Stembiosis Privacy Policy

1. What we collect

Your account. Email address, display name, a securely hashed password (we never store the password itself), whether you work as a producer and/or vocalist, and — if you fill them in — a short bio and genre tags. If you choose to appear in collaborator discovery, your display name, roles, bio, tags, your count of completed collaborations, and any disputed human/AI-origin flags against your uploads are visible to other signed-in members.

Collaboration activity. Collaboration titles, the agreements you propose and sign (the parties, the revenue split, the amount), and an activity log of every step — who proposed terms, who signed, who funded, who approved release, and when. When you sign an agreement or upload a file, we also record your IP address and the time, as evidence of what was agreed.

Audio you upload. The stem files themselves (stored with our hosting provider), their file names, a content fingerprint (SHA-256 hash), the file type, whether you marked the stem human-made or AI-generated, and the IP address and time of the upload.

Split sheets. If you generate one, it includes the legal names, credited roles, and any PRO affiliations you enter, plus the agreed percentages. This document is for you to submit to your own distributor or PRO — we do not send it anywhere.

Payment records. The amount of each held payment, its status, our fee, and the identifiers our payment processor (Stripe) gives us for the checkout, the payment, any refund, any payout, and your connected payout account. See section 3 for what Stripe handles directly.

The store. If you buy merchandise, we collect your name, email, shipping address, and order details so we can fulfil and track the order.

Automatically. Basic technical data from your requests — IP address, browser and device information — which our hosting provider logs, and which we use to keep the service running and to investigate fraud and abuse. We do not currently run any third-party analytics or advertising trackers.

2. Why we use it

• To run collaborations — matching, agreements, signatures, stem exchange, previews.
• To hold, release, and refund payments, and to pay out your share.
• To keep evidence (the activity log, signature and upload records) so we can resolve a dispute about held funds.
• To respond to copyright complaints and enforce our Terms.
• To detect and prevent fraud, abuse, and security incidents.
• To send you service messages (for example, order confirmations from the store, or a notice about a dispute).
• To meet tax, accounting, and other legal obligations.

3. Stripe and payments

Payments are processed by Stripe. When you pay, your full card number, expiry, and security code are entered on Stripe's systems, not ours — Stembiosisnever receives or stores card numbers. We keep only Stripe's identifiers and the amount and status.

When you set up payouts, Stripe collects the information it needs to pay you and to meet its own legal obligations: your legal name, date of birth, address, a government ID or tax identification number (such as an SSN or EIN), and your bank or debit-card details. Stripe may also ask you for verification documents. Stripe collects and holds all of that directly— we only receive a confirmation that your account is (or is not) ready to receive payouts. Stripe's handling of your information is governed by the Stripe Privacy Policy.

4. Who we share it with

We share information with the service providers we need to operate, each under its own privacy terms:

• Stripe — payment processing, held payments, payouts, and payout-account verification.
• Cloudflare — hosting, the database, audio file storage, and content delivery. Our contact form also uses Cloudflare Turnstile to block spam.
• Resend — sending transactional email (such as store order confirmations).
• Shippo and the shipping carrier — for store orders only: your name and shipping address, to rate and deliver the package.

We also share your display name and rolewith your collaborator inside a shared collaboration, and any files you upload there. We may disclose information if required by law, to enforce our Terms, or to protect someone's safety. If Stembiosis is ever transferred to a new operator, account and collaboration records would transfer with it. We do not sell your personal information and we do not share it for cross-context behavioral advertising.

5. How long we keep it

Account and collaboration records, including the activity log, signed agreements, and payment records, are kept for as long as your account is open and afterward as needed for tax, accounting, dispute, and legal-defense purposes.

Uploaded stems stay in the collaboration workspace after the collaboration closes so both people keep access to what they exchanged. You can ask us to delete your uploads at any time (see section 6). Store order records are kept as needed to handle returns and meet tax obligations.

6. Your choices and rights

Email privacy@stembiosis.com to access, correct, or delete your personal information, or to ask for a copy of it. Depending on where you live you may have additional rights under laws such as the GDPR or U.S. state privacy laws; we honor those requests.

Some limits apply: we may need to keep certain records to complete a payout or refund, to resolve an active dispute, to comply with tax and accounting law, or to defend a legal claim. Deleting your account does not automatically remove files from a collaboration you shared with someone else — ask us and we will handle it. We will not discriminate against you for exercising these rights.

7. Cookies and local storage

We use one strictly necessary cookie to keep you signed in. Your browser also stores a couple of small values locally — your cookie-banner choice and, in the store, your cart — which never leave your device. We do not currently use analytics or advertising cookies. If that changes, we will update this policy and ask for consent where required.

8. Security

Passwords are stored using PBKDF2 hashing, traffic is encrypted in transit, card payments are handled by Stripe (which is PCI-compliant), and audio downloads require you to be signed in and a party to the collaboration. No system is perfectly secure, but we take reasonable measures to protect your information.

9. Data breach

If a breach affects your personal information, we will notify you and the relevant authorities as required by applicable law, and tell you what happened and what you can do.

10. Children

Stembiosis is for adults. You must be at least 18 to use it, and we do not knowingly collect information from anyone under 18.

11. International users

Stembiosis is operated from the United States and your information is processed there. If you use Stembiosis from outside the U.S., you understand your information will be transferred to and processed in the U.S.

12. Changes

We may update this policy. Material changes get a new version number and effective date here, and a reasonable effort to notify you.

13. Contact

Privacy questions and requests: privacy@stembiosis.com
General support: support@stembiosis.com
Legal: legal@stembiosis.com
Copyright: dmca@stembiosis.com
Derek Vance (Stembiosis), Ohio, USA