Last updated: October 9, 2026
This Privacy Policy explains what personal information Fort Never collects through fortnever.com (the “Site”), why, who we share it with, how long we keep it, and your rights. Fort Never is an independent music project based in Austin, Texas, USA. We run a small website with an online store, a contact and booking form, and a journal. We collect as little as we can, and we never sell your personal information. This policy takes effect on October 9, 2026.
1. Who we are
The Site is operated by Fort Never (“Fort Never,” “we,” “us,” or “our”), located in Austin, Texas, USA. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Fort Never is the “controller” of the personal information described in this policy. For the purposes of U.S. state privacy laws, we are the business or “controller” that decides how your information is used.
Contact for all privacy matters: [email protected] (please put “Privacy” in the subject line so your message is routed quickly).
2. What this policy covers
This policy applies when you browse fortnever.com, contact us, buy from our store, create an account, book a performance or session, request a sync license, or comment on a journal post. It does not cover third-party platforms we link to or embed, such as Instagram, SoundCloud, Spotify, YouTube, or Apple Music, which have their own privacy policies.
3. Information we collect
3.1 Information you give us
- Contact and booking form. Our form (Contact Form 7) asks for your first name, last name, email address, a subject, your message, and a consent checkbox. Anything you include in the message, such as an event date or phone number, is also collected.
- Orders. Our WooCommerce store collects your name, billing and shipping addresses, email address, phone number (if provided), the items you bought, order notes, and the order total.
- Customer accounts. If you create an account, we store your username, email address, password (hashed, so we cannot read it), saved addresses, and order history.
- Services and licensing. For performances, production or mixing sessions, and sync licenses, we collect what we need to deliver the work: event or project details, dates, locations, organization name, audio files you send, the intended use of a licensed track, and related correspondence.
- Comments and emails. If you comment, we collect the name, email address, and optional website you enter. If you email us, we receive your address, message, and attachments.
3.2 Payment information
Payments are processed by third-party payment gateways connected to WooCommerce, such as Stripe or PayPal. You enter your card or account details on forms provided by those processors. We never receive or store your full card number, security code, or PayPal password. The processor sends us limited information to complete and record the order, such as the payment status, a transaction ID, the card brand, the last four digits of the card, and the expiration date. The processor’s own privacy policy governs how it handles the payment data it collects.
3.3 Information collected automatically
- Server and security logs. Our server records your IP address, browser and operating system, the page requested, the referring page, and the time. Our security plugin, Wordfence, also logs IP addresses, failed logins, and blocked requests to protect the Site from attacks and spam.
- Cookies. A small number of cookies keep your cart, login, cookie choices, and security features working. See section 5 and our Cookie Policy.
- Approximate location. We do not collect precise location. Your IP address or shipping country may indicate a general region, which the store uses for shipping and tax.
3.4 Information from third parties
- Payment processors tell us whether a payment succeeded and give us the limited details described above.
- Shipping carriers may give us delivery status updates for your parcel.
- Embedded media providers (YouTube, Spotify, SoundCloud) do not send us personal information about you. If you choose to load an embed, the provider collects information directly from your browser under its own policy.
3.5 What we do not collect
We do not ask for, and ask you not to send us, sensitive information such as health information, government ID numbers, financial account numbers, racial or ethnic origin, religious beliefs, or sexual orientation. We do not use third-party analytics or advertising trackers on the Site by default (see section 5.3).
4. How we use your information and our legal bases
We use personal information only for the purposes below. For visitors in the European Economic Area (EEA), the UK, or Switzerland, the right-hand column shows our legal basis for each purpose.
