1. Introduction & Data Controller Identity

Andrea B. Denney Studios (“Studio,” “we,” “us,” “our”) operates from Dickson County, Dickson, Tennessee 37055, United States. We are the data controller for personal information you provide through andreabdenneystudios.com, checkout, Companion app, email, and related services.

Our work involves preservation of sensitive materials including voice recordings, voicemails, and stories of deceased loved ones. Because of that, we treat privacy as stewardship, not checkbox compliance. This Policy explains what we collect, how we use it, lawful bases under GDPR, your California rights under CCPA/CPRA, Tennessee consumer considerations, retention, security, and how to exercise rights.

Contact for privacy requests: hello@andreabdenneystudios.com. We respond to verifiable requests within 30 days, and 45 days where CCPA timeline applies.

2. What We Collect

Identifiers: name, email, phone, billing address, IP address, device identifiers.
Commercial: purchase history, cart totals, coupons used, affiliate referral source (?ref).
Audio Data & Sensitive Personal Information: voice files, voicemails, voice memos, WhatsApp or Messenger voice exports you upload with consent, narrative transcripts. Under CCPA this is sensitive; we do not sell it or use it to infer characteristics.
User Content: Companion journal entries, reflections, legacy questionnaires, facilitator guide responses.
Internet Activity: pages viewed, behavior events logged via our first-party behavior tracker (use-behavior-tracker), referring URL, affiliate localStorage entry, time on page.
Support & Communication: emails to hello@, support tickets, EveryExpert widget interactions.
Payment: Stripe processes cards. We do not store full card numbers. We receive last 4, brand, transaction ID.

3. How We Collect

Directly from you via forms, checkout, voice upload, Companion workspace, and email. Automatically via cookies and localStorage: affiliate ?ref parameter stored 60 days, session auth, and behavior analytics. From processors: Stripe for payment confirmation, Supabase Auth for account creation, Buildy hosting logs. We do not purchase lists.

4. Legal Bases Under GDPR (EEA/UK)

If you are in the EEA, UK, or Switzerland, we process under:

Contract: to deliver $19 kit, $297 review, $3K full voice, $10K Archive, guides, books redirect, Companion subscription.
Consent: for marketing emails, for storage of voice of deceased where you represent you have lawful permission, for non-essential cookies, for sensitive audio handling.
Legitimate Interest: fraud prevention, affiliate fraud checks, site security, improving offerings, remembering ?ref 60 days.
Legal Obligation: tax accounting 7 years, compliance with law enforcement requests where legally required.

You may withdraw consent anytime without affecting prior lawful processing by emailing hello@.

5. How We Use Your Data

Deliver voice preservation kits instantly on-screen + email backup.
Review up to 200 files and produce 10-minute heirloom + WAV masters for Full Voice Preservation.
Execute 12-week Legacy Continuance Archive: discovery, story, transform, ensure — per client agreement.
Provide Companion daily keeping, journaling, and path prompts.
Operate 7-day free trial for Companion, manage Stripe portal cancellations.
Track affiliate referrals via ?ref and localStorage for 60 days, calculate 30% commission on high-ticket only.
Send Weekly Notes marketing if subscribed; transactional emails always (receipts, delivery, upload confirmations).
Secure, back up, and purge after deletion requests (see retention).

6. Processors & Sub-Processors

We share only what is needed to operate:

Stripe, Inc. (US) — payments, tax calculation, subscription portal: andreabdenneystudios.com/support links to customer portal.
Supabase (US) — database, auth, file storage for voice and journal, encrypted at rest.
Buildy (Hosting Platform) — website hosting, behavior tracker, publish-scheduled-posts automation.
EveryExpert.com — embed script at footer for credentials badge; loads only on pages with badge container.
Amazon (Books) — when you click Books, you are redirected to Amazon; their privacy applies.

We do not sell personal data. We do not share voice data with AI training companies. Human artistry only — AI for editing efficiency, never to recreate sound.

