Refund & Withdrawal Policy — Gigapop

Last updated: 2026-07-25

Quick summary

• You have 14 days to change your mind about a purchase, for any reason and without giving one. The 14 days run from the day you place the order, not from delivery.
• If you ask us to unlock your song straight away — which you may well want to do if the song is for a date that will not wait — you give up that 14-day right at the point the full song is actually available to you to play or download (see §4.4 for exactly when that is). We ask you to confirm this explicitly at checkout with a separate tick box. We never pre-tick it, we never bundle it with anything else, and we do not recommend one option over the other.
• If you would rather keep the 14-day right, don't tick the box. We will hold your song and unlock it once the 14 days are over. You keep the full right to cancel in the meantime.
• Separately from all of that, you have a legal guarantee: if the song never arrives, or arrives broken, or is not what we contracted to deliver, you can require us to fix it, or get a price reduction or your money back. This guarantee cannot be signed away and is not affected by the tick box. It lasts at least two years.
• You are buying from Dodo Payments, which is the Merchant of Record for the sale. Gigapop makes the song. You can start a withdrawal or a complaint with either of us — it counts from the moment the first of us hears from you.

If you only read one thing: the tick box gives up the no-questions-asked cancellation. It does not give up your right to a working song.

1. Who you are contracting with

Two different companies are involved in one purchase. This matters, so we set it out plainly.

Contact for anything in this document, including withdrawals, refunds and complaints:

• Gigapop: hi@gigapop.app (postal address and telephone to be inserted — CRD Art. 6(1)(c))
• Dodo Payments, as Merchant of Record: contact details to be inserted from the merchant agreement — see Annex D

You may use either. You never have to use both, and neither of us will send you to the other.

Drafting note for the reviewer. Five points here need work before publication:

• Do not publish this document naming Dodo as the seller while giving only Gigapop's contact details. If Dodo is the trader, the Art. 6(1)(c) identity and contact details that must be given are Dodo's. A policy that names one party as the seller and then routes the consumer exclusively to the other reads, to a regulator, as obscuring who the seller is — which is the Wathelet problem below, not a cure for it.
• CRD Art. 6(1)(c) requires a geographical address and a telephone number, not just an email. Gigapop has neither published today. See Annex D.
• The exact Dodo legal entity name and registered address must be inserted from the Dodo merchant agreement. It is deliberately not guessed at here.
• The Dodo relationship must be confirmed as principal/reseller, not agent. The product facts say Dodo is "the seller/contracting party for the purchase", which reads as principal — so Dodo is the trader and owes the Art. 6(1) information, the Art. 8(2) order button, the Art. 8(7) confirmation, the Art. 16(m) capture, the Art. 11a function and the Art. 13 refunds. If Dodo is in fact a disclosed agent selling in Gigapop's name, that flips: Gigapop becomes the trader and owes all of it directly, and Art. 6(1)(c)/(d) then additionally requires Dodo to disclose Gigapop's identity and geographical address. Do not infer the answer from the VAT invoice — the VAT deeming rules in Art. 28 of the VAT Directive and Art. 9a of Implementing Regulation 282/2011 make a platform the supplier for VAT purposes only and say nothing about who the trader is under consumer law.
• Watch the Wathelet risk either way. The price, the product description, the CTA and everything before the card form live on gigapop.app; only the card page is Dodo-hosted. Under C-149/15 Wathelet and Commission Guidance §3.2.2, a party that presents itself to the consumer as the seller can be treated as the seller. Branding must be consistent across the landing page, the pay pane, the invoice, the confirmation email and this document, or both parties are exposed and it is a standalone Art. 6 breach. It is not consistent today: the only transactional email Gigapop sends (_send_track_email, api/server.py) signs off "— Gigapop · gigapop.ru" and tells the recipient the message arrived "потому что ты подтвердил почту на gigapop.ru", i.e. it names a third domain that is neither gigapop.app nor Dodo.

