Privacy policy
Effective 29 September 2026
StemOut is a Shopify app for mixing and mastering engineers. It lets a store's buyers upload stems and book a day, lets the store play audio samples, and lets the store send finished songs back to buyers. This policy explains what data StemOut handles, why, and how long it keeps it. If you have questions, email support@stemout.store.
Who this covers
Merchants are the Shopify stores that install StemOut. Buyers are the merchant's customers who use StemOut on the merchant's store. For buyers' data, the merchant decides how it's used and StemOut processes it on the merchant's behalf. Buyers with privacy requests should contact the store they bought from; the store can ask us to act on it.
Data we collect from merchants
- Store details from Shopify: the store's domain, name, contact email, timezone and plan, and the access token Shopify gives the app.
- Subscription status, handled through Shopify's billing system. We never see payment card details.
- Settings the merchant chooses in StemOut, such as booking limits and open days.
Data we collect about buyers
- Files the buyer uploads (stems) and their file names.
- The day the buyer books.
- The order number and order ID the upload and booking belong to.
- The buyer's email address, only when the merchant sends a finished song back, so we can email the download link.
- Finished songs the merchant uploads for the buyer.
- Technical data needed to run the service, such as IP addresses in server logs.
We don't collect buyers' names, addresses, phone numbers or payment details.
How we use data
- To receive and store buyers' stems for the merchant.
- To manage booking days and stop orders without stems or a booking.
- To link uploads and bookings to the right order.
- To email buyers a link to download their finished song.
- To bill merchants through Shopify and provide support.
We don't sell data, use it for advertising, or share it with anyone except the service providers below.
Service providers
- Shopify: the platform StemOut runs on, and billing.
- Cloudflare (R2 storage): stores uploaded stems and finished songs.
- Fly.io: hosts the StemOut server and its database, in the United States.
- Resend: sends the “your song is ready” emails.
These providers may process data outside your country, including in the United States. They process it only to provide their service to us.
How long we keep data
- Uploads that are started but not finished: deleted after 24 hours.
- Uploads that never become part of an order: deleted after 14 days.
- Booking holds that aren't checked out: released after 24 hours.
- Finished songs sent back to buyers: deleted when the download link expires, 60 days after sending.
- Uploads and bookings that are part of an order: kept until the merchant deletes them or uninstalls StemOut.
- When a merchant uninstalls StemOut, Shopify notifies us 48 hours later and we delete all of that store's data and files.
- When a buyer asks a store to delete their data, Shopify notifies us and we delete the files linked to that buyer's orders.
Security
Data is sent over encrypted connections (HTTPS). Files are stored in private storage and are only reachable through signed links that expire. Requests from stores are verified with Shopify's signatures, and checkout checks use signed tokens that can't be forged.
Cookies
This website doesn't use tracking or advertising cookies. The StemOut app inside Shopify uses the session information Shopify provides to keep merchants signed in.
Your rights
Depending on where you live (for example under the GDPR, CCPA or POPIA), you may have the right to access, correct or delete your data, or to object to how it's used. Merchants can email support@stemout.store. Buyers should contact the store they bought from, which can pass the request to us.
Changes
We'll update this page if our practices change, and change the effective date above.
Contact
Email support@stemout.store with any privacy question or request.