Skip to content
On Air
All channelsAll
Join Free
Legal

Privacy Policy

Last updated: September 2026

Who We Are

Vintage Radio Vault (vintageradiovault.com, “VRV”, “we”) is operated by 140db LLC, a Wyoming (USA) limited liability company, 312 W 2nd St Unit A8699, Casper, WY 82601, USA [TODO — owner to confirm: legal entity + address of record; note card payments are currently taken via a Stripe account in the name of DVolution Music LLC]. 140db LLC is the controller of the personal data described here. Our business is run from Poland (EU), so we apply the EU General Data Protection Regulation (GDPR) and the UK GDPR to everyone, wherever you live.

Contact for anything privacy-related: our contact page [TODO — owner to confirm: dedicated privacy email address].

What We Collect and Why

  • Account: email address, optional name, password (stored only as a one-way bcrypt hash), and — if you sign in with Google — your Google account identifier and profile picture URL. Also whether you verified your email, your display preferences, and referral codes/counts. Purpose: to provide your account. Legal basis: contract (Art. 6(1)(b) GDPR).
  • Listening activity: episode listening progress, saved shows and download history, linked to your account. Purpose: to resume playback, keep your library and enforce download allowances. Legal basis: contract.
  • Orders: name, email, shipping address, items and amounts. Card details go straight to Stripe — we never see or store your card number. Purpose: to take payment, produce and ship your order, answer questions and keep accounting records. Legal basis: contract, and legal obligation (Art. 6(1)(c)) for tax/accounting records.
  • Membership: your plan, status and billing dates (payments handled by Stripe). Legal basis: contract.
  • Newsletter and station alerts: email address, optional name, where you signed up, and whether you confirmed. We only send marketing email after you tick the box / sign up and confirm via the link we email you (double opt-in). Legal basis: consent (Art. 6(1)(a)) — withdraw it any time with the unsubscribe link in every email.
  • Reviews, show requests and contact messages: the name, email and text you submit. Your review text and display name are published; your email is never shown. Legal basis: legitimate interests (Art. 6(1)(f)) in running the store and answering you.
  • Analytics: we use a self-hosted Matomo instance. It counts visits without cookies, recording pages viewed, referrer and browser/device type. Your IP address is anonymised before it is stored (the last two bytes of an IPv4 address are removed; IPv6 addresses are shortened to their network prefix). Raw visit logs are currently kept without a fixed deletion period. If you accept cookies, Matomo also sets visitor cookies so it can recognise return visits. It does not build advertising profiles. Legal basis: legitimate interests in understanding how the site is used; consent for the visitor cookies.
  • Advertising measurement: if you accept cookies (or, outside the EU, UK, EEA and Switzerland, unless you opt out) we use the Meta Pixel and the Meta Conversions API to learn when someone who saw our ads on Facebook or Instagram visits the site, signs up or buys. This shares page visits, the event (for example a purchase and its value), your browser’s Meta cookies, IP address and browser type with Meta. Your email address and phone number are hashed (irreversibly scrambled) before they are sent. Meta acts as a separate controller for this data under its own privacy policy. Legal basis: consent (Art. 6(1)(a)) — withdraw it any time via “Your privacy choices”.
  • Security: your IP address is used briefly (in memory, not stored) to rate-limit sign-in, sign-up and password reset attempts. Legal basis: legitimate interests in protecting accounts.

We never sell your data, and we do not make automated decisions that have legal effects on you.

Cookies

  • Sign-in and security: a sign-in session cookie and security (CSRF) cookies set when you log in. Always on — the site needs them.
  • Preferences: small settings stored in your browser (e.g. display preferences, cart contents) and your cookie choice itself.
  • Matomo visitor cookies: recognise return visits. Only with your consent.
  • Meta _fbp and _fbc: link visits to our Facebook and Instagram ads. Only with your consent.

Your choices: visitors from the EU, UK, EEA and Switzerland are asked first with a cookie banner; elsewhere these cookies are on unless you opt out. Change your mind any time with the banner or the link at the foot of every page — choosing “No thanks” stops the Matomo visitor cookies and the Meta Pixel straight away. We also honour the Global Privacy Control signal sent by your browser as an opt-out.

Who Processes Data for Us

  • Stripe (USA/Ireland) — card payments, subscriptions and billing portal.
  • Google (USA) — only if you choose “Sign in with Google”.
  • Email delivery — account, order and newsletter emails are sent via our SMTP provider [TODO — owner to confirm: SMTP provider name + country (code default is Purelymail, USA)].
  • Mautic (self-hosted, operated by us) — our email marketing/contact list.
  • ERPNext (self-hosted, operated by us) — customer records, invoices and accounting.
  • Matomo (self-hosted, operated by us) — visitor analytics (cookieless unless you accept cookies).
  • Meta Platforms (Meta Platforms Ireland Ltd. / Meta Platforms, Inc., USA) — advertising measurement via the Meta Pixel and Conversions API, only as described above; Meta is a separate controller.
  • Hosting and network — our web servers and database [TODO — owner to confirm: hosting provider name + country]; Cloudflare (USA) may proxy traffic for security and performance [TODO — owner to confirm: confirm Cloudflare is in front of vintageradiovault.com].
  • Manufacturing and fulfilment partners (e.g. TrepStar, USA) and marketplaces (eBay, if you buy there) — receive your name and shipping address to produce and ship an order.

International Transfers

Some of the providers above are in the United States. Where personal data from the EU/UK is transferred to the US, we rely on the EU–US Data Privacy Framework (and its UK extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses [TODO — owner to confirm: verify each provider's transfer mechanism].

How Long We Keep Data

  • Account, listening activity, saved shows: until you delete your account.
  • Orders and invoices: kept for as long as tax and accounting law requires [TODO — owner to confirm: retention period, e.g. 5–7 years]. If you delete your account, these records are kept but your name and email are removed from them (and the shipping address once the order is complete).
  • Newsletter: until you unsubscribe. We keep a record that an address unsubscribed so we don't email it again. Unconfirmed sign-ups are not mailed.
  • Password-reset and email-verification links: expire after 15 minutes and 7 days respectively.
  • Backups: nightly database backups are kept for about 15 days, so deleted data can remain in backups for up to that long before it is overwritten.

Your Rights

Under the GDPR and UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your data, to receive it in a portable format, and to withdraw consent at any time (without affecting processing before withdrawal).

Complaints

You can complain to a data protection authority. Our lead supervisory authority is the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl. You may also contact the authority in your own EU country, or, in the UK, the Information Commissioner's Office (ico.org.uk).

Children

VRV is not directed at children under 16, and we do not knowingly collect their data.

Changes

If we change this policy in a meaningful way we will update the date above and, for significant changes, tell account holders by email.