Privacy Policy

Effective date: October 30, 2026

This Privacy Policy explains how Tonar Music, Inc. ("Tonar Music," "we," "us," or "our") collects, uses, shares, and protects personal information when you visit tonarmusic.com (the "Site"), buy from our online store, or sign up for our mailing list. We have always believed that the information our customers share with us should be handled with care and kept confidential. We do not sell, rent, or license your personal information to anyone.

1. Who we are

Tonar Music, Inc. is a classical-guitar record label and music publisher, and the label of guitarist Manuel Barrueco. For the purposes of data protection laws such as the EU and UK General Data Protection Regulation (GDPR), Tonar Music is the "controller" of the personal information described in this policy.

Mail: Tonar Music, Inc., P.O. Box 4466, Timonium, MD 21094-4466, USA
Phone: +1-443-492-9294
Email: orders@tonarmusic.com
Online: the Contact page at tonarmusic.com

2. What information we collect

Information you give us when you order. We offer guest checkout only, so there are no customer accounts or passwords. When you place an order, we collect:

your name and email address;
your billing address and shipping address;
your phone number and company name (both optional);
the contents of your order, prices, taxes, shipping charges, and totals.

Payment information. Payments are processed by Stripe or PayPal. You enter your card or payment details directly with them. Tonar Music never sees or stores your full card number.

Digital downloads. If you buy MP3 albums, we create download links tied to your order and email address. We record each time a download link is used so we can enforce the download limit (links expire after one year or 3 downloads, whichever comes first) and help if you have trouble.

Mailing list. If you sign up for our mailing list, we collect your email address and the language of the site you signed up on.

Messages you send us. If you contact us, we keep the information you include, such as your name, contact details, and message.

Technical information. Like any website, our hosting provider automatically processes your IP address and basic request data (such as browser type, the page requested, and the date and time) to deliver the Site, keep it secure, and diagnose problems. If you accept analytics cookies, Google Analytics also collects information about how you use the Site (see Section 6).

3. How we use your information

We use personal information to:

process, ship, and deliver your orders, and provide your digital downloads;
send transactional emails, such as order confirmations and download links;
answer your questions and provide customer service;
send our newsletter and news about releases, if you have signed up;
understand how the Site is used and improve it (only if you consent to analytics);
keep accounting, tax, and business records;
maintain our own internal contact book of customers (we may export a customer's contact details as a vCard for this purpose; this is for internal use only and is never sold or shared for others' marketing);
protect the Site, our customers, and our business against fraud, abuse, and security threats; and
comply with the law, including responding to valid legal requests such as court orders or subpoenas.

4. Legal bases for processing (EU/UK visitors)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

Contract: to process and deliver your order and downloads, and to send related emails.
Legal obligation: to keep order and financial records required by tax and accounting laws.
Consent: for analytics cookies and for our mailing list. You can withdraw consent at any time without affecting processing that took place before you withdrew it.
Legitimate interests: to run and secure the Site, answer inquiries, prevent fraud, and keep an internal customer contact book. We balance these interests against your rights, and you may object at any time (see Section 8).

5. Who we share information with

We share personal information only with service providers that help us run the Site and the store, and only as needed for them to perform their services for us. They act on our behalf and are not allowed to use your information for their own purposes, except where a payment provider acts independently as required by financial regulations.

Vercel: Website hosting. Location: United States.
Neon: Database (order and customer records). Location: United States (AWS us-east-1).
Cloudflare (R2): File storage for images, audio samples, and purchased downloads. Location: United States (Eastern North America).
Cloudflare (Turnstile): Bot protection at checkout and mailing-list sign-up: checks browser signals and IP address to block automated submissions; no cookies for tracking. Location: United States / global.
Resend: Transactional email (order confirmations, download links, and notices to us of mailing-list sign-ups). Location: United States.
Stripe: Card payment processing. Location: United States and other countries.
PayPal: Payment processing. Location: United States and other countries.
Google Analytics 4: Site analytics, only if you accept cookies. Location: United States and other countries.
Constant Contact: Mailing list and newsletters. Location: United States.

Shipping carriers and postal services receive your name and shipping address to deliver physical orders.