7. International Transfers & SCCs

Our primary storage and processing is in the United States. The US does not have an adequacy decision from the EU. Where we transfer data from EEA/UK to US, we rely on your explicit consent at checkout/upload, contract necessity to deliver what you purchased, and Standard Contractual Clauses embedded in processor DPAs (Stripe, Supabase). You can request a copy of SCCs via hello@.

8. Tennessee & US Privacy Notes

Tennessee does not currently have a comprehensive state privacy law like California, but we voluntarily provide same rights to all US users. We comply with FTC truth-in-advertising, CAN-SPAM for email (unsubscribe in every marketing email, physical address included), and sales tax collection where required by Tennessee Department of Revenue. We do not sell sensitive personal information. Voice files of deceased are treated as sensitive and not shared.

9. Retention & Deletion

Voice files & uploads: retained until you request deletion. After request, removed from active storage immediately and from backups within 30 days (3-2-1 backup: 3 copies, 2 media types, 1 offsite; purged on cycle).
Companion journal entries: until account deletion.
Purchase & accounting: 7 years for tax, per Tennessee and IRS requirements.
Affiliate records: 7 years for tax reporting after final payout.
Support tickets: 3 years.
Email marketing: until unsubscribe; receipts retained 7 years.
Behavior logs: 90 days then aggregated.

10. Security

TLS 1.3 in transit, AES-256 encrypted at rest via Supabase, role-based access limited to Andrea B. Denney, breach notification within 72 hours where GDPR requires, secure disposal of records, MFA on Stripe and Supabase, backups encrypted. No system is perfect — we cannot guarantee absolute security but we treat voice data with museum-grade stewardship.

11. Your Rights

GDPR (EEA/UK): Access, Rectification, Erasure, Restriction, Portability, Objection, Withdraw Consent.

CCPA/CPRA (California — extended to all US):

Right to Know categories and specific pieces collected in last 12 months, sources, purposes, and third parties.
Right to Delete (exceptions: complete transaction, security, tax).
Right to Correct inaccurate data.
Right to Opt-Out of Sale/Share: we do not sell or share personal data for cross-context behavioral advertising as defined.
Right to Limit Use of Sensitive Personal Information (voice) to what is necessary.
Right to Non-Discrimination for exercising rights.
Authorized Agent: you may designate agent with signed permission and verification.

To exercise: email hello@andreabdenneystudios.com with subject “Privacy Request — [Right]”. We verify by email ownership + recent order ID or last 4 of payment method. California metric: we processed fewer than 100k California requests in prior year; no annual metric disclosure required yet but we track.

We use TLS-only. If using accessible alternate method, include phone callback preference Mon-Fri.

12. Canada, Australia, New Zealand, UK

CASL: commercial emails only with express or implied consent; unsubscribe within 10 business days. Australia: APPs, you may request access/correction. Marketing frequency: Weekly Notes weekly plus transactional; Archive clients receive project emails Mon/Wed/Fri container only.

13. Cookies, Affiliate Tracking, Children

See Cookie Policy for full list. Affiliate tracking: ?ref stored in localStorage and 60-day cookie for attribution. Consent banner not currently set — by using site you consent to essential cookies; you can block via browser and affiliate tracking may fail. Children under 13: not directed to site. 18+ to purchase. No child voice without guardian consent and proof of authority. If we learn under-13 data collected without consent, we delete promptly.

14. Changes, Contact, Grievance

We will post material changes here with new Last Updated date and, if material, email subscribers. For grievance: hello@andreabdenneystudios.com, Dickson County, Dickson, TN 37055. Tennessee consumers may contact Tennessee Attorney General Consumer Division. EU residents have right to lodge complaint with supervisory authority.

Document properties: Controller Andrea B. Denney Studios, DPO Contact same as hello@, Processors as listed, Lawful Bases as above, Retention as above, Cross-border transfer to US with SCCs and explicit consent.

Privacy Policy