Privacy & Cookie Notice

This notice explains what personal information SOUNDDEX collects, how we use and protect it, and the choices you have. It is written to align with South Africa's Protection of Personal Information Act (POPIA).

Who we are

SOUNDDEX is a directory for South Africa's audio industry. For any privacy questions or requests, contact us at hello@sounddex.local.

What we collect

• Account information - your name, email address, and password. Passwords are stored only as a one-way hash; we can never see them.
• Listing & profile content - anything you publish to your directory listing (studio name, location, contact details, images, links, and page content).
• Usage analytics - aggregate views and clicks on your listing, plus coarse visitor signals (country and referring site). Visitor identifiers are stored only as a one-way hash.
• Payment information - handled entirely by our payment provider, Paystack. Card numbers never reach our servers; we only store Paystack reference tokens needed to manage your subscription.
• Contact enquiries - the name, contact details, and message you choose to submit through a SOUNDDEX or listing contact form.

Cookies

We keep cookies to a minimum. SOUNDDEX uses a single strictly-necessary cookie to keep you signed in (a secure, http-only session cookie). Your light/dark theme preference is stored in your browser's local storage, not a cookie.

We do not use advertising or third-party tracking cookies, so no cookie-consent opt-in is required to browse the site. Contact forms use Cloudflare Turnstile for bot detection; the widget performs browser checks when the form is displayed but is not configured to issue a site-access cookie. If you make a payment, Paystack may set its own cookies on its checkout pages, governed by Paystack's privacy policy.

How we use your information

• To create and operate your account and listing.
• To process subscription payments and the optional featured add-on.
• To show you analytics about your listing's performance.
• To send essential account and billing emails.
• To receive and respond to support requests you submit.
• To prevent automated abuse of public contact forms.

Sharing with service providers

We never sell your personal information. We share it only with the service providers we rely on to operate SOUNDDEX, acting as our processors under POPIA:

• Paystack - payment processing. Card data is tokenised by Paystack and never reaches our servers.
• Atlassian (Jira Service Management) - our support ticketing system. If you submit a support request, your name and email address are sent to Atlassian to create the request and a corresponding support-portal contact record so our team can reply to you. Atlassian hosts this data on infrastructure outside South Africa, so this involves a cross-border transfer, carried out under Atlassian's data-processing terms. We share support data with Atlassian only when you choose to contact support - no support account is created otherwise.
• Cloudflare Turnstile - human verification on public contact forms. Cloudflare receives the browser and network signals needed to assess whether a submission is automated; SOUNDDEX receives only the resulting short-lived verification token.

How we protect it

• All traffic is served over HTTPS (encrypted in transit).
• Passwords are hashed; sensitive fields such as two-factor secrets and integration credentials are encrypted at rest.
• Card data is tokenised by Paystack - we never store it.

End-to-end encrypted media

Expert members can choose end-to-end encryption for ListenLoop projects and QuickSend files. When enabled, files are encrypted in the member's browser before upload. SOUNDDEX administrators and the application server do not receive the decryption keys and cannot recover the encrypted file from the R2 storage object by themselves.

Encryption is user-controlled and has no administrator bypass. Members must protect their recovery key and trusted devices; if all recovery material and trusted devices are lost, encrypted files may be permanently inaccessible. A recipient who receives a complete encrypted share link can decrypt the files included in that link, and SOUNDDEX cannot revoke plaintext copies that someone has already downloaded.

This protection applies only to files and projects the member explicitly encrypts. Voice comments and text proposals for encrypted files are encrypted in the browser too. Encrypted media is fully downloaded and decrypted locally before playback; large-file behavior depends on browser memory. Duration and basic dimensions are read locally, and video posters are generated locally; codec/bitrate analysis, stored thumbnails, watermark derivatives, and server-side malware scanning are not performed for encrypted files because they would require creating plaintext on SOUNDDEX infrastructure. Encrypted uploads should be scanned locally before upload.

Data retention & your rights

Under POPIA you may request access to, correction of, or deletion of your personal information. You can delete your account at any time from Account → Delete account in your member dashboard; this cancels any active subscription, permanently erases your account, listings, saved data, encrypted media, and associated encryption envelopes, and removes your support-portal contact record from Atlassian. Deletion cannot recover encrypted files, and already-downloaded plaintext copies are outside our control. Some records may be retained by our payment provider where required for financial-compliance purposes.

Icon attribution

SOUNDDEX uses Phosphor Icons, an icon set made available under the MIT License. Phosphor Icons is copyright Phosphor Icons and its contributors.

Changes to this notice

We may update this notice from time to time. Material changes will be reflected on this page.