising profiles.
loopember_csrf: Loopember first-party session cookie protecting forms from forged requests; expires with the browser session. HttpOnly, Secure on HTTPS and SameSite=Lax.
lm_cart_0 and, for larger carts, lm_cart_1: Loopember first-party cookies storing a signed music selection for up to 30 days so you can return to an unfinished cart. They are removed when the cart is cleared; HttpOnly, Secure on HTTPS and SameSite=Lax.
__Secure-better-auth.session_token: Loopember first-party sign-in cookie, normally retained for up to 30 days and renewed during use; sign-out invalidates your session and clears authentication cookies. A session-only __Secure-better-auth.dont_remember cookie may be used if a non-persistent sign-in is requested. Authentication cookies use HttpOnly, Secure on HTTPS and SameSite=Lax. Non-HTTPS development installations omit the __Secure- prefix.
react-router-scroll-positions: first-party session storage restoring the page position during navigation; retained for the browser tab/session. It is not an advertising identifier.
loopember_preview_volume: first-party local storage remembering the preview volume you set, as a number from 0 to 100. It is written only when you change the volume and stays in this browser until you remove it. It is not an advertising identifier.
You can remove browser storage in your browser settings or sign out to end your login. Blocking necessary cookies can prevent login, cart or form functions. Optional storefront storage would require a separate choice before activation. Creem's hosted checkout has its own cookie information and controls.
Your rights
Subject to the applicable conditions, you can request access and a copy of your data, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing is based on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Write to loopember@matikus.com. No special form is required. We may request proportionate information to verify your identity. We normally respond within one month; if a lawful extension is necessary, we explain it within that month. Our account data download provides a convenient copy of core shop records and does not limit your right to request other personal data.
Loopember does not itself make decisions based solely on automated profiling that produce legal or similarly significant effects. Creem's independent payment/fraud processing is described in its own notice.
Complain to a supervisory authority
You may complain to a competent data protection authority, particularly in the country of your habitual residence, workplace or the alleged infringement. In Portugal, the authority is the Comissão Nacional de Proteção de Dados (CNPD). You do not have to contact us first.
License version: 2026-10-26-1Consent version: 2026-09-23-1