2. What you are buying, and why the category matters

EU law treats digital content and digital services differently, and the difference decides whether the 14-day right can be given up at all. So we state it per product.

The price shown to you before you order is the total you pay, inclusive of VAT. A promotional code, where one applies, reduces that total, and everything in this document about refunds applies to the amount you actually paid.

Drafting note. Do not publish the sentence above until someone has watched a real EU checkout end to end. It is an Art. 6(1)(e) statement about a total that is assembled by two systems — Gigapop sets the amount, Dodo renders the payment page and applies VAT — and this draft has no evidence about what Dodo displays or whether any fee is added there. If a fee or a VAT line appears at the Dodo step that was not in the price on gigapop.app, this sentence becomes the misleading statement rather than the fix for one. See Annex D, item 4.

Drafting note — the price is not displayed in euro today, and this table is stated as if it were. prototype/song/index.html hard-codes the ruble symbol in the pay button and in the pre-purchase copy (six occurrences) and never calls the currency helper window.GBMoney defined in prototype/script.js, even though the API deliberately returns a currency field for exactly this purpose and api/server.py documents that on the EUR instance the historically-named price_rub field contains euros. prototype/clip/index.html (the EUR 99 SKU) does it correctly; the EUR 29 SKU does not. On the EU instance the main CTA therefore reads "открыть полностью — 29 ₽". Showing a euro price under a ruble symbol is a failure to give the total price under CRD Art. 6(1)(e) and a misleading action on price under UCPD Art. 6(1)(d), and it makes this table's "EUR 29" a statement the product contradicts. See Annex C, item 15.

Note also that the two prices are admin-editable settings (song_price_eur, clip_price_eur in bot/db.py, defaults 29 and 99), not constants. A published policy that hard-codes them will silently go stale the first time someone changes a setting. Either state them as "the price shown to you before you order" or add the price table to whatever process updates the setting.

Drafting note — the third row of that table is dismissed in four words and may be a contract in its own right. The account and hosted page are supplied without a price, but the consumer supplies personal data to get them. Since Directive (EU) 2019/2161, CRD Art. 3(1a) and DCD Art. 3(1) bring contracts of that kind into scope, subject to the carve-out where the personal data is processed exclusively to supply the content or to meet legal requirements. If that carve-out does not apply — and the Privacy Policy records purposes going beyond bare supply — then the free account carries its own pre-contractual information duties, its own withdrawal treatment and its own conformity obligations. Note in particular that the Art. 16(m) architecture in §4 does not transplant onto it: the (i)–(iii) conditions are expressed by reference to a contract that places the consumer under an obligation to pay, so for a data-for-service contract the analysis is different and this document does not do it. Decide whether it belongs here, in the Terms, or in a document of its own. See Annex D, item 11.

Why we say the paid products are digital content. Each purchase is a single, finished delivery of specific files, produced once from the brief you gave us. After it is made, it does not change. There is no catalogue, no recommendation engine, nothing that watches what you listen to and adapts, and no continuing editorial involvement from us. That is the line the Court of Justice drew in C-234/25 Sky Österreich Fernsehen (9 July 2026): an offering is a service where it "goes beyond the mere stable and, as the case may be, continuous provision of specific content" — in particular where it adapts to the consumer's individual behaviour or recommends content. A bespoke song, generated once, does not.

The honest caveat. The personalisation in Gigapop happens at the moment of creation, not during supply — that is what keeps it on the content side. But you also get an account and a hosted page, and if the practical thing a customer values were "ongoing access to my library", a court could see a digital service. Recital 30 of Directive (EU) 2019/2161 resolves genuine doubt in favour of the service rules, and Art. 16(m) is to be read strictly (C-641/19 PE Digital, reaffirmed in C-234/25).