| Purpose | Information used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Answering messages and booking inquiries | Contact form data, emails | Pre-contract steps at your request (Art. 6(1)(b)); legitimate interest in replying (Art. 6(1)(f)) |
| Processing and delivering orders, including digital downloads | Order, address, and payment confirmation data | Performance of a contract (Art. 6(1)(b)) |
| Providing booked services and sync licenses | Booking details, project files, licensing details | Performance of a contract (Art. 6(1)(b)) |
| Running customer accounts | Account data, order history | Performance of a contract (Art. 6(1)(b)) |
| Sending order confirmations, receipts, download links, and service messages | Name, email address, order data | Performance of a contract (Art. 6(1)(b)) |
| Keeping financial, tax, and accounting records | Order and payment records | Compliance with legal obligations (Art. 6(1)(c)) |
| Protecting the Site from attacks, fraud, and spam | IP addresses, security logs, security cookies | Legitimate interest in security (Art. 6(1)(f)) |
| Remembering your cookie preferences | Consent cookie | Compliance with legal obligations (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
| Publishing comments | Name, comment, optional website | Consent (Art. 6(1)(a)), which you can withdraw by asking us to remove the comment |
| Loading embedded YouTube, Spotify, or SoundCloud content | Data your browser sends to the provider when you click to load | Consent (Art. 6(1)(a)), given by clicking the “load” placeholder |
| Handling legal claims, disputes, and copyright notices | Relevant correspondence and records | Legitimate interest in handling legal claims (Art. 6(1)(f)); legal obligation where applicable |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see section 11).
Marketing. Placing an order or sending a message does not add you to a mailing list. If we ever offer a newsletter, it will be opt-in only, with an unsubscribe link in every email.
Automated decisions. We do not make decisions with legal or similarly significant effects based solely on automated processing, and we do not profile visitors. Our security plugin may automatically block an IP address showing attack activity; if you think you were blocked in error, email us.
5. Cookies, embedded media, and analytics
5.1 Cookies
We use cookies from WordPress, WooCommerce, Wordfence, and our CookieYes consent banner. Most of them are strictly necessary: without them, the cart, checkout, login, and security features would not work. CookieYes stores your consent choices in a cookie named cookieyes-consent. You can change your choices at any time using the “Cookie Settings” link in the footer of every page. The full list of cookies is in our Cookie Policy.
5.2 Click-to-load embeds
Our pages may feature music and videos from YouTube, Spotify, and SoundCloud. These embeds do not load automatically. Instead, you see a placeholder with a “load” button. Nothing is requested from the third party until you click it. Once you do, your browser connects to that provider, which receives your IP address and browser information and may set its own cookies or similar technologies. That processing is controlled by the provider:
- YouTube (Google LLC): policies.google.com/privacy
- Spotify AB: spotify.com/legal/privacy-policy
- SoundCloud Global Limited & Co. KG: soundcloud.com/pages/privacy
5.3 Fonts, scripts, and analytics
Our fonts and scripts are hosted on our own server, so simply viewing a page does not send your IP address to Google Fonts or a third-party content delivery network. No third-party analytics service is installed on the Site by default. If we decide to add analytics in the future, it will run only after you give consent through the cookie banner, and we will update this policy and our Cookie Policy before it is switched on.
6. How we share information
We share personal information only as needed to run the Site, fulfill your order or booking, or meet a legal requirement:
- Web hosting provider, which stores the Site, its database, and server logs on our behalf.
- Payment processors (for example, Stripe or PayPal), which process your payment and screen for fraud.
- Shipping carriers and postal services (for example, USPS or another carrier), which receive your name, shipping address, and sometimes your phone number or email address to deliver physical orders.
- Email provider. Messages from our contact form and order notifications are delivered to our inbox, [email protected], which is hosted by Google LLC.
- Security provider. Wordfence, provided by Defiant, Inc., may process IP addresses and request data to identify and block malicious traffic.
- Consent management provider. CookieYes helps us record and honor your cookie choices.
- Collaborators on a booking, such as band members, sound engineers, or venue staff, who receive only the details needed for that job.
- Professional advisers, such as an accountant or lawyer, under a duty of confidentiality.
- Authorities, where required by law, for example to respond to a valid court order, enforce our Terms & Conditions, or protect the safety and rights of Fort Never or others.
- A successor, if the project, its catalog, or its store is transferred, who must honor this policy for information collected under it.
7. We do not sell or share your personal information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use targeted advertising, and we do not give or rent our customer list to anyone. This has been true for the 12 months before the date of this policy. Because we do not sell or share personal information, we do not offer a “Do Not Sell or Share” link; if that ever changes, we will update this policy and provide one before doing so.
