Privacy policy

Data we collect

We collect the minimum we need to deliver the course, process your payment, and email you about your account. We do not collect anything for advertising.

• Email address, required for your account, your receipt, and your magic link logins.
• Name, optional, used to personalize emails and your dashboard.
• Self-reported role (label ops, manager, A&R, tour manager, producer, marketer, artist, or other), used to recommend a route.
• Payment information, processed by Stripe. We never see or store your card number. We store only a Stripe customer ID and a record of which tier you bought.
• Course progression data, which modules you started and finished, used to render your dashboard and to improve curriculum.
• Bridge activation events, which AstraBrava products (CatalogIQ, MusicOps, proof.audio, etc.) you activated from inside a module.
• Aggregate analytics via Cloudflare Web Analytics, which is cookieless and does not fingerprint you.

How we use it

• Deliver the course and your account dashboard.
• Send transactional email, receipts, magic link logins, refund confirmations, and material policy updates.
• Improve curriculum based on aggregate completion data (we look at which modules people finish, not at any single student).
• Send marketing email only if you check the opt-in box at signup. Opt-in is separate from purchase. You can unsubscribe from any marketing email in one click.
• Send Bruce a weekly internal digest of new students and progress. No personally identifiable information leaves AstraBrava in that digest.

Who we share it with

We share the minimum required with the vendors below to operate the course. We do not share, sell, or rent your data to ad networks, data brokers, or any third-party CRM.

• Stripe, for payment processing. Stripe receives your name, email, and billing address per its own privacy policy.
• Resend, for transactional email delivery. Resend receives your email address and the email body.
• Cloudflare, for hosting and cookieless web analytics. Cloudflare receives standard request logs (IP, user agent, requested URL).
• Mux, for video hosting. Mux receives anonymized video view events. We do not pass your email or name to Mux.
• Slack, for the Pro community. When you accept a Slack invite, your email is shared with Slack so they can provision your account.
• We never share with: advertising networks, data brokers, Facebook, Google Ads, third-party retargeting pixels, or any party offering to enrich our list.

Your rights

We honor CCPA and GDPR rights for every user, not just for residents of California or the EEA.

• Access, you can request a copy of every piece of data we hold about you.
• Deletion, you can request full erasure. We will delete your account, course progression, and personal data. We retain only the anonymized purchase record required for tax law.
• Correction, you can request that we fix any inaccurate data.
• Portability (GDPR), you can request your data in a machine-readable format.
• Opt out of marketing, you can unsubscribe from any non-transactional email in one click.
• Response time, we respond to all data requests within 30 days. Email [email protected] with the subject line Data request.

Cookies and tracking

We do the minimum and we tell you exactly what we use.

• Cloudflare Web Analytics, cookieless, no fingerprinting, no third-party calls.
• One first-party session cookie, set only after you log in, marked httpOnly and sameSite=lax, 30-day expiry. This cookie keeps you logged in and does nothing else.
• No third-party cookies. No Facebook Pixel. No Google Analytics. No retargeting pixels of any kind.
• A one-time cookie consent banner is shown on first visit. Your choice is stored in browser localStorage, not in a tracking cookie.

Data retention

• Active accounts, we keep your data for as long as your account is active.
• Closed accounts, we delete your personal data within 90 days of closure.
• Purchase records, we keep purchase records for 7 years to comply with U.S. tax law. After your account is closed, those records are anonymized (no name, no email, just amount and date).
• Newsletter unsubscribes, we remove your email from marketing lists within 24 hours.

Changes to this policy

• We update this policy when something material changes, for example a new third-party vendor, a new category of data, or a change in retention.
• On any material change, we send an email notice to all users at least 14 days before it takes effect.
• Last updated: May 27, 2026.

Contact

Email [email protected] for any privacy question, data request, or correction. We read every message.

AstraBrava LLC, California, USA.