Privacy

Who we are

We’re Wendlo, a band — legally, Jacob and Chelsea Hamilton, doing business as Wendlo Music LLC. This notice covers wendlomusic.com. We decide what happens to the information you give us here, which makes us the “controller” under UK and EU data-protection law. You can reach us about anything on this page at hello@wendlomusic.com.

What we collect, and why

Joining the email list

Your name and email address (required), and if you choose to tell us: where you live, the best meal you’ve ever eaten, and a message for us. A city or postcode is plenty for where you live — we use it to know where our people are and to tell you about shows nearby. The meal question is just for fun.

Why we’re allowed to: your consent. You join the list by sending the sign-up form, and we keep a record of when you did. You can withdraw consent any time by unsubscribing or emailing us.

Sending us a message

Your name and email address (required), an optional subject, and your message. We use it only to read and reply to you — it doesn’t add you to the email list.

Why we’re allowed to: our legitimate interest in answering people who write to us (bookings, events, love letters).

Keeping the forms safe

When you submit a form, our server uses your IP address to stop spam and abuse: it counts submissions per IP address and per email address, and ignores accidental double-sends. The forms may also run a bot check from Cloudflare (details below). Why we’re allowed to: our legitimate interest in keeping the forms working and free of spam.

Buying merch

Your cart (which items, sizes, prices and quantities) is saved only in your own browser so it’s still there next time. When you hit checkout, the cart is sent to Shopify and checkout opens on Shopify’s own pages. Anything you enter there — name, address, payment — is collected by Shopify, and we receive the order details we need to send you your stuff. Why we’re allowed to: it’s needed to fulfil your order.

Just browsing

We don’t run analytics or advertising trackers, and we don’t build profiles of visitors. Like every website, the services that deliver our pages, images and fonts see your IP address and browser details as part of sending them to you, and our host keeps short-lived technical logs of those requests (see the list below).

Who handles it for us

We use a few services to run the site. They process your information on our behalf, for the purposes above:

Vercel

Hosts the website and runs the server code that handles the forms. Like any host, it keeps short-lived request logs that include your IP address and browser details.

Google (Google Sheets and Gmail)

Google Sheets is our record of every form submission, kept in our own private spreadsheet. Messages and email-list sign-ups go on separate tabs, and each row holds the date and time and everything you filled in. Sign-up rows also have a “Mailing list” column where our server notes what happened with your sign-up — for example, that you were added to the list, that you were already on it, or that you weren’t added. Nothing else about you is added. Our email inbox is Gmail, so emails you send us — and the notification emails described below — are stored there.

ImprovMX

Forwards email sent to our @wendlomusic.com addresses (like the one on this page) to our Gmail inbox, and keeps a short log of the emails it has forwarded.

Kit (Kit, Inc., US)

Runs the email list — email-list sign-ups only. It gets your email address, name, and — if you told us — where you live and your best meal (never your message), plus the web address of the page you signed up on. You’re on the list as soon as you sign up, and Kit sends our newsletters. Kit is based in the US and acts as our processor under its data processing agreement.

Resend

Sends us a notification email for each form submission (either form) containing what you filled in (for sign-ups, also the same “Mailing list” note as in our spreadsheet), with your email address as the reply-to so we can reply straight to you. Resend keeps a copy in its sending logs for a limited time.

Cloudflare (Turnstile)

A bot check that loads when you open one of our forms (when it’s switched on). Cloudflare sees your IP address and browser signals to tell people from bots, and when you submit, our server sends Cloudflare the check’s one-time token together with your IP address to confirm it.

Upstash

Short-term storage for the spam limits. It holds your IP address (deleted automatically about 10 minutes after your last submission), a scrambled one-way hash of your email address (about 1 hour after your last submission), and one-way hashes used to spot duplicate submissions and reused bot-check tokens (10 and 5 minutes). Nothing else.

Shopify

Runs our merch store: product listings, cart and checkout. Product photos in the store load straight from Shopify’s servers.

YouTube (Google)

Plays the videos in the Music section, using YouTube’s privacy-enhanced player (youtube-nocookie.com). See “Cookies” below.

Sanity

Stores the site’s words and photos and serves the images. It doesn’t store information about visitors; its image servers see your IP address when sending you photos, like any web server.

jsDelivr

Serves the icon font used for the site’s icons.

Bandsintown

Our show listings come from Bandsintown; our server fetches them, so your browser doesn’t talk to Bandsintown until you click a Tickets or RSVP link.

We don’t sell your information, share it for advertising, or give it to anyone else unless the law requires us to.

International transfers

Most of these services are US companies, so your information may be stored or processed in the United States. Where it leaves the UK or EU, we rely on the safeguards those companies provide for that, such as the EU–US Data Privacy Framework and its UK extension, or the standard contractual clauses approved by the UK and EU. For example, Kit (our email list) relies on the Data Privacy Framework (including its UK extension), backed where needed by the EU’s standard contractual clauses and the UK’s International Data Transfer Agreement.

How long we keep it

• Messages: as long as we need to reply and follow up, then we delete them from our records and inbox.
• Email list: until you unsubscribe or ask us to delete it. If you unsubscribe, Kit keeps your subscriber record (your address, the details above and a history of the emails we sent you) marked as unsubscribed so you aren’t emailed again — ask us if you’d rather it was deleted completely. Signing up again through our form puts you back on the list. Unsubscribing doesn’t remove your sign-up row from our Google Sheet; that stays until you ask us to delete it.
• Spam-limit data: deleted automatically within about an hour of your last submission, as described above.
• Ask us to delete your information any time and we will — from our records, the email list and our inbox.

Cookies and storage

This site doesn’t set cookies for visitors and uses no analytics or advertising trackers. What it does use:

• Your cart is kept in your browser’s local storage (under “wendlo_cart”). It never leaves your device until you check out, and you can clear it by emptying the cart or your browser data.
• YouTube: videos use YouTube’s privacy-enhanced mode. The player loads automatically once the Music section is on or near your screen, which shares your IP address and browser details with YouTube. YouTube (Google) may store its own data in your browser (cookies or similar storage) when the player loads, and more once you press play, under Google’s privacy policy.
• Shopify checkout opens on Shopify’s pages, which set their own cookies under Shopify’s privacy policy.
• Bot check: Cloudflare Turnstile (when switched on) loads only once you open a form, and is used only to tell people from bots — not by us to track you or for advertising.

Your rights

Under UK GDPR and EU GDPR you can ask us to:

• show you the information we hold about you (and get a copy);
• correct it, or delete it;
• stop or limit how we use it, or object to it being used;
• send it to you, or to someone else, in a usable format;
• withdraw your consent to the email list at any time (unsubscribe link in every email) — this doesn’t affect anything we did before.

Wherever you live — including the US — just ask and we’ll do the same. Email hello@wendlomusic.com; we’ll reply within one month and won’t charge you.

We don’t make decisions about you by purely automated means, other than the automatic spam and bot checks on the forms.

If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or, in the EU, to the data-protection authority where you live (list of EU authorities).

Contact us

Questions, requests, or just checking what we have on you: hello@wendlomusic.com.

Changes

If we change how the site handles your information, we’ll update this page and the date at the top.