We may also disclose information:

when required by law, regulation, or valid legal process;
to protect the rights, property, or safety of Tonar Music, our customers, or others; or
in connection with a merger, acquisition, or sale of all or part of our business. In that case, we will require the recipient to honor this Privacy Policy, and we will notify you if required by law.

We may share aggregated statistics (for example, total visitors) that cannot identify you.

6. Cookies and similar technologies

We keep cookies to a minimum:

Shopping cart: the items in your cart are stored in your browser's local storage so your cart is kept as you browse. This stays on your device and is not used to track you.
Language preference: we remember whether you chose English or Spanish.
Analytics (optional): Google Analytics cookies are set only if you accept them in our cookie banner. They help us understand which pages are visited and how the Site performs. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.

We do not use advertising, retargeting, or cross-site tracking cookies. You can also block or delete cookies and local storage through your browser settings; if you clear local storage, your cart will be emptied.

7. How long we keep information

Order records (contact details, addresses, order contents, and totals) are kept as long as needed for accounting, tax, and legal purposes, currently seven (7) years after the order.
Download records are kept while your download links are active (up to one year) and then as part of the order record.
Mailing-list data is kept until you unsubscribe or ask us to delete it.
Messages to us are kept for as long as needed to respond and for a reasonable period afterward, up to one (1) year.
Server and analytics data: Google Analytics data is kept for 14 months; our hosting provider's server logs are kept according to its standard retention settings.

When information is no longer needed, we delete or anonymize it. Copies in backups may persist for a limited time until they are overwritten in the normal course.

8. Your rights

You may contact us at any time to update or correct your information or ask us to stop using it. Depending on where you live, you may have additional rights.

EU/UK residents have the right to:

access the personal information we hold about you;
correct inaccurate or incomplete information;
delete your information, where we no longer have a reason to keep it;
data portability — receive your information in a structured, commonly used format;
object to processing based on our legitimate interests, and to direct marketing at any time;
restrict our processing in certain circumstances;
withdraw consent at any time, where we rely on consent; and
lodge a complaint with your local data protection supervisory authority (for example, the UK Information Commissioner's Office or the authority in your EU country).

California residents have the right to:

know what personal information we collect, use, and disclose, and the categories of sources and recipients;
delete personal information we have collected from you, subject to legal exceptions;
correct inaccurate personal information; and
not be discriminated against for exercising these rights.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We do not use or disclose sensitive personal information for purposes that would require offering a right to limit.

How to make a request. Email us, or contact us through the Contact page, by phone, or by mail (see Section 13). We may need to verify your identity, usually by confirming the email address and order details you used. You may use an authorized agent where the law allows. We will respond within the time required by applicable law. Some information may need to be kept even after a deletion request, for example order records required for tax purposes.

Marketing emails. Every marketing email includes an unsubscribe link. Unsubscribing does not stop transactional emails about orders you place.

9. International transfers

Tonar Music is based in the United States, and our service providers primarily store and process data in the United States. If you are outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses (and the UK equivalent) or a provider's certification under the EU-U.S. Data Privacy Framework and its UK extension.

10. Children's privacy

The Site is intended for a general audience and is not directed to children under 13, or under 16 in the EU/UK. We do not knowingly collect personal information from children in those age groups. If you believe a child has given us personal information, please contact us and we will delete it.

11. Security

We take the security of your information seriously and use reasonable technical and organizational measures to protect it, including encrypted (HTTPS) connections, reputable service providers, restricted administrative access, and keeping payment card data out of our systems entirely. No website or online service can be completely secure, however, so we cannot guarantee absolute security. If a data breach affects your personal information, we will notify you and the authorities as required by law.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the new version on this page and update the effective date above. If we make significant changes, we will provide more prominent notice where appropriate, such as a notice on the Site.

13. Contact us

If you have questions about this Privacy Policy or want to exercise your rights, please contact us:

Email: orders@tonarmusic.com
Online: the Contact page at tonarmusic.com
Phone: +1-443-492-9294
Mail: Tonar Music, Inc., P.O. Box 4466, Timonium, MD 21094-4466, USA

This Privacy Policy should be read together with our Terms of Use.