Shuriken Challenge

Privacy policy

Last updated: 2 November 2026

This page explains what personal data we handle when you download the free guide “50 Hacks to Produce Like a Ninja”, visit the Shuriken Challenge page, buy it or take part in it: what we use it for, who we share it with, how long we keep it and what your rights are.

1. Who handles your data

• Controller: LA MUSICA QUE TE IMAGINAS SL (“La Música Que Te Imaginas”), a Spanish company.
• Tax ID (NIF): B21977905.
• Address: C/ Antonio García Campos, 35, 4º-4, 03202 Elche (Alicante), Spain.
• Commercial Registry: registered in the Commercial Registry of Alicante (Registro Mercantil de Alicante), section 8, sheet A-197807, entry 1.
• Email: hola@lamusicaqueteimaginas.com.
• Phone: +34 622 351 618.
• Websites: www.lamusicaqueteimaginas.com (pages, checkout and challenge platform, on Systeme.io), ninjatime.lamusicaqueteimaginas.com (our service for the guide sign-up, for the guide PDF and for keeping proof of the checkout box) and deadline.lamusicaqueteimaginas.com (our service for the challenge price deadlines).

We don't have a data protection officer because the law doesn't require us to. For anything about your data, email hola@lamusicaqueteimaginas.com.

2. Summary

3. Each use, in detail

3.1. Guide sign-up and emails

• What data: name, email and, if you arrive from a campaign link, where you came from (UTM parameters, for example which Instagram post).
• What for: sending you the guide and sending you emails, in English, with music production content and offers for our programs, such as the Shuriken Challenge.
• Legal basis: your consent (Article 6(1)(a) of the EU General Data Protection Regulation, GDPR, and Article 21(1) of Spanish Law 34/2002 on information society services, LSSI), which you give when you sign up. You can withdraw it at any time with the unsubscribe link in every email or by writing to us. Anything done before you withdraw it remains valid.
• How long: until you unsubscribe. After that we keep your email on an unsubscribe list so we don't write to you again [CONFIRM: and delete the rest after X months].
• Is it required? Yes, your name and email: without them we can't send you the guide.

3.2. Your Shuriken Challenge price deadlines

When you sign up for the guide, your deadlines to buy the Shuriken Challenge at a reduced price start (they're explained in the terms of purchase, section 4). To make the deadlines real and the same for everyone, we keep a record of when yours started.

• With your email: when you sign up, our guide service tells the challenge deadline service your email and the time your 48 hours end. If you already had challenge deadlines, they're replaced by the new ones. The deadline service keeps an encrypted summary of your email (an irreversible code made with a secret key, never the email itself), your dates and, when you reach the checkout, the moment your 20-minute window opens. If you buy, it records your email, the amount and which deadline you bought in, to check that you were charged the right price. Legal basis: applying the terms of the offer you ask for before buying (Article 6(1)(b) GDPR).
• If you accept the “Personalized offer” cookies: we also use a cookie with a random identifier for your browser (svsl_vid and nt_vid), your device fingerprint and an encrypted summary of your IP address, never the IP address itself. This lets us recognize your deadlines even if you change browser or delete your cookies. Legal basis: your consent (Article 6(1)(a) GDPR and Article 22(2) LSSI). You can withdraw it in “Cookie settings”. Without it, your deadlines are calculated from your email only.
• Where: on our services at Cloudflare. The email, the identifier, the fingerprint and the IP are stored only as irreversible codes.
• How long: 120 days from the last time you visit an offer page; the IP summary, 7 days. If you buy, the purchase record is kept for 400 days.
• Automated decisions: the deadlines apply automatically and are the same for everyone. When they end, the price goes up. We don't make any other automated decisions about you or build profiles with this data.

3.3. Buying the Shuriken Challenge

• What data: the order form data (whether you buy as an individual or a business, country, name, email, phone number and, if you give them to us, tax details for the invoice), the date, the amount, the price deadline you bought in and the payment method.
• What for: taking payment, giving you access to the platform and the bonuses (including The Beatmaker's Black Box if it applies to you), helping you and issuing the invoice.
• Legal basis: the purchase contract (Article 6(1)(b) GDPR) and, for invoicing and accounting, a legal obligation (Article 6(1)(c) GDPR; Spanish tax and commercial law).
• How long: while you have access (365 days from your Day 1) and then 6 years (Article 30 of the Spanish Commercial Code). After that we delete it.
• Is it required? Yes, the fields marked as required in the form: without them we can't sell you the challenge. [CONFIRM: if the phone number isn't used for anything, remove it from the form or make it optional.]