We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising. Since we do not do either, no further action is needed on your part.
8. International data transfers
We and our service providers primarily process data in the United States. If you visit from another country, your information will be transferred to the United States, which may not offer the same level of protection as your home country.
For transfers from the EEA, UK, or Switzerland, we rely on the transfer being necessary to perform a contract or take steps you requested (such as shipping your order or answering your inquiry), and on our providers’ safeguards, such as the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or Standard Contractual Clauses, where they use them. Ask us for details about a specific transfer.
9. How long we keep information
We keep personal information only as long as we need it or the law requires, then delete or anonymize it.
| Type of information | How long we keep it |
|---|---|
| Contact form messages and general email correspondence | Up to 24 months after our last exchange, unless the conversation leads to an order or booking |
| Order records, invoices, and payment confirmations | 7 years after the order, to meet tax and accounting requirements |
| Booking and service records (live performances, sessions) | 7 years after the service is completed, for accounting and dispute purposes |
| Audio files and project materials you send us | Up to 12 months after the project is delivered, unless you ask us to delete them sooner or we agree otherwise |
| Sync license records | For the term of the license plus 7 years, so we can confirm what was licensed if questions arise later |
| Customer accounts | Until you ask us to close the account; accounts with no login or orders for 3 years may be deleted (order records are kept as above) |
| Blog comments | Until the comment or post is removed, or until you ask us to delete it |
| Security logs (Wordfence) and server logs | Generally no longer than 90 days, unless needed to investigate a specific security incident |
Cookie consent record (cookieyes-consent) |
12 months in your browser, after which the banner asks again |
| Privacy requests and our responses | 24 months, to show that we handled the request properly |
We may keep information longer if it is needed to resolve a dispute, enforce our agreements, or comply with a legal hold.
10. How we protect information
We use reasonable safeguards suited to a small website, including:
- HTTPS encryption across the Site;
- a firewall, login protection, and malware scanning through Wordfence;
- WP Hide & Security Enhancer, which hides standard WordPress paths from automated attacks;
- third-party payment gateways, so card numbers never touch our server;
- strong passwords and two-factor authentication on administrator accounts where available;
- regular updates to WordPress, WooCommerce, and plugins; and
- access to personal information only for those who need it.
No website is completely secure. If a breach affects your personal information, we will notify you and the authorities where the law requires.
11. Your rights in the EEA, UK, and Switzerland
If the GDPR, UK GDPR, or Swiss data protection law applies to you, you have the right to:
- Access the personal information we hold about you and receive a copy;
- Rectify information that is inaccurate or incomplete;
- Erase your information (“right to be forgotten”), unless we must keep it, for example for tax records;
- Restrict our processing while a concern is being resolved;
- Object to processing based on our legitimate interests;
- Data portability, meaning a copy of information you gave us in a structured, machine-readable format;
- Withdraw consent at any time, where we rely on consent, without affecting processing that already happened; and
- Lodge a complaint with a data protection supervisory authority, particularly in the country where you live or work, or where an alleged infringement occurred. In the UK, this is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first, so please contact us.
Providing personal information is generally voluntary, but some of it is necessary to complete an order or booking. If you do not provide it, we may not be able to fulfill your request.
12. Notice for California residents (CCPA/CPRA)
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), gives California residents specific rights. Fort Never is a small independent project and may not meet the thresholds that make the CCPA apply, but we choose to describe our practices in CCPA terms and honor the rights below.
Categories of personal information collected in the past 12 months
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email, postal address, IP address, username | Hosting, payment, shipping, email, and security providers |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, address, phone, card brand and last four digits | Hosting, payment, and shipping providers |
| Commercial information | Purchases, order history, booking details | Hosting, payment, and email providers |
| Internet or network activity | Server and security logs, cookie data | Hosting, security, and consent providers |
| Approximate geolocation | Country or region from IP or shipping address | Hosting, payment, and shipping providers |
| Audio information | Recordings or stems you send for a session | Project collaborators, as needed |
| Sensitive personal information | Account login and password (hashed) | Hosting provider |
Sources are you, your device, and our payment processors. We use these categories for the purposes in section 4 and keep them for the periods in section 9. We use account credentials only to provide and secure your account, as the CCPA permits. We have not sold or shared personal information in the past 12 months and have no actual knowledge of selling or sharing information of consumers under 16.
