This policy explains what personal data wagnerwho.com processes, why, for how long, and the choices you have. I kept it short and plain. If anything is unclear, email me.
In short
- No user accounts, no newsletter and no ads on this site. I never sell or rent your data.
- Google Analytics, the Meta Pixel and embedded music players run only if you allow them. In the EU, EEA, UK and Switzerland, and on German pages, they stay off until you say yes.
- Purchases happen on the checkout platform (Gumroad), which handles your payment. I never see your card details.
- You can change your choice at any time under Cookie settings in the footer.
Who is responsible
The controller of your personal data on this website is Wagner Who, an independent music producer and plugin developer based in Brazil. In this policy, “I” and “me” mean Wagner Who.
For any privacy question or request, write to sitesupport@wagnerwho.com. The same address is the contact of the person in charge of data protection (privacy officer).
Visiting the website
When you open a page, your browser sends technical data to the server: IP address, date and time, the page requested, the page you came from, and your browser and operating system. This is needed to deliver the page and to keep the site secure, for example to block attacks. Failed logins to the admin area are recorded with the IP address to stop password guessing.
The site is hosted by Hostinger International Ltd. (Cyprus), which also runs the content delivery network that serves it. Hostinger processes this data on my behalf under its data processing terms and keeps server logs only for a short time. Pages are cached with LiteSpeed Cache, which sets no cookies for visitors. Fonts are served from this server, so no font requests go to Google.
Legal basis: my legitimate interest in a working and secure website (Art. 6(1)(f) GDPR; art. 7, IX LGPD).
Cookies and similar technologies
Some information is stored in your browser. Necessary items are always on. Everything else depends on your choice, which you can change here:
| Name | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
ww-consent (local storage) |
wagnerwho.com | Remembers your privacy choice | 12 months | Necessary |
pll_language (cookie) |
wagnerwho.com | Remembers the site language | 1 year | Necessary |
cp-emb-ok-* (local storage) |
wagnerwho.com | Remembers “always load” for a player on German pages | Until you clear it | Necessary |
_ga, _ga_* (cookies) |
Tell visits apart for statistics | 2 years | Statistics | |
_fbp (cookie) |
Meta | Recognizes the browser to measure and target my ads | 3 months | Marketing |
| Cookies and storage of the players | Spotify, Apple, Google (YouTube), TIDAL, Deezer, Amazon, AWA | Set by the service when its player loads, under its own policy | Set by the provider | Music players |
Your region is estimated from your device’s time zone, inside your browser. Nothing is sent anywhere to work it out.
Statistics (Google Analytics)
With your permission, I use Google Analytics 4 (through Google Site Kit) to see how the site is used: pages visited, clicks on releases and buttons, how visitors found the site, approximate location (country and city), and device and browser type. This shows me what people enjoy and what needs fixing.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA. Google Analytics 4 does not log or store IP addresses. Advertising features are off: Google Consent Mode keeps advertising storage and ad personalization denied for every visitor.
The Google script is not loaded at all until statistics are allowed. In the EU, EEA, UK and Switzerland, and on German pages, it stays off until you opt in. In other regions it is on by default and you can switch it off at any time. If your browser sends a Global Privacy Control (GPC) signal, it stays off.
Legal basis: your consent where the law requires it (Art. 6(1)(a) GDPR; § 25(1) TDDDG); elsewhere my legitimate interest in understanding how the site is used (art. 7, IX LGPD), with the right to opt out. Statistics are kept for at most 14 months; the cookies expire after 2 years.
Marketing (Meta Pixel)
I promote my music and plugins with ads on Facebook and Instagram. With your permission, the Meta Pixel records which pages you visit here (for example a plugin page) and connects this with your Meta account if you have one. This tells me whether my ads work and lets me show ads to people who visited the site or are similar to them.
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and Meta Platforms, Inc., USA. For the collection and transmission of this data, Meta and I are joint controllers (Art. 26 GDPR) under Meta’s Controller Addendum; Meta is responsible for everything that happens afterwards. Meta explains its processing in its Privacy Policy, and you can manage ads in your ad preferences.
The pixel is not loaded until marketing is allowed. In the EU, EEA, UK and Switzerland, and on German pages, it stays off until you opt in. In other regions it is on by default and you can switch it off at any time under Cookie settings; a Global Privacy Control signal keeps it off. Legal basis: your consent where the law requires it (Art. 6(1)(a) GDPR; § 25(1) TDDDG); elsewhere my legitimate interest in promoting my work (art. 7, IX LGPD), with the right to opt out. The _fbp cookie expires after 3 months.
