Privacy policy — dhreian.com

Last updated: 28 October 2026

In short

  • This site does not set cookies or persistent identifiers in the browser, and it does not load third-party analytics scripts (not Vercel Web Analytics, Plausible or Umami).
  • If you write through the form, request a plugin or ask a question, we keep the details of that submission so we can reply and, when it applies, send you the link.
  • Visits are counted in our own statistics: event type, page, a short label and the source reduced to a category. That statistic does not store the full URL or the contents of a form.
  • The IP address is not stored in the clear. To limit abuse we store only a cryptographic summary (a hash) for the length of the limit window.
  • Automatic email is sent by Resend. The production database is PostgreSQL on Supabase. The site is hosted on Vercel.

1. Who is responsible

dhreian ("dhreian", "we") publishes this site and is responsible for the processing described here: the music, the production services and the audio software offered on dhreian.com. Contact: contact@dhreian.com.

2. What we collect and why

2.1. Contact form (/api/send)

If you send the form we store your name, email, subject, message and the page language (es or en), plus the delivery status, the id Resend returns and, if it fails, a technical error message, with the date.

The message is sent to contact@dhreian.com and you receive a fixed-text receipt. We use it to reply and, if you asked, to prepare a quote. It is not used for a newsletter: the code does not add anyone to a mailing list.

We do not store the hidden anti-spam field or the moment you opened the form. If that hidden field is filled in, the request is dropped and nothing is stored.

2.2. Plugin downloads (/api/plugin-download and /api/plugin-file)

If you request dhreVerb, dhreComp, dhreEcho, dhreLink or dhreView we store your name, email, the product, the system (Windows or macOS), the version, the file name, whether that version is a beta, the language, the URL of the link we email you and the delivery status.

The link in the email expires after 14 days. The link identifies the product, version, system and expiry; it does not carry your name or email. When you open it, the server records a download_link event (product and system) and redirects you to the installer. That event does not store your name or email.

2.3. Questions about a product (/api/product-question)

If you ask from a product page we store your name, email, the product, the text of the question and the language, plus the delivery status. The question goes only to contact@dhreian.com and you receive a fixed-text receipt.

2.4. Our own statistics (/api/analytics)

The browser tells /api/analytics the event type, the path and a label. On a page view it also sends only the origin of the referrer (the site you came from, without the path or the parameters). The server reduces that to a category: direct, Instagram, TikTok, YouTube, Spotify, X, Google or other.

What is stored is the event type, the path (an unknown page is stored as /otra), the label, that category and the language taken from the path (/en/... is English). It does not store cookies, a personal identifier, form text or complete URLs.

Events the browser may send:

  • pageview: a page was viewed.
  • service_quote: a click on Get a quote (custom beat, full production, mixing or mastering).
  • contact_start, contact_submit and contact_error: the contact form was started, sent or failed. The label is only the subject category, not the message.
  • download_open, download_close, download_submit and download_error: the download dialog was opened, closed, sent or failed, with the product and, when sending, the system.
  • outbound: a click to Spotify, Apple Music, YouTube, Instagram, TikTok, X, BeatStars, the support links or another site. A click from a release may include the title in the label.
  • journey: a click on the home buttons (services, plugins or tools).
  • tutorial_play: a product tutorial was started.

The browser cannot report these outcomes: the server records them only when they actually happen.

  • contact: the contact message was delivered.
  • download_success: the email with the download link was sent.
  • download_link: that link was opened.

There is no second meter. These events are not sent to Vercel Web Analytics, Plausible or Umami.

2.5. Use limits

To limit abuse, the IP address (and, on the forms, the email as well) is turned into an HMAC-SHA256 hash with a server secret. We store the hash, the time window and a counter, not the IP or the email in the clear. The statistics window is 15 minutes. The forms window is 24 hours. A global counter for the day is not tied to a person. Those rows are deleted when a later request notices that the window has expired; there is no separate scheduled deletion.

2.6. Videos

A product tutorial loads a youtube-nocookie.com player only if you press play. From then on YouTube (Google) receives what a visit to its player involves, including your IP. The site does not send YouTube your name, email or messages.

2.7. eqlypse and payment

When eqlypse is on sale, payment is taken by Lemon Squeezy, which acts as merchant of record. dhreian does not receive your card details. What the plugin stores and what Lemon Squeezy sees is in the eqlypse privacy policy.

3. Why the law allows it

  • A request you make (steps to reply, quote, send you an installer or answer a question): the form you submit.
  • Legitimate interest: counting visits without identifying you and limiting abuse of the forms, with the minimum data in sections 2.4 and 2.5.
  • Legal duty: keeping whatever a statute requires. The code does not apply a deletion period by itself today; the periods still missing are marked in section 5.

This policy is written to line up with Law 19.628, on the protection of private life, which applies today, and with Law 21.719, which regulates the protection and processing of personal data. As published, Law 21.719 enters into force on 1 December 2026, or on any later date set by a statute that changes that entry into force.

4. Who else processes data

  • Vercel: hosts the site and may process connection data (for example, the IP address) in its logs, under its policy.
  • Supabase: the PostgreSQL database where forms, events and counters are stored. Its policy.
  • Resend: sends the site's automatic emails (the notice to dhreian, the receipt and the download link) from contact@dhreian.com. The code calls api.resend.com. Its policy.
  • Lemon Squeezy: only if you buy eqlypse. Its policy.
  • YouTube (Google): only if you play a tutorial.
  • Authorities, when a law or a valid order requires it.

[pending: confirm who hosts the contact@dhreian.com mailbox and whether mail is forwarded; this site's code only sends through Resend].

We do not sell personal data or pass it on for anyone else's advertising.

5. How long we keep it

  • Limit hashes: for the window (15 minutes or 24 hours) and until a later request deletes expired windows.
  • Download link: stops working after 14 days. The request record (name and email) is not deleted on its own.
  • Contact messages, download requests, questions and statistics events: the code does not delete them. [pending: retention periods for messages, downloads, questions and statistics].

6. Your rights

You can ask for access, correction, deletion and objection. Once Law 21.719 is in force, also blocking and portability, on the terms of that law. Write to contact@dhreian.com. We will answer within the period the applicable law sets.

You can complain to the ordinary courts of Chile. Once the Personal Data Protection Agency is operating, you can also complain to that Agency. For data Lemon Squeezy processes on its own (payment and billing), rights are exercised with Lemon Squeezy.

7. Transfers outside Chile

dhreian operates from Chile. Vercel, Supabase, Resend and, if you buy or if you play a video, Lemon Squeezy and YouTube may process data in the United States or other countries where they operate. The safeguards they offer are in their policies, linked above.

8. Minors

The site is not directed at children and we do not seek their data. If you believe a child wrote to us, tell us at contact@dhreian.com and we will delete that submission.

9. Changes

If this policy changes, we will publish the new version on this page with its date.

Contact: contact@dhreian.com