Legal & Privacy

2. Data We Collect

Information you provide directly

• Account registration: Username, full name, email address, city, country, and password (stored as a one-way hash — we never store your plain-text password)
• Profile information: Biography, optional social media handles, profile picture (if uploaded)
• User-generated content: Gossip posts, comments, dance video submissions, fan wishlists, contact messages, and private conversation messages
• Votes: Your DJ votes, Royalty votes, Dance votes, and dance type votes. These are linked to your account to enforce one-vote-per-category limits.
• Audio uploads: MP3 or WAV files you choose to upload, along with the title and artist name you provide
• Riddim Studio: Beat patterns you save are stored as JSON data linked to your account. For each beat we store: the pattern name, the step/velocity grid, BPM, swing, reverb and scale settings, play count, like count, and whether you chose to share it publicly. MIDI and WAV exports are generated in your browser and never uploaded to our servers.
• Beat Gallery interactions: If you like a public beat, we store a record of that like (your user ID + the beat ID) to prevent duplicate likes. This is not visible to other users.
• Voice Editor: Voice clips you save via Save to Profile are stored as audio files on our servers, linked to your account. We store the clip name, filename, public/private status, play count, and upload date. All audio processing (EQ, reverb, compressor, noise gate, de-esser, de-noise, pitch, speed) is performed client-side in your browser and no intermediate audio data is transmitted to our servers. Sample Pad files loaded from your device remain local to your browser session and are not stored by us.
• Voice clip deletion: Deleting a saved voice clip from your profile removes both the database record and the audio file from our servers immediately and permanently.
• Communications: Messages you send via our Contact Us form and private conversations with other users

Information collected automatically

• Session data: We use server-side sessions to keep you logged in between page visits. Session data is stored in an encrypted cookie and is not accessible to third parties.
• Play counts: When you play an audio track, a play count increment is logged against that track (not against your user ID)
• We do not collect IP addresses for logging purposes, install analytics trackers, or use advertising cookies

Social & Community Data

When you use Social Circles, we collect and store: follow relationships and their status (pending/accepted), private messages between users, mute preferences, and group announcement content. When you use the DJ Booking feature, we store pricing information you publish, availability dates you set, and booking requests you send or receive. When you send a collaboration request, we store the request details and its status.

When you post a DJ appearance through the DJ Events section, we store: the DJ name, event name, venue, city, country, date, time, minimum age, entry type (free or paid), ticket information, and a source link that credits your username as the poster. This data is publicly visible to all visitors. You may delete any appearance you have posted at any time.

When you create a Business or Service Intro on your profile, we store: the intro title and content you enter. Intros you choose to share to your My Page are visible according to your My Page privacy settings. You may delete any intro from your profile at any time.

My Page content you share (posts, bio, business intros) is stored and visible according to your chosen visibility setting (Everyone / Followers / Selected / Private). Visibility settings are stored as profile preferences and can be changed at any time.

Gender

Gender (Male / Female) is an optional field you may set during registration or on your profile page. If provided, it is stored and may be visible to other logged-in members via the Member Profiles search. You may update or remove your gender at any time from your profile page. We do not use gender data for profiling or targeted advertising.

3. How We Use Your Data

We use the data we collect solely to operate and improve Caribbeanvibez:

• To create and maintain your account and authenticate your sessions
• To display your profile, posts, and contributions to the community
• To enforce voting limits and competition integrity
• To deliver private messages between consenting users
• To respond to your Contact Us enquiries and support requests
• To apply your DM privacy settings (auto-accept, auto-decline, or manual)
• To display your uploaded tracks and track play/like counts
• To generate platform statistics for our internal admin dashboard (aggregated totals — not sold or shared)

We do not use your data for advertising, profiling, automated decision-making with legal effect, or sale to third parties.

4. Data Storage & Retention

• All data is stored in a SQLite database hosted on our server. The server is located in the Netherlands (Amsterdam), operated by DigitalOcean LLC.
• Your data is retained for as long as your account is active. If you request account deletion via your Profile page, your personal data will be permanently deleted immediately, except where we are required by law to retain it.
• Inactivity retention limit: Accounts inactive for 18 consecutive months (no login recorded) are automatically and permanently deleted. A warning email is sent at the 12-month inactivity mark. Logging in at any time resets this window. This policy is in place to comply with data minimisation principles under GDPR and POPIA.
• Audio files you upload are stored on the same server. Deleting a track through the Site also removes the file from the server.
• Beat patterns saved via Riddim Studio are stored in the database. Deleting a beat removes all associated pattern data, play counts, and like records immediately. Public beats remain visible until deleted.
• Anonymised and aggregated data (e.g. total vote counts for a DJ) may be retained indefinitely as it cannot identify you.
• Party question & concern conversations (between members and a party organiser or their appointed contact) are archived and automatically deleted 90 days after the event date. They are accessible to the organiser, any appointed contact, and — for safety and dispute-resolution only — Caribbeanvibez administrators.
• Party safety details (minimum age, pricing, security, refund/guest/drinks policies, house rules) and any Instagram/Facebook invite notes you add are stored with the party listing and removed when the party is deleted.

5. Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Within the platform: Information you submit publicly (username, full name, city, gossip posts, dance video entries, wishlist entries, comments) is visible to all visitors of the Site
• Hosting provider: DigitalOcean LLC processes data on our behalf as a data processor. They do not access your data except as required to provide infrastructure services.
• Legal requirements: We may disclose your data if required by law, court order, or to protect the rights, property, or safety of our users or the public
• Twitter / X notifications: If you are a DJ whose profile has been set up for social media notifications, and if you have consented to this via the DJ Claim system, your DJ name and handle may be included in an automated notification message sent via Twitter/X API. No other personal data is transmitted.

6. Your Rights

Under the UK GDPR and South Africa's POPIA, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your account and all personal data
• Right to restriction: Request that we restrict processing of your data in certain circumstances
• Right to data portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact the site administrator via the Contact Us form. We will respond within 30 days. There is no charge for exercising these rights. If you are unhappy with our response, you have the right to lodge a complaint with the ICO (UK: ico.org.uk) or the Information Regulator (South Africa: inforegulator.org.za).

8. Cookies

We use a single, strictly necessary session cookie to maintain your login state. This cookie:

• Is set only when you log in and is cleared when you log out or close your browser
• Contains only an encrypted session identifier — no personal data is stored in the cookie itself
• Is not used for tracking, advertising, or analytics
• Is not shared with any third party

We do not use any third-party cookies, analytics cookies (e.g. Google Analytics), or advertising cookies. No cookie consent banner is required for strictly necessary cookies under UK GDPR and PECR.

9. Third-Party Services

The following third-party services may process data when you use the Site:

• Google Fonts: Font files are loaded from Google's CDN. Google may log your IP address as part of this request. To avoid this, font files can be self-hosted — contact us if you have concerns.
• Font Awesome CDN: Icon assets served via cdnjs.cloudflare.com. Standard CDN logging may apply.
• YouTube (embedded videos): Dance competition pages may embed YouTube videos using youtube-nocookie.com (YouTube's privacy-enhanced mode), which limits tracking to active playback only. No data is sent to YouTube unless you play a video.
• Twitter / X API: If you are a DJ with social notifications enabled, messages may be sent via the Twitter/X API. Twitter's privacy policy applies to data processed on their platform.

We have no control over, and accept no responsibility for, the privacy practices of these third parties.

10. Security

We take reasonable technical and organisational measures to protect your personal data:

• Passwords are stored using SHA-256 hashing — plain-text passwords are never stored
• Session cookies are signed and encrypted using a server-side secret key
• The Site is served over HTTPS (SSL/TLS encryption in transit) on our production domain
• Admin-only sections (/admin/*) are protected by user ID checks and accessible only to the designated site administrator

No system is completely secure. We cannot guarantee absolute security and are not liable for unauthorised access resulting from events beyond our reasonable control. If you believe your account has been compromised, contact us immediately.

11. Children & Parental Monitoring

The Site is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it promptly. If you believe a child has registered, notify us via the Contact Us form.

Users aged 13–17: Parental or guardian consent is required for all users under 18. We strongly encourage parents and guardians to actively monitor the use of the Site by any minor in their care. In particular:

• User-generated content (gossip posts, comments, dance videos) is community-submitted and may contain adult themes or strong language pending moderation
• The private messaging feature allows one-to-one conversations between registered users; parents are advised to supervise minor users' messaging activity
• Dance and music sections include links to external platforms (YouTube, Instagram, TikTok) over which Caribbeanvibez has no content control
• Parents may request deletion of a minor's account and all associated personal data at any time via the Contact Us form — we will process such requests within 30 days

We reserve the right to remove content and suspend accounts where a user is found to be exposing minors to harmful, explicit, or inappropriate material.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page and update the "Last updated" date. For significant changes, we will notify registered users via a site notice. Continued use of the Site after changes are posted constitutes acceptance of the revised policy.

13. Contact & Data Controller

The data controller for Caribbeanvibez is the site operator. All requests are handled on-site:

• DJ removal: Use the Request Removal button on any DJ's profile — removal is automatic
• All other data requests: caribbeanvibez.com/contact (registered users)
• Response time: Verified DJ removal requests are processed automatically. All other data requests are acknowledged within 5 business days and resolved within 30 days.