The Tomb Studio

Privacy Policy

How we collect, use, and protect your data

Last updated: October 27, 2026

The Tomb Studio (“we”, “our”) operates tomb.freewaterent.com and related services for studio bookings, beat consignment, live streaming, and social media integrations. This policy explains what we collect, why we collect it, how it is stored, and the choices you have over it.

Data We Collect

  • Account. Name, email address, and a Keycloak identity identifier. We do not store passwords - sign-in is delegated to Keycloak via OAuth.
  • Bookings. The service, date, time, payment receipts, engineer assignment, and any notes you add. Stored in our database for at least 7 years for tax purposes.
  • Payments. Card details are never stored by us. Stripe and PayPal handle charges; we receive only a payment identifier, status, and the last four digits of the card.
  • Beats & merch. Audio uploads, cover artwork, producer payout email, and sale records. Audio files stay on our servers and are never shared outside the purchase you grant access to.
  • Connected social accounts. If you connect a third-party account (YouTube, Twitch, TikTok, Instagram, Facebook, Spotify), we store your platform user ID, public profile metadata (channel name, handle, avatar), OAuth access and refresh tokens, and token expiry. Tokens are used only to perform the actions described in the “Third-Party Integrations” section below.
  • Streaming configuration. Stream keys, RTMP ingest URLs, channel titles, and broadcast metadata needed to run your configured live-stream destinations.
  • Uploaded content. Files you upload for bookings, beat submissions, stream submissions, and vault deliveries, plus associated metadata.
  • Site analytics. Server access logs (IP + user-agent) are kept for 30 days. We do not run third-party trackers or ad pixels.

How We Use Your Data

  • Provide the services you request: bookings, beat purchases, file delivery, messaging, and live-stream configuration.
  • Display analytics dashboards for your connected accounts (views, followers, watch time, engagement) inside your account area.
  • Publish or schedule content to your connected accounts only when you explicitly request it.
  • Operate your configured live-stream destinations: resolving ingest URLs, syncing stream titles and descriptions.
  • Process payments and send transactional email (confirmations, receipts, delivery notices, reminders).
  • Maintain security, prevent abuse, and meet legal obligations such as tax-record retention.

Google & YouTube Data

When you connect a Google or YouTube account, we request the minimum OAuth scopes needed for the feature you enabled:

  • youtube.readonly - read your channel information, videos, and live stream resources so we can display your channel profile and resolve your stream ingest details.
  • yt-analytics.readonly - read YouTube Analytics for your channel to populate your social dashboard (views, watch time, subscribers, top videos).
  • youtube.force-ssl - create and update live stream and live broadcast resources on your channel when you use the stream-key import or title-sync features.

Our use of Google user data is limited to the features described above. We do not sell Google user data, use it for advertising, or share it with third parties except as required to operate the service. Our access, use, storage, and sharing of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

Third-Party Integrations

  • Twitch. If you connect Twitch, we store your broadcaster ID, login name, and OAuth tokens so we can fetch your stream key for RTMP destinations and update your channel title when you go live.
  • TikTok. If you connect TikTok, we store your open ID, display name, avatar, follower stats, and OAuth tokens so we can show analytics and post videos you approve.
  • Meta / Instagram / Facebook. We store your Meta user ID, page IDs, profile metadata, and access tokens to enable cross-posting, scheduling, comments, and insights.
  • Spotify. We store your artist ID and OAuth tokens to display release and listener stats.

You can disconnect any integration at any time from your socials page, which deletes the stored connection and tokens from our database. Revoking access on the provider's side also works - the connection will simply fail to refresh.

Sharing & Processors

We do not sell your data. We share it with vendors only when necessary to deliver the service: Stripe and PayPal (payments), Keycloak (sign-in), Cloudflare (CDN/edge), Mailgun SMTP relay (transactional email), and our hosting provider. Each vendor processes data under its own privacy terms.

Storage & Security

Data is stored on infrastructure we operate. Sensitive fields such as messages and connection tokens are encrypted at rest, all traffic is served over HTTPS, and access to production systems is restricted to studio staff.

Data Deletion

You can request deletion of your data by emailing thetombstu@gmail.com. Deletions that conflict with our tax-record retention window are honored as soon as that window closes.

For Meta/Instagram-connected accounts, you can also request deletion through your Facebook account settings, which will trigger our automated data deletion callback.

Children

Our services are not directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

Changes to This Policy

We may update this policy as features change. The “Last updated” date at the top reflects the latest revision. Continued use of the service after an update constitutes acceptance of the revised policy.

Contact

Questions about privacy? Contact us at thetombstu@gmail.com or visit tomb.freewaterent.com/contact

View our full Terms & Policies for booking, payment, and studio behavior policies.