3.4. The immediate access box

Before you pay, the checkout asks you to tick a box to get immediate access to the challenge, confirming that this way you lose the right of withdrawal for the digital content and asking for the support to start with your challenge (explained in the terms of purchase, section 5). The law requires us to be able to prove you did this.

• What data: your email, the date and time, your IP address, the country you connect from (worked out from the IP), your browser, the exact text of the box and its version, the version of the terms and the checkout page. It's saved twice: when you tick the box and type your email, and when you press “Buy now”.
• What for: proving, if there's a complaint, that before paying you asked for immediate access and acknowledged losing the right of withdrawal.
• Legal basis: complying with our legal obligations as a seller, which require us to be able to prove it (Article 6(1)(c) GDPR; Articles 103(m) and 108 of Spanish Royal Legislative Decree 1/2007), and our legitimate interest in defending ourselves against claims (Article 6(1)(f) GDPR).
• Where: on our service ninjatime.lamusicaqueteimaginas.com, at Cloudflare. Only our team can look at it, with an access key.
• How long: if you press “Buy now”, 6 years, like the rest of the purchase. If you tick the box but don't complete the payment, 30 days, and then it's deleted automatically.
• It doesn't use cookies or store anything in your browser.

3.5. Payment

You pay through Stripe (card, Apple Pay or Google Pay) or PayPal. These companies receive the payment details directly. We never see or store your card details. PayPal handles your data as an independent controller, under its own privacy policy. Stripe handles the payment data on our behalf and, to prevent fraud and meet its legal obligations, also as an independent controller.

3.6. The challenge: progress, submissions and receipts

• What data: the day you open your first lesson (your Day 1), the lessons you complete, the submissions you upload each day (screenshots, audio files or projects), the date and time of each one and the receipts we send you by email.
• What for: so you can do the challenge, see your progress and, if you claim it, so we can check the Shuriken Guarantee.
• Legal basis: the contract (Article 6(1)(b) GDPR).
• Where: on the challenge platform, on Systeme.io [CONFIRM: and on the tool that sends the receipts, if it's a different one].
• How long: while you have access to the platform [CONFIRM: plus X months]. If you claim the guarantee, what's needed to resolve it is kept like the rest of the purchase.
• Your music is yours. We only look at your submissions to give you support and check the guarantee. We don't publish them without your permission.

3.7. Support in the WhatsApp group

• What data: your name and phone number, which the other participants and our team will see, and the messages you write in the group.
• Legal basis: the contract (Article 6(1)(b) GDPR). Joining the group is voluntary: if you don't want your number to be visible, write to us first and we'll give you support by email.
• Who else handles the data: WhatsApp (Meta) runs the service as an independent controller, under its own privacy policy, and may process data outside the EU.
• How long: [CONFIRM: for example, the group is closed or emptied at the end of each round].

3.8. Withdrawal and the Shuriken Guarantee

• What data: your request, the email you bought with, the name you used to upload your submissions, your receipts, your compressed Ableton project (for the guarantee) and our messages with you, including those in the support group.
• What for: handling your withdrawal or your guarantee claim and refunding you if it applies.
• Legal basis: the contract and our legal obligations as a seller (Articles 6(1)(b) and 6(1)(c) GDPR).
• How long: 6 years, like the rest of the purchase. We delete your Ableton project [CONFIRM: X MONTHS] after resolving the guarantee.

3.9. Emails to customers

If you buy, we may write to you about similar products of ours even if you haven't subscribed.

• Legal basis: legitimate interest (Article 6(1)(f) GDPR and Article 21(2) LSSI).
• How to opt out: you can object for free before buying or at any time, by writing to us or with the unsubscribe link in any email. You'll still get the challenge emails.

3.10. Testimonials, name and image

We only use your testimonial, name, image or screenshots if you give us express permission in a form separate from the purchase (Article 6(1)(a) GDPR and Spanish Organic Law 1/1982). You can withdraw it whenever you want: what's already published stays, but we stop any new use from the moment you ask.

3.11. Measurement, statistics and advertising

If you accept the “Analytics and advertising” cookies, we use the Meta pixel and Google Tag Manager, which loads Google Analytics (visit statistics) and Google Ads. With them we measure visits, sign-ups, people reaching the checkout and purchases, and we show ads to people who have already visited our pages.