Music players from streaming services
Release and streaming pages can show players from Spotify, Apple Music, YouTube, TIDAL, Deezer, Amazon Music and AWA. A player loads from the service’s own servers, so the service receives your IP address, browser data and the page you are on, and it may set cookies or read data it stored earlier. If you are logged in to that service, it can link the visit to your account. YouTube videos use YouTube’s privacy-enhanced mode (youtube-nocookie.com).
Players load only when you scroll near them. In the EU, EEA, UK and Switzerland, and on German pages, a player loads only after you click “Load player” or allow music players in Cookie settings. Plain “Listen on” links send nothing until you click them.
Legal basis: your consent where the law requires it (Art. 6(1)(a) GDPR; § 25(1) TDDDG); elsewhere my legitimate interest in letting you hear the music (art. 7, IX LGPD). Each service explains its own processing: Spotify, Apple, Google (YouTube), TIDAL, Deezer, Amazon Music and AWA (in their apps and websites).
Buying a plugin
Plugins are sold through checkout platforms: Gumroad (Gumroad, Inc., USA). The sales page always shows which one handles your order. Checkout happens on their website: they collect your name, email address, billing country and payment details, process the payment and taxes, and send you the download. They act as the seller (merchant of record) or as an independent controller under their own privacy policies.
From the platform I receive what I need to deliver and support your license: name, email address, country, product, price and order number. I never receive card or bank details.
When a sale happens, the platform also notifies this website. Only the buyer’s country is kept, to show anonymous notices such as “Someone from Germany just bought Kick & Bass Auto Mix”. These notices are deleted after the display period (90 days at most).
Legal basis: performing the contract (Art. 6(1)(b) GDPR; art. 7, V LGPD) and legal duties such as tax records (Art. 6(1)(c) GDPR; art. 7, II LGPD); the anonymous notices rely on my legitimate interest (Art. 6(1)(f) GDPR). Order data is kept while your license is supported and for as long as tax and commercial law requires.
Emailing me
If you email me, I use your address and message only to answer you. Legal basis: my legitimate interest in replying, or steps toward a contract when you ask about a purchase (Art. 6(1)(b) and (f) GDPR). I delete messages when they are no longer needed, normally within 2 years, unless they relate to a purchase.
Service providers and international transfers
I share data only with the providers below, for the purposes described. I am based in Brazil, and some providers are outside your country. Where the GDPR applies, transfers rely on an adequacy decision (for example the EU-U.S. Data Privacy Framework, under which Google is certified) or on the European Commission’s standard contractual clauses (Art. 46 GDPR).
| Provider | Country | Purpose | Data |
|---|---|---|---|
| Hostinger International Ltd. | Cyprus (EU) | Hosting, content delivery, server logs | IP address, technical data |
| Google Ireland Ltd. / Google LLC | Ireland / USA | Statistics (with permission), YouTube player | Usage data, online identifiers, IP address |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Ireland / USA | Ad measurement and targeting (with permission) | Pages visited, online identifiers, IP address |
| Spotify, Apple, TIDAL, Deezer, Amazon, AWA | Sweden, Ireland, Norway, France, USA / Luxembourg, Japan | Music players (with permission) | IP address, browser data, cookies |
| Gumroad, Inc. | USA | Checkout and delivery | Order and contact data |
Your rights
Depending on where you live, you can ask to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw your consent at any time (this does not affect what happened before). Email sitesupport@wagnerwho.com; I answer within the time set by law, usually within 15 days. I do not make automated decisions or profiles that have legal effects on you.
- EU, EEA, UK and Switzerland: you can complain to the data protection authority where you live or work.
- Brazil: you also have the rights in art. 18 LGPD, including information about who your data is shared with, and you can complain to the ANPD (Autoridade Nacional de Proteção de Dados).
- United States: depending on your state (for example California), you can ask to know, delete or correct your data and to opt out of its sale or sharing. I do not sell personal data for money. The Meta Pixel can count as “sharing” for cross-context behavioral advertising: you can opt out at any time under Cookie settings, and Global Privacy Control turns it off automatically. I do not use sensitive personal data. Global Privacy Control is honored as described above. Using these rights never leads to different treatment.
- Japan and South Korea: you can ask for disclosure, correction, suspension of use and deletion. Data is kept only for the periods above and then deleted or made anonymous.
Security
The site runs only on HTTPS. Admin access is restricted and protected against password guessing, software is kept up to date, and backups are made regularly. No method is perfectly safe, but I work to protect your data.
Children
This website is not aimed at children under 16, and I do not knowingly collect their data. If you think a child has sent me personal data, email me and I will delete it.
Changes to this policy
When the site or the law changes, I update this page and the date at the top. For important changes, I will show a notice on the site.