Your California rights
- Right to know the categories and specific pieces of personal information we collected, the sources, the purposes, and the categories of recipients;
- Right to delete personal information we collected from you, subject to legal exceptions;
- Right to correct inaccurate personal information;
- Right to opt out of the sale or sharing of personal information (we do neither);
- Right to limit the use of sensitive personal information (we already use it only for permitted purposes); and
- Right to non-discrimination. We will not deny you goods or services, charge you a different price, or give you a different level of quality because you exercised any of these rights.
Under California’s “Shine the Light” law, you may also ask whether we disclosed personal information to third parties for their direct marketing purposes. We do not.
13. Notice for Texas residents (TDPSA)
The Texas Data Privacy and Security Act (“TDPSA”) gives Texas residents rights over their personal data. Where it applies to us, and as good practice where it may not, you can:
- confirm whether we process your personal data and access it;
- correct inaccuracies in your personal data;
- delete personal data you provided or that we obtained about you;
- obtain a copy of personal data you previously provided in a portable, readily usable format; and
- opt out of processing for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in any of these activities.
We do not process sensitive data as defined by the TDPSA, and we do not sell sensitive data. Appeals: if we decline to act on your request, you may appeal by replying to our decision or emailing [email protected] with the subject line “Privacy Appeal” within a reasonable time. We will respond in writing within 60 days and explain our reasons. If your appeal is denied, you may contact the Texas Attorney General at texasattorneygeneral.gov.
14. Residents of other U.S. states
States such as Colorado, Connecticut, Virginia, Utah, and Oregon give similar rights to access, correct, delete, and port personal data and to opt out of targeted advertising, sale, and certain profiling. Wherever you live, you can make any request in this policy through section 15, and we will apply your state’s law where it protects you more.
15. How to make a privacy request
- Email us at [email protected] with “Privacy Request” in the subject line, saying which right you want to use and the email address you used with us.
- Verification. We confirm the request comes from you, usually by replying to the email on file or asking about a recent order. We use verification details only for that purpose, and you do not need an account to make a request.
- Authorized agents. An agent may make a request for you. We may ask for your signed permission and ask you to verify your identity directly, unless the agent holds a valid power of attorney.
- Timing. We respond within one month under the GDPR and UK GDPR (extendable by two months for complex requests) and within 45 days under the CCPA and TDPSA (extendable by 45 days when reasonably necessary). We will tell you if we need an extension.
- Cost. Requests are free. Where the law allows, we may charge a reasonable fee for, or decline, manifestly unfounded or excessive requests, and will explain why.
You can also update your account details yourself by logging in.
16. Children’s privacy
The Site is a general-audience music website and is not directed to children. We do not knowingly collect personal information from children under 13, consistent with the U.S. Children’s Online Privacy Protection Act (COPPA). If you are in the EEA or UK, you must be at least 16 years old (or the minimum age of digital consent in your country, if lower) to send us personal information, unless a parent or guardian has given consent. Purchases must be made by an adult or with the involvement of a parent or guardian.
If you believe a child has given us personal information, please email [email protected] and we will delete it promptly.
17. Links to other websites
The Site links to other websites and platforms, including streaming services, social media profiles, and venues. We are not responsible for the privacy practices of those websites. When you leave fortnever.com, check the privacy policy of the site you are visiting.
18. Changes to this policy
We may update this policy when our practices or the law change, for example if we add a newsletter or analytics. We will update the date at the top and, for significant changes, post a notice on the Site or email account holders. Where the law requires your consent to a change, we will ask for it.
19. Contact us
Questions, requests, or complaints about privacy can be sent to:
Fort Never
Austin, Texas, USA
Email: [email protected]
We read every message and aim to reply within a few business days.