Privacy Notice

Information we collect

• Contact information such as name, organization, email and optional telephone number.
• Project information such as your message, audience, preferences, event or practice structure, timing, budget and intended use.
• Materials you intentionally provide, such as lyrics, stories, recordings, photographs, logos or pronunciation notes.
• Payment status, billing information and transaction records. Complete card details are entered directly into Stripe and are not stored by us.
• For digital-store purchases, including music mixes, Daily Shifts and other personal-listening products: purchase email, selected product, access type, price and currency, payment status, order and payment references, secure entitlement status, activation and expiry times, download count and last access time.
• For complimentary EMFReconnect downloads, the requested asset, source, date and time. This download count does not collect the attendee’s name, email address, IP address or a tracking cookie.
• When you allow optional advertising measurement, first-party campaign details such as source, medium, campaign, content, term, an advertising click identifier, the tagged campaign landing page captured after consent and the referring website domain may be kept for that browsing session and saved with a submitted request.
• Communications, the named designated decision contact, dated project checkpoints, approvals, consolidated revision requests, consent records and ordinary website security or device information.

How we use it

• Assess project fit and respond to your inquiry.
• Prepare a proposal, agreement, schedule, project plan and licence.
• Create, revise, quality-check and deliver the agreed project.
• Deliver purchased music, verify purchase access, activate time-limited passes, recover access and provide customer support.
• Process payments, refunds, taxes and accounting records.
• Protect the website, prevent fraud, resolve concerns and meet legal duties.
• Send occasional promotional email only when you separately opt in. Submitting a music request does not subscribe you.

Website database and payments

The website may be delivered through Cloudflare. Project forms, order records and access entitlements may be stored in Cloudflare D1, while private digital audio may be delivered through Cloudflare R2. See the Cloudflare Privacy Policy (https://www.cloudflare.com/privacypolicy/).

Payments are processed through Stripe. Stripe may process contact, billing, transaction, device and fraud-prevention information under its own Privacy Policy (https://stripe.com/privacy).

For purchase delivery and access recovery emails, Resend receives the customer email address, purchased music, private access link, access timing instructions and order reference. Resend does not receive payment-card or banking details from us.

For owner notification emails, Resend receives the minimum contact and project-summary information needed to alert the owner. The private story, detailed music request and supplied media are not placed in the notification email.

Cloudflare, Stripe, Resend and other service providers may process information outside Canada, where it is subject to the laws of that jurisdiction.

Purchase verification

When you request access on a new browser, we send a one-time code to the email address recorded on your purchase. Resend delivers the code. We store a protected representation of the code, its expiry, attempt count and browser association to verify access and limit repeated requests.

Necessary security cookies keep verification on the browser where you requested it and remember successful verification. If you choose “Remember this browser,” access is remembered for up to 30 days; otherwise the session is limited to 12 hours and uses a session cookie. You can sign out from your private access page. Purchase and listening-pass expiry dates still apply.

To limit repeated code requests, we use protected representations of your email and the connection IP address provided by Cloudflare. These checks support purchase security and are separate from optional advertising measurement.

Optional analytics and advertising measurement

Optional analytics and advertising measurement remains off unless you choose “Allow optional measurement.” When configured and allowed, Plausible counts public-page visits, audio plays, request-form starts, successful request submissions and checkout starts. A checkout start is not a completed purchase. Plausible processes analytics in Europe. We do not send names, email addresses, form answers, individual customer identifiers, private links or full audio URLs to Plausible. Only our approved campaign labels and the referring website origin are included.

Private account, project, purchase-confirmation and studio pages are excluded from Plausible measurement. You can stop further optional measurement using Privacy choices. If separately configured and allowed, Google Analytics, Google Ads or Meta may receive public-page, device, browser and campaign information under their own privacy terms.

We use these optional tools to understand which pages and campaigns lead to a completed request and to measure advertising performance. We do not send the private story, names, email addresses, project reference or form answers in an advertising event.

Your measurement choice is stored on your device so the website can remember it. When measurement is allowed, one coherent campaign touch is held for the current browser session and may be saved with a submitted request. Choosing or changing to “Only necessary” clears that session attribution. You can reopen “Privacy choices” on a public page and change your selection.

Selecting “Only necessary” does not prevent you from browsing, submitting a request or using a private project page.

Technology assisted music production

Our production process may use AI-based music services, including Suno. Submitting this initial inquiry does not authorize us to send your material to an AI provider.

Before a paid project uses an AI-based service, the agreement identifies the relevant processing and asks for a separate acknowledgement. We minimize information sent to a provider and do not need participant lists, medical details or an entire confidential source document to create musical direction.

Suno's current terms grant broad rights concerning submitted material and do not promise that generated output is unique or eligible for copyright protection. Tell us before booking if your project requires a restricted or alternative workflow.

Sharing and portfolio use

We share limited information only with service providers and professional advisers who need it for hosting, payments, communications, delivery, accounting, security or legal support, or where disclosure is required by law.

For a Team Memory Film or another visual project, you remain responsible for having permission to provide and use the people, voices, logos, photos and videos supplied. Keep shared media folders private and remove access when the project is complete.

We do not publish your name, organization, logo, testimonial, project or music in our portfolio without separate written permission. Portfolio permission is optional and is never required to buy a service.

Retention and security

We keep personal information only as long as reasonably needed to deliver purchases and projects, provide support, and meet legal, tax, consent, dispute and backup requirements. A 30-day music delivery window is not a promise to delete order records after 30 days. Final custom-project delivery availability and working-file retention are stated in the project agreement.

Private project decision pages use a revocable access link issued to the designated decision contact. The link acts like a key and should not be forwarded. We store a one-way hash of the key rather than the readable key itself, and the owner can replace or revoke access.

We use reasonable administrative and technical safeguards, but no online system can guarantee absolute security.

Your choices

Subject to applicable law, you may ask whether we hold personal information about you, request access or correction, withdraw optional consent or ask us to delete information we are not required to retain.

Every promotional email will include an unsubscribe method. Transactional project, payment, security and delivery messages are not a marketing subscription.

For privacy questions, access or correction requests, withdrawal of optional consent, deletion requests or complaints, email prem@ultimatemind.org with the subject Privacy request. We may need to verify your identity. We will respond within the time required by applicable law and explain any lawful restriction on your request. You may also contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/. We will not use a privacy request for marketing.