PRIVACY POLICY

1. Introduction

FNCCO, LLC, a Florida limited liability company doing business as Olea Sound ("we," "us," or "Olea Sound"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and online services (the "Platform").

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

Information You Provide

• Account Information: Full name, email address, and password when you create an account
• Profile Information: Phone number and any additional details you add to your profile
• Payment Information: Billing details provided during purchases (processed by Stripe; we do not store card numbers)
• Booking Information: Session dates, preferences, and notes provided when booking studio time
• Music Platform Links: URLs and profile information from music platforms you choose to connect or link
• Communications: Messages or inquiries you send to us
• Waiver and Agreement Data: Signatures, consent records, and associated information provided when signing agreements

Information Collected Automatically

• Device and Browser Information: IP address, browser type and version, operating system, and device identifiers
• Usage Data: Pages visited, time spent on pages, links clicked, and general navigation patterns
• Authentication Data: Login timestamps, session tokens, and account activity logs

Information From Third-Party Integrations

If you connect your Spotify or SoundCloud account through OAuth, we receive limited profile information (display name, profile image, profile URL) and, where applicable, publicly available content data (such as top tracks). We store encrypted OAuth access and refresh tokens to maintain your connection. You can disconnect at any time from your account settings.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Process payments and deliver purchased digital goods (beat licenses)
• Facilitate session bookings and related communications
• Operate the loyalty rewards program and track qualifying activity
• Display your connected music platform profiles and embeds
• Send transactional emails (account confirmation, booking confirmations, purchase receipts, password resets)
• Respond to your inquiries and provide customer support
• Maintain the security and integrity of the Platform
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data for automated decision-making or profiling.

4. How We Share Your Information

We share your personal information only with the following categories of service providers, solely to operate the Platform:

We may also disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Olea Sound, its users, or the public.

5. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information, including:

• Passwords are hashed and never stored in plaintext
• OAuth tokens are encrypted at rest using AES-256-GCM encryption
• All data transmission uses HTTPS/TLS encryption
• Payment processing is PCI-DSS compliant through Stripe
• Database access is controlled through row-level security policies

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods:

• Account data: Retained until you request deletion
• Session files: Retained for 90 days after the session, then may be deleted
• Payment records: Retained as required by tax and financial regulations (typically 7 years)
• Cached music platform data: Automatically expires after 24 hours and is refreshed on access
• OAuth tokens: Retained until you disconnect the integration or delete your account

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request your data in a commonly used, machine-readable format
• Opt-Out: Opt out of promotional communications at any time

To exercise any of these rights, contact us at studio@oleasound.com. We will respond to verified requests within 30 days.

8. California Residents (CalOPPA)

If you are a California resident, you have the right to know what personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared, as described in this Privacy Policy.

Do Not Track: We do not currently respond to "Do Not Track" browser signals. There is no uniform industry standard for recognizing or honoring DNT signals at this time.

Sale of Information: We do not sell your personal information to third parties.

9. Children's Privacy

The Platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If we become aware that we have collected information from a child under 13 without verifiable parental consent, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at studio@oleasound.com.

10. Data Breach Notification

In compliance with the Florida Information Protection Act (FIPA), if we become aware of a data breach affecting your personal information, we will notify you within thirty (30) days of discovery. Notification will include the date or estimated date of the breach, a description of the personal information involved, and contact information for further inquiries.

11. Cookies and Tracking Technologies

The Platform uses essential cookies for authentication and session management. These cookies are necessary for the Platform to function and cannot be disabled.

We do not currently use third-party advertising cookies or tracking pixels. If this changes, we will update this policy and provide notice.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Platform at least thirty (30) days before the changes take effect. The "Last updated" date at the top of this page indicates when this policy was last revised.

13. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us at: