Privacy Policy

Version 1.0 · Effective date: 12 October 2026

This policy explains how ASMR Market collects and uses personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and Czech data protection law.

1. Who is responsible

The controller of your personal data is:

data broker s.r.o.
Registered office: Jaurisova 515/4, 140 00 Praha, Czech Republic
Company ID (IČ): 14073757
A company registered in the Commercial Register kept by the Municipal Court in Prague
Email: [email protected]

For any question about your data or to exercise your rights, write to [email protected] or use the contact form.

2. What data we collect

Account data: email address, display name, country, sign-in method (email link or Google), language, age confirmation, email and notification preferences.
Order data: orders, items, licences, prices, VAT, receipts, Circle memberships, custom requests, credit top ups and balance.
Payment metadata: card and wallet details are collected and processed directly by Stripe. We never see your full card number. We receive only limited information such as the card brand, the last four digits, the card country and the payment status.
VAT evidence: to determine the country where you live, which decides the VAT we must charge, we record at least two pieces of non-contradictory evidence, such as your billing country, the country of your card and your IP address and the country derived from it (Article 24b of Council Implementing Regulation (EU) No 282/2011). If you buy as a business, your VAT number and the result of its validation.
Creator data: for creators, shop details, legal name, country, tax residence and VAT status, tax identification numbers, certificates of tax residence, the behind-the-scenes verification clip, acceptance of the creator agreement (version, time and IP address), royalty statements and payout records. Identity verification and bank details are collected by Stripe.
Listening and usage data: what you play, preview, buy, follow and save, your listening progress in each sound, and player settings.
Messages: what you write to us through the contact form or by email, messages exchanged with artists in custom requests, and our replies.
Reports and appeals: content reports and notices you submit, including your contact details and explanation, and any appeals.
Technical data: IP address, browser and device information, and server logs with timestamps.
Analytics data: pseudonymous usage data collected by Google Analytics 4 (see section 3 and the cookie policy).

3. Why we use it and on what legal basis

To provide your account, deliver purchases, stream and save your listening progress, run Circle memberships, custom requests and your credit wallet – performance of a contract (Art. 6(1)(b) GDPR).
To process payments, calculate, charge and report VAT (including under the EU One-Stop-Shop scheme), issue invoices, keep accounting records and withhold tax on creator royalties – legal obligation (Art. 6(1)(c) GDPR) under Czech VAT, accounting and income tax law.
To pay creators, issue royalty statements under the self-billing agreement and verify creators – performance of the creator agreement and legal obligation.
To prevent fraud, payment abuse and copyright infringement, and to verify that artists are real people – our legitimate interest in a safe, human-made marketplace (Art. 6(1)(f) GDPR).
To moderate content and handle reports, notices, statements of reasons and appeals – legal obligation under the EU Digital Services Act and our legitimate interest in enforcing our guidelines.
To answer messages and support requests – performance of a contract or our legitimate interest in responding to you.
To keep the service secure and working, including server logs – our legitimate interest.
To establish, exercise or defend legal claims – our legitimate interest.
To measure how the site is used with Google Analytics – for visitors from the EU/EEA, the UK and Switzerland, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time; for visitors from other regions, our legitimate interest in improving the site.
To send the newsletter and release notifications you sign up for – your consent, which you can withdraw at any time through the link in every email or in settings. Where the law allows, we may email existing customers about similar products based on our legitimate interest; you can object at any time.

Providing account and order data is necessary to buy on ASMR Market, and creators must provide their tax and payout data to receive royalties. Everything else is optional.

4. Who we share data with

We use service providers that process data on our behalf under data processing agreements, or as independent controllers where stated:

Stripe Payments Europe Ltd. (Ireland) – payment processing, Stripe Tax for tax calculation, and Stripe Connect for creator payouts and identity verification. Stripe acts partly as an independent controller, for example for fraud prevention and its legal obligations as a payment institution.
Our hosting provider (data centres in the EU) – hosting of the website, database and media files.
Our transactional email provider – delivery of sign-in links, email confirmations, password resets, receipts and notifications.
Google Ireland Ltd. – Google Analytics 4, for visitors from the EU/EEA, the UK and Switzerland only with consent; and Google sign-in, only if you choose to sign in with Google.
The European Commission's VIES system – to validate VAT numbers of business buyers and creators.
Our accountants, tax advisers and lawyers – where needed for accounting, tax and legal advice, bound by confidentiality.
Public authorities – such as the tax authority or courts, where the law requires it.

Artists. Artists receive only what they need. They see aggregated sales information about their own items. For custom requests, the artist sees your request text, your messages and the first name on your account. We do not share buyers' email addresses with artists. We do not sell personal data.

5. International transfers

Some providers, such as Stripe and Google, may process data outside the European Economic Area, in particular in the United States. Where this happens we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it, or on the European Commission's Standard Contractual Clauses (SCCs) with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

6. How long we keep data

Accounting and tax records (orders, invoices, VAT and One-Stop-Shop records, royalty statements, payouts and withheld tax): 10 years from the end of the year in which the transaction took place (section 35 of the Czech VAT Act and Czech accounting law).
Account data: until you delete your account. Data we must keep for tax and accounting purposes is then kept only for the periods above.
Certificates of tax residence: for as long as they are needed to support our withholding tax records.
Creator verification clips: deleted as soon as the verification has been reviewed.
Server logs: 30 days.
Consent records (for example your cookie choice and newsletter sign-up): for the duration of your consent plus 3 years.
Support messages: 3 years after the matter is closed.
Reports, notices and appeals: for as long as needed to handle the matter and any follow-up, and to keep the records required by the Digital Services Act.
Analytics data: no longer than 14 months, according to our Google Analytics retention setting.

We may keep data longer where it is needed to establish, exercise or defend a specific legal claim.

7. Your rights

You have the right to:

access the personal data we hold about you and receive a copy;
have inaccurate data corrected (rectification);
have your data erased, where we are not required to keep it;
restrict processing in certain cases;
receive your data in a structured, machine-readable format (portability). You can do this yourself at any time with "Download my data" in settings;
object to processing based on our legitimate interests, and to direct marketing at any time;
withdraw consent at any time, without affecting processing before the withdrawal.

You can delete your account yourself in settings. To exercise any other right, write to [email protected]. We may need to confirm your identity. We reply within one month; in complex cases this can be extended by two more months, and we will tell you if so.

8. Complaints

If you believe we process your data unlawfully, you can lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz. You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.

9. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. Some checks are automated to help our team: for example, when a creator uploads a file, we compare its digital fingerprint with files already on ASMR Market and flag possible duplicates. A flag never leads to removal by itself; a person reviews it and decides.

10. Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls and limited staff access. Payment card data is handled only by Stripe.

11. Cookies

We use strictly necessary cookies to run the site and, for analytics, cookies from Google Analytics. Visitors from the EU/EEA, the UK and Switzerland are asked for consent before analytics run. See the cookie policy.

12. Children

Listener accounts are for people aged 15 and over. Selling on ASMR Market requires an age of at least 18. We do not knowingly collect data from children below these ages. If you believe a child has created an account, please contact us and we will delete it.

13. Changes

We may update this policy. We will post the new version here with a new effective date and tell you by email about significant changes.

14. Contact

data broker s.r.o., Jaurisova 515/4, 140 00 Praha, Czech Republic. Email: [email protected]. You can also use the contact page. We answer in English and Czech.