Privacy policy

This policy covers justsheetmusic.com. It is written to be read, not to be survived.

The short version

There is no account system. We use Google Analytics to count visits and see which pages get read, which sets a cookie and tells Google you were here; beyond that, unless you write to us, we hold nothing about you. We make money from affiliate links to sheet music retailers, and we never learn who you are or what you bought.

Who is responsible

The site is run by its operator, who is the data controller for anything described here. The way to reach us about your data — or about anything else — is the contact form.

What we collect

Nothing that identifies you, by default. There is no login, no newsletter and no account. You can use the whole site without giving us anything.

Two exceptions:

• If you use the contact form, we receive the name, email address and message you type. We use them to reply and for nothing else. Submissions are handled by our hosting provider.
• Server logs. Our host records standard request data — IP address, user agent, the page requested and the time. This is ordinary web-server logging, retained by the host on their own schedule.

Why we are allowed to hold it

Under UK and EU data protection law we rely on two bases. Contact form submissions are processed because you chose to send them and we need them to reply — that is your consent, and you can withdraw it by asking us to delete the message. Server logs are processed under legitimate interests: keeping the site available and diagnosing faults. We do not profile you and we run no advertising.

How long we keep it

Contact form submissions are kept while they are still useful for dealing with your enquiry, and deleted whenever you ask — just write in and say so. Server logs are retained by our host on their own schedule. Nothing else is stored.

Cookies

Google Analytics sets two cookies on this domain — _ga and _ga_7T0ZR2LQ8J — which give your browser a random identifier so that repeat visits are counted as one person rather than several. They expire after two years. They hold no name, email or address, and we cannot use them to work out who you are.

We run no advertising and no cross-site tracking scripts. Our network provider may also set a short-lived security cookie when it needs to verify a request is not automated; it is used for that and nothing else, and it carries no identifier we can read.

If you would rather not be counted, any browser setting or extension that blocks Google Analytics will stop it, and nothing on this site will break as a result. We do not detect or work around blockers.

When you click through to a retailer

Retailer links pass through /go/ on this domain, where an affiliate identifier is added, and then land on the retailer's site. From that point you are on their site under their privacy policy, and they will typically set their own cookie to attribute the referral. We do not receive your name, your payment details or what you bought — only aggregate commission reporting from the programme.

The retailers and programmes involved are listed on how we make money.

Third parties we rely on

• Netlify — hosting, CDN and contact form handling.
• Cloudflare — DNS and network protection in front of the site.
• Supabase — the database and image storage behind the catalogue.
• Google Analytics — visit statistics. It records the page you viewed, roughly where in the world you are, and what kind of device and browser you used. Google states that GA4 does not log or store full IP addresses. We see only totals and trends, never individual people.

Fonts and styles are served from this domain — no Google Fonts, no third-party CDN, no embedded social widgets. The analytics tag above is the only script we load from anyone else.

Where your data goes

Those providers operate internationally, so data may be processed outside the UK and EEA. Each of them offers standard contractual clauses covering those transfers. We do not sell personal data, and we do not send anything to advertising networks — the analytics data described above goes to Google and no further, and is not used to build an advertising profile of you.

Your rights

If you are in the UK, EU or a jurisdiction with comparable law, you can ask what we hold about you, ask for it to be corrected, ask us to delete it, object to our processing it, or ask for a copy in a portable form. In practice, unless you have written to us, we hold nothing. Ask here.

If you think we have handled your data badly you can complain to your data protection regulator — in the UK that is the Information Commissioner's Office, at ico.org.uk. We would rather you told us first, but you do not have to.

Children

The site is not directed at children under 13 and we do not knowingly collect their information.

Changes

If this policy changes materially we will update the date at the top. Old versions are in the site's public source history.

This page is a plain-language description of how a small catalogue site actually works. It is not legal advice and it has not been reviewed by a solicitor.