Privacy Policy

This Privacy Policy describes how RMG Universal Brands LLC and its subsidiaries (collectively, "RMG Universal," "we," "us," or "our") collect, use, share, and protect personal information when you visit our websites, sign up for our newsletters or SMS programs, purchase our products, support our causes, or otherwise interact with us. Participating subsidiaries include America First Music, RMG Music Group, Sextronica, Sõnicated, Lo Spettro, blu852, Awareness Project USA, and any other brand operated under the RMG Universal umbrella.

1 · Information We Collect

Information You Provide

• Identity & contact: name, email address, mobile number, mailing address
• Account & commerce: order history, membership tier, donation history, items in your cart
• Payment: handled by our payment processor (Stripe); we do not store full card numbers on our systems
• Communications: contact-form submissions, support requests, survey responses
• Consent records: for SMS and email opt-ins — verbatim consent text, the URL where the opt-in occurred, IP address, user agent, and timestamp (required under the TCPA)

Information Collected Automatically

• Device & usage: IP address, browser type, operating system, referring URL, pages viewed, time stamps
• Cookies & similar: session cookies for cart and authentication, analytics cookies for aggregate site performance. See Section 6.
• Email engagement: opens and link clicks via our email service provider (Resend)

2 · How We Use Your Information

• To deliver products, fulfill orders, process donations, and provide customer support
• To send transactional communications (order confirmations, shipping, password resets, account changes)
• To send marketing emails and SMS messages — only to the brand and channel you opted in to
• To verify your identity and protect against fraud, abuse, and unauthorized access
• To improve our websites, products, and services through aggregate analytics
• To comply with legal obligations, including tax, accounting, and consent-record retention

3 · Legal Basis for Processing

Where applicable law requires a legal basis, we rely on:

• Consent — for marketing communications, SMS messages, and non-essential cookies
• Contract — to fulfill purchases, memberships, and donations you initiate
• Legitimate interest — for fraud prevention, security, and improving our services
• Legal obligation — for tax records, consent retention, and lawful requests

4 · How We Share Your Information

We share personal information only with the following categories of recipients, and only as needed for the purpose described:

• Payment processing: Stripe Inc. — to process payments and donations
• Email delivery: Resend.com — to send transactional and marketing email
• SMS delivery: Twilio Inc. — to send transactional and marketing SMS
• Infrastructure: Cloudflare Inc. — to host our websites, deliver static assets, and protect against attack
• Data & CMS: Airtable Inc. — to store inquiry, subscription, and product metadata
• Affiliates: other RMG Universal subsidiaries — only with respect to the brand-and-channel relationship you established. Opting in to one brand does not enroll you in any other brand.
• Legal & safety: government agencies and law enforcement, when compelled by valid legal process or when necessary to investigate fraud or protect rights

5 · Your Rights

All Users

You may at any time:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and personal information
• Withdraw consent for marketing email (use the unsubscribe link in any email) or SMS (reply STOP)
• Export your data in a portable format

Submit requests to privacy@rmguniversal.com. We acknowledge within five (5) business days and respond substantively within thirty (30) days.

California Residents (CCPA / CPRA)

California residents have the right to (i) know what categories of personal information we collect and the purposes for which they are used, (ii) request access to and copies of their personal information, (iii) request correction or deletion, (iv) opt out of any "sale" or "sharing" (we do neither), and (v) limit our use of "sensitive personal information." We honor verified Global Privacy Control (GPC) signals as an opt-out request. To exercise rights, email privacy@rmguniversal.com. We will not discriminate against you for exercising any privacy right.

Virginia, Colorado, Connecticut, Utah Residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have rights to access, correct, delete, port, and opt out of targeted advertising. We do not engage in targeted advertising or profiling resulting in legal effects. Submit requests as above.

EU / UK / EEA Residents

If you are in the EU, UK, or EEA, you have rights under GDPR/UK-GDPR including access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your local supervisory authority. Submit requests as above.

6 · Cookies & Tracking

We use the following categories of cookies:

• Strictly necessary — session cookies for cart, authentication, and security. Cannot be disabled.
• Analytics — aggregate site performance only. No cross-site tracking.

We do not use advertising cookies, behavioral tracking pixels, or cross-site identifiers. We honor the Sec-GPC: 1 header as a binding opt-out signal under CCPA/CPRA.

Enhanced security and analytics capabilities described in the Notice at the top of this Policy will be reflected here as each becomes active. The consent banner on each brand site continues to honor your current preferences and the GPC signal across all rollout stages.

7 · Data Retention

• Order & donation records: retained for seven (7) years for tax and accounting purposes
• Consent records: retained for the lifetime of the subscription, plus four (4) years after opt-out, as a TCPA compliance record
• Marketing engagement (email opens, clicks): retained for two (2) years
• Support correspondence: retained for three (3) years
• Anonymous analytics: retained indefinitely

8 · Security

We protect personal information using industry-standard safeguards including TLS encryption in transit, encryption at rest, access controls, principle-of-least-privilege provisioning, and regular credential rotation. No system is perfectly secure; if a breach affects your data, we will notify you and the appropriate authorities within the time limits required by applicable law.

9 · Children's Privacy

Our websites and programs are not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided information to us, contact privacy@rmguniversal.com and we will delete it.

10 · International Transfers

Our infrastructure is operated in the United States. If you access our services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your country.

11 · Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be communicated by email to active subscribers and posted to this page with a revised effective date. Continued use of our services after the effective date constitutes acceptance.

12 · Contact

• Privacy requests: privacy@rmguniversal.com
• General support: support@rmguniversal.com
• Web: rmguniversal.com
• SMS terms: rmguniversal.com/sms-terms