• Legal basis: your consent (Article 6(1)(a) GDPR and Article 22(2) LSSI). You can withdraw it in “Cookie settings”.
• Meta: with the pixel, La Música Que Te Imaginas and Meta Platforms Ireland Ltd. are joint controllers for collecting that data on our pages and sending it to Meta. After that, Meta uses it as a controller for its own purposes, under its privacy policy. More about how this is split in Meta's controller addendum. Along with the sign-up, we send Meta an irreversible code derived from your email (a hash), so it isn't counted twice.
• Google: with Google Analytics, Google handles the visit statistics on our behalf. To measure conversions and for remarketing, Google handles the Google Ads data as a controller, under its data protection terms for advertisers.

The specific cookies and how long they last are in the cookie policy.

3.12. Custom audiences on Meta and Google

• What we do: we upload to Meta (custom audiences) and to Google Ads (Customer Match) the list of emails and phone numbers of our subscribers and customers. Before sending them, they're turned into irreversible codes (SHA-256 hash). Meta and Google compare them with their users and, if there's a match, let us show you ads, not show you ads (for example, if you've already bought) or show them to people with similar interests. Data that doesn't match is deleted.
• Legal basis: our legitimate interest in letting people who already know us hear about our products (Article 6(1)(f) GDPR and Recital 47).
• How to object: email us at hola@lamusicaqueteimaginas.com and we'll remove you from those lists at the next update. If you unsubscribe from our emails, you're also removed from them.
• Who handles it: Meta Platforms Ireland Ltd. and Google Ireland Ltd., as processors under their custom audiences and Customer Match terms.

3.13. Sales page video

If you accept the “Video” category, the video plays with VTurb (ConverteAI). VTurb receives technical data from your device (such as your IP and browser), stores a device and session identifier in your browser, and records how much of the video you've watched. We use it so the video works and to see how far people watch. Legal basis: your consent (Article 6(1)(a) GDPR and Article 22(2) LSSI).

3.14. Messages you send us

If you write to us, we use your data to reply. Legal basis: dealing with your request and, if you're a customer, the contract (Article 6(1)(b) GDPR). We keep it while we deal with your question [CONFIRM: and up to 1 year after].

4. Who we share your data with

We don't sell your data. We share it only with these companies, and only for what's explained above:

We'll also share data with the Spanish Tax Agency, the courts and other authorities when the law requires it.

5. Transfers outside the European Union

Some of these companies handle data in the United States or in Brazil:

• United States: with companies certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, Article 45 GDPR) and, failing that, with standard contractual clauses approved by the Commission (Article 46(2)(c) GDPR). You can check which companies are certified at dataprivacyframework.gov.
• PayPal transfers data within its group under its binding corporate rules (Article 47 GDPR), approved by the Luxembourg data protection authority.
• Brazil: in January 2026 the European Commission recognized that Brazil offers an adequate level of protection (Implementing Decision (EU) 2026/179, Article 45 GDPR).

If you'd like a copy of the safeguards, write to us.

6. Your rights

You can ask us at any time for:

• Access: to know what data we have about you.
• Correction: to fix it.
• Deletion: to erase it.
• Objection: to stop using it, for example for marketing emails or custom audiences.
• Restriction: to keep it without using it while a complaint is being resolved.
• Portability: to receive it in a format you can take to another company.
• Withdrawing your consent whenever you want, without affecting what was done before.
• Not being subject to decisions based solely on automated processing that significantly affect you.

How: email hola@lamusicaqueteimaginas.com with the subject “Data protection”, from the email you signed up or bought with. If you write from a different one, we may ask you to confirm your identity. We'll reply within one month at most; if the request is complex, we can extend this by two more months, letting you know (Article 12(3) GDPR). It's free.

To stop getting emails, just use the unsubscribe link at the end of each one.

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid, Spain). If you live in another EU country, you can also complain to the data protection authority there. If you like, write to us first and we'll try to sort it out.

7. Where we get your data from

You give it to us when you sign up, buy, do the challenge or write to us. Technical data (IP, browser, device fingerprint, cookie identifiers) comes from your browser when you visit our pages, in the cases explained above. The payment providers confirm to us whether the payment went through.

8. Minors

You must be 18 or over to buy the Shuriken Challenge. If the person doing the challenge is under 18, the purchase must be made by their parent or legal guardian, who consents to their participation, including in the WhatsApp group. If you're under 14, don't sign up for the guide unless your parent or guardian does it for you (Article 7 of Spanish Organic Law 3/2018).

9. Security

We use providers with recognized security measures. On our services we store your email and your IP as irreversible codes made with a secret key, and the IP summary for only 7 days. The exceptions are the purchase record and the proof of the checkout box, which include your email (and the proof, your IP) in readable form because we must be able to show them if there's a complaint. In every case, only our team can look at the records, with an access key.

10. Changes

If we change this policy, we'll publish the new version on this page with its date. If the change is important, we'll let you know by email.