Privacy policy
Last updated 8 August 2026.
The short version: to send you a recording I need an email address to send it to, and PayPal needs to take your money. That is very nearly the whole of it. I don't sell anything about you, I don't run advertising trackers, and I never see your card number.
Who is responsible for your data
This shop is run by Boris Cherniak, a sole trader in Ontario, Canada, trading as Hypnosis MP3 Shop. I am the data controller for everything described on this page, and the person who answers when you write in. Questions, corrections or deletion requests go to sales@hypnosismp3shop.com, or through the contact form.
What I collect when you buy something
Checkout asks for one thing: your email address. It isn't marketing collection — it is the delivery address. The recording is a file, the file is sent as a private link, and the link has to go somewhere.
Alongside it, an order record is created holding:
- the email address you entered;
- your first and last name, only if PayPal passes it back with the payment — the shop never asks you for it;
- which recordings you bought, the price of each, any tax, the currency, and any coupon code used;
- PayPal's order reference, so a payment can be matched to a delivery;
- the date, and whether the delivery email sent successfully.
A separate record is created for each download link: a random token, the item, your email address, when the link expires, and how many times it has been used. Opening a link increments that count and stores the time of the most recent download. No IP address, browser or location is recorded against a download.
What I never see
Card numbers, bank details and your PayPal password never touch this site. Payment happens inside PayPal's own checkout window. This site tells PayPal an amount, a currency and a description of what you're buying; PayPal tells it back whether the payment completed, for how much, and the payer's name. That is the entire exchange. There is nothing here to steal, because the card data was never here.
PayPal is an independent controller of what it collects from you, under its own privacy policy at paypal.com. Its checkout script loads on the cart, item and buy-button pages, so PayPal can set its own cookies and see that you visited a page where a payment was possible — the same as on any site that offers PayPal.
What I collect when you don't buy anything
- The cart. One cookie, named DDS_SESS, holds a session identifier. Against it the server keeps which items you've added, any coupon you've entered, and a token that protects forms from being submitted from other sites. It is strictly necessary for the shop to function, carries no advertising identifier, and expires when you close your browser.
- The contact form. Your name, email address, subject, message and the optional order reference are emailed to me and kept in my mailbox so I can reply. If a submission trips the spam checks, its details are written to the server error log so I can find a false positive rather than guess at it.
- Rate limiting. To stop the contact and resend forms being abused, the server keeps a short list of timestamps against a one-way hash of your IP address. The address itself is not stored, the file holds nothing but times, and old files are deleted automatically. The admin login is the one exception: failed attempts on it are counted against the IP address itself, which is what makes a lockout possible.
- Server logs. The web host keeps standard access logs — IP address, time, page requested — as every web server does. I don't mine them and they age out on the host's schedule.
- Analytics. This site runs a third-party analytics script that records visits in aggregate — pages viewed, roughly where in the world visitors are, what referred them. It is used to see which pages are worth writing more of, never to identify you personally.
Delivery emails, contact acknowledgements and resend messages are sent over an authenticated SMTP connection through this site's mail provider, which necessarily handles your email address and the message in order to deliver it. There is no mailing list. Buying a recording does not subscribe you to anything, and you will not receive marketing from this shop as a result of a purchase.
Who else gets your data
Three parties, each because the shop cannot work without them:
- PayPal — to take the payment.
- The mail provider — to deliver your download email.
- The web host — the server the site and its database sit on.
Nobody else. Your data is not sold, rented, traded, or handed to advertisers or data brokers. If a court or regulator legally compels disclosure I would have to comply, and that is the only other circumstance in which anything leaves.
The shop is hosted in, and the business operates from, Canada, and PayPal is a US company — so buying from elsewhere in the world means your order details are processed outside your own country.
How long it's kept
- Download links expire 168 hours after they are issued and stop working after 7 downloads. An expired token stays in the database as the record of a delivery, but it can't be used to reach a file.
- Order records are kept for as long as the law requires business and tax records to be kept — several years — and so that the resend page can issue you a fresh link years after you bought something. That feature is the direct reason your email address stays on file.
- Contact messages stay in my mailbox until I clear them out.
- Rate-limit files and logs are deleted automatically, within days.
Your rights
You can ask me for a copy of everything held about you, ask for it corrected, or ask for it deleted. Email sales@hypnosismp3shop.com from the address you used at checkout and I'll deal with it personally, normally within a few days and always within thirty.
Two honest limits. Deleting your order record also destroys your ability to have links resent, so I'll say so before doing it. And I have to keep enough of a transaction record to satisfy tax law, which means a purchase can be anonymised but not made to disappear entirely.
Depending on where you live these rights sit under Canada's PIPEDA, the UK or EU GDPR, or your local equivalent. If you are in the EU or UK, the lawful basis for holding your email address and order is performance of a contract — I cannot deliver a recording without them. If you think I've handled your data badly, please tell me first; you also have the right to complain to your national data protection authority, or to the Office of the Privacy Commissioner of Canada.
Security
The whole site is served over HTTPS. Audio files are never given a public URL — they sit outside the web root and are streamed only through a valid, unexpired, unrevoked download token. Download links are 64-character random tokens, which is not something that can be guessed. The admin area is password protected and rate-limited against brute force.
No system is perfect, and I would rather say that than claim otherwise. If you ever find something wrong with this one, tell me and I'll fix it.
Children
These recordings are made for adults and the shop is not intended for anyone under 18. I don't knowingly collect anything from children. If you believe a child has bought something here, write to me and I'll remove the record and refund it.
Changes to this policy
If how the shop handles data changes, this page changes with it and the date at the top moves. There is no archive of past versions — for a shop this size, the current page and an honest date are more use than a changelog nobody reads.