Privacy Policy

Effective: 31 October 2026

GuitarHub respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Data Collection and Customer Accounts

We collect only the personal information strictly necessary to configure your custom instrument, manage your order, and fulfill your build:

• Account Authentication & Email: Customer accounts use passwordless email authentication. We send single-use verification codes to your email address to sign you in securely without storing passwords.
• Order Timeline & Build Progress: Your account records your order milestones, timeline events, stage updates, and workshop build photos uploaded during the manufacturing process.
• Build Communications: Emails, notes, and specification details exchanged with our team regarding your custom build. You can reply to any email we send you.
• Order Specifications: The 3D configuration data snapshot (body shape, wood selections, finish, pickups, hardware, and inlays) of your custom guitar.
• Name, Phone and Shipping Address: Collected securely via Stripe during the final invoice payment to arrange physical delivery of your completed instrument. We store them with your order; only you and GuitarHub can see them.
• Records of Your Agreement: The time, IP address and browser details of the confirmations you give before the deposit and the final payment, with the Terms and Refund Policy versions shown to you and the specification you approved. We keep them for as long as we may need to establish or defend a claim about the order, such as a payment dispute.

2. Staged Payment Structure & Payment Security

GuitarHub operates a transparent payment structure of a deposit hold and one final payment:

• Initial Deposit Hold ($49): Placed upon order reservation as an authorization hold, not a charge, to secure your production queue slot and initiate custom luthier review. It is released when you pay for the guitar, or automatically after 7 days, and can be released at your request at any time prior to the final payment.
• Final Invoice: Once specifications and custom pricing are agreed with the workshop, your one final invoice for the guitar and shipping is issued and paid securely via Stripe on our billing subdomain (billing.guitarhub.store). Physical manufacturing begins only after the final invoice is paid. The deposit is not deducted from it.

GuitarHub does not collect, process, or store raw credit card information or Primary Account Numbers (PANs). All payment transactions, including billing details, are securely handled by Stripe, Inc., a certified PCI Level 1 Service Provider, under Stripe’s Privacy Policy.

3. Legal Basis for Processing (GDPR)

Under GDPR Article 6(1)(b), our primary legal basis for processing your account details, email address, order timeline, and guitar specifications is the Performance of a Contract. We require this data to authenticate your account session, maintain your order progress, coordinate custom guitar construction with partner workshops, and deliver your instrument.

4. Data Sharing

We do not sell your personal data. We share necessary information only with:

• Independent Luthiers & Workshops: Partner workshops receive your configuration specifications, order reference, timeline notes, and the destination country and city (to estimate shipping) so they can build your instrument. Your name, phone number and street address are not shared with the workshop through the platform.
• Stripe, Inc.: For secure payment processing, address verification, and fraud prevention on our billing subdomain.

5. Cookies, Analytics & Storage Policy

GuitarHub uses strictly necessary first-party cookies for authentication, and privacy-respecting product analytics on the public site surface only after you grant consent:

A. Strictly Necessary First-Party Cookies

• gh_session: Customer account session cookie (HTTP-only, Secure, SameSite) that maintains your sign-in state across a 30-day sliding window.
• gh_admin: Administrative session cookie (HTTP-only, Secure, SameSite) used to authenticate administrative access.
• gh_csrf: Cryptographic Cross-Site Request Forgery (CSRF) protection token to verify request origin and protect against unauthorized state changes.
• gh_consent: First-party cookie storing your cookie consent preference (accepted or rejected) for up to 365 days.

B. Product Analytics (Consent Required)

We do not use third-party advertising or cross-site behavioral retargeting. On the public site only, we utilize product analytics to measure visitor journeys and improve configurator performance:

• Google Analytics 4 (GA4): Analyzes aggregated funnel milestones (e.g. configurator opened, step changes, option groups touched, deposit placed). We never send emails, customer names, person-tied prices, or design IDs to Google Analytics.
• Microsoft Clarity: Provides anonymized session recordings and heatmaps to help us detect usability issues and drop-offs in the 3D guitar configurator. Clarity is loaded only on the public website (never on admin, authentication, account, or billing surfaces). All text inputs (names, emails, notes) are automatically masked on the client side before data leaves your browser.

C. Consent Gating & Opt-Out

No analytics scripts or non-essential cookies load until you click Accept on our cookie consent banner. You can withdraw your consent, reject analytics, or change your choice at any time by clicking the Cookie settings link in our footer, or by clearing the gh_consent cookie in your browser. Additionally, you may install the Google Analytics Opt-out Browser Add-on.

6. Changes to This Policy

We may update our Privacy Policy periodically to reflect legal, regulatory, or operational changes. The updated version will be indicated by the effective date above.

7. Your Rights & Contact

Under GDPR and EEA regulations, you have the right to access, rectify, port, or erase your personal data, or object to its processing.

To exercise any statutory rights or submit questions, contact our support team at support@guitarhub.store or reach out directly to our founder at tim@guitarhub.store.