Privacy policy

Last updated: July 23, 2026

1. Who we are

This Privacy Policy explains how DirectDisc ("DirectDisc," "we," "us," or "our") collects, uses, and protects your personal information when you use directdisc.io and related services (the "Platform"). DirectDisc is a sole proprietorship operated by Aaron Neal from New York, USA.

For the purposes of applicable data-protection law, DirectDisc is the "controller" of the personal information collected through the Platform, except where we act as a processor on behalf of artists or where our third-party providers act as independent controllers.

2. Information we collect

2.1 Information you give us. When you place a pre-order, create an account, or contact us, we collect information such as your name, email address, shipping and billing address, order details, and communications you send us.

2.2 Payment information. Payments are processed by third-party payment providers (including Shopify Payments and its supported gateways). Your full card details are collected and processed directly by those providers — we do not store full payment card numbers. We may receive limited information such as the last four digits, card type, and transaction status.

2.3 Information collected automatically. When you visit the Platform, we and our providers automatically collect certain technical data through cookies and similar technologies, including your IP address, device and browser type, pages viewed, referring URLs, and interactions with the site. See Section 7 for cookies.

2.4 Information from third parties. We may receive information from our service providers (for example, order and fulfillment status, fraud-prevention signals, or analytics) and, where relevant, from artists whose drops you participate in.

3. How we use your information

We use personal information to:

  • Process and fulfill your pre-orders, including charging your payment method when a drop closes successfully and arranging manufacturing and shipping;
  • Communicate with you about your orders, drops you have joined, and campaign outcomes (including whether a drop reached its threshold);
  • Provide customer support and respond to your inquiries;
  • Detect, prevent, and address fraud, abuse, and security issues;
  • Operate, maintain, and improve the Platform;
  • Send marketing or promotional messages only where you have opted in or where otherwise permitted by law — you can unsubscribe at any time; and
  • Comply with legal obligations and enforce our Terms.

4. Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (to process your orders and drops); legitimate interests (to secure, operate, and improve the Platform and prevent fraud); consent (for optional marketing and non-essential cookies); and legal obligation (to meet tax, accounting, and other legal requirements). Where we rely on consent, you may withdraw it at any time.

5. How we share your information

We do not sell your personal information. We share it only as needed to run the Platform:

  • Service providers who host, operate, and support the Platform — for example, our e-commerce platform (Shopify), payment processors, the crowdfunding/pre-order app that manages drop funding and charge-at-close, email and analytics providers, and shipping/fulfillment partners;
  • Manufacturers and fulfillment partners, who receive the information necessary to produce and ship your order (such as name, shipping address, and order contents);
  • Artists receive only aggregate campaign data about their own drops — such as the total number of orders and amounts raised. Artists do not receive individual buyers' names, email addresses, or contact details. If we introduce any feature in the future that shares buyer contact information with artists, or that emails you on an artist's behalf, we will update this Policy and obtain your consent first;
  • Legal and safety recipients, where disclosure is required by law, legal process, or to protect our rights, users, or the public; and
  • Business transfers, if DirectDisc is involved in a merger, acquisition, or sale of assets, subject to this Policy.

6. International data transfers

Our providers (including Shopify) may process and store data in countries other than yours, including the United States. Where personal information is transferred internationally, we rely on appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, as required by applicable law.

7. Cookies and similar technologies

We use cookies and similar technologies to operate the Platform, remember your preferences, secure checkout, and understand how the site is used. Essential cookies are necessary for the site to function; analytics and marketing cookies are used only where permitted. We use Shopify's cookie-consent banner to manage your preferences: where required by your region's laws (such as the EU/UK and California), you can accept or decline non-essential cookies through that banner, and you can also control cookies through your browser settings.

8. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy — including completing your orders, providing support, and meeting legal, tax, and accounting obligations — and then delete or anonymize it. Retention periods vary by data type and legal requirement.

9. Your rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

  • Access — request a copy of the personal information we hold about you;
  • Correction — ask us to fix inaccurate or incomplete information;
  • Deletion — ask us to delete your information, subject to legal exceptions;
  • Restriction / objection — ask us to limit or stop certain processing;
  • Portability — request your information in a portable format;
  • Withdraw consent — where we rely on consent, withdraw it at any time; and
  • Opt out of marketing — unsubscribe from promotional messages via the link in any such message.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of "sale" or "sharing" of personal information. We do not sell your personal information. You will not be discriminated against for exercising these rights.

To exercise any right, contact us at hello@directdisc.io. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law.

10. Data security

We take reasonable technical and organizational measures to protect your personal information, and we rely on established providers (such as Shopify) whose platforms include security safeguards. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children's privacy

The Platform is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us at hello@directdisc.io and we will delete it.

12. Third-party links

The Platform may link to third-party sites (for example, artists' pages or social media). We are not responsible for the privacy practices of those sites, and we encourage you to review their policies.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date reflects the latest revision. Material changes will be communicated through the Platform or by other appropriate means. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

14. Contact

Questions or requests about your privacy? Contact us at hello@directdisc.io.

DirectDisc — directdisc.io