Drafting note. This is the load-bearing call in the document and it needs sign-off. Two things make it materially safer, and both are product changes rather than drafting:

1. Offer a real download of the mp3 and the karaoke mp4 at the moment of unlock. If the consumer walks away holding the files, the supply is complete and self-contained, and the "it's really ongoing hosted access" argument loses most of its force. Today the delivery email sends a link to the song page, which pushes the other way.
2. Do not let the paid product drift into service territory. The moment Gigapop adds a subscription, a recommendation feed, a catalogue or anything that adapts to listening behaviour, the classification flips, the Art. 16(m) waiver stops being available for that product, and §4 of this document has to be rewritten around Art. 16(a) and Art. 8(8) instead. Flag this to product.

Also note for completeness: Art. 16(c) is not available here. The exception for goods "made to the consumer's specifications or clearly personalised" applies to goods. A bespoke song is not a good, and "but it's personalised" is not a route to killing the withdrawal right for digital content.

3. Your 14-day right of withdrawal

You may withdraw from the contract within 14 days, without giving any reason and without paying any penalty.

When the clock starts. For digital content that is not supplied on a physical medium, the period runs from the day the contract is concluded — that is, the day you place the order — not from the day you download or first listen (CRD Art. 9(2)(c)). It ends 14 calendar days later. Sending your withdrawal on the last day is enough; it does not have to reach us by then (Art. 11(2)).

If we fail to tell you about this right, the period does not quietly expire. Under CRD Art. 10(1) it runs for a further 12 months. If we give you the information late but within those 12 months, the 14 days start when you receive it (Art. 10(2)).

Where the right does not apply. It applies to consumers — that is, where you are acting wholly or mainly outside your trade, business, craft or profession. If the purchase is made partly for business purposes but the business purpose is not the predominant one, you are still a consumer and you still have this right (Recital 17 CRD). We will not treat a company email address, an invoice request or a VAT number as, by itself, proof that you bought as a business. If you buy purely in the course of a business, the withdrawal right in this section does not apply to you.

4. How and when you lose the right — the immediate-unlock choice

This is the section that matters most in practice, because a birthday song that arrives in 15 days is worthless.

4.1 The choice we put in front of you

At checkout you choose one of two things:

Option A — unlock now. You tick a box asking us to start immediately and confirming you understand what that costs you. We unlock the full song and start the karaoke render as soon as your payment is confirmed. You lose the 14-day right at the point performance begins — see §4.4, which sets out exactly when that is.

Option B — keep the 14 days. You leave the box unticked. We hold delivery and unlock the song once the 14-day period has ended. Until then you can cancel for any reason and get a full refund. This is a genuine option, not a formality — the contract expressly provides for delayed supply in this case, as DCD Art. 5(1) permits where the parties agree otherwise.

We never pre-tick the box, and ticking it is never bundled into "I accept the Terms".

4.2 The exact wording the checkout shows

The tick box carries this text, and nothing is hidden behind a link:

☐ Unlock my song immediately. I ask Gigapop to begin performance of the contract straight away, during the 14-day withdrawal period, and I acknowledge that I lose my right of withdrawal as soon as the full song has been made available to me.

"Made available to me" means the point at which you can actually play or download the full track — not the moment we flip a switch at our end, and not the moment we send you an email. §4.4 sets this out, and it is the reading that governs: if the two ever diverge, the one that favours you applies.

That single statement is doing three jobs at once, which Commission Guidance 2021/C 525/01 §5.7 expressly permits: the consent required by Art. 16(m)(i), the acknowledgement required by Art. 16(m)(ii), and the Art. 6(1)(k) information about the circumstances in which the right is lost.

Drafting note — two hazards in this exact string.

1. "Made available" is looser than the law. Art. 16(m) kills the right when performance has begun, and where delivery is by link that is activation, not availability (§4.4). A checkout string that tells the consumer the right dies earlier than it does is both misleading and self-defeating: an acknowledgement of a proposition that is not accurate is a weak Art. 16(m)(ii) acknowledgement. The clarifying sentence above patches this in the policy, but the checkout string itself should be re-drafted with the lawyer so the two match without a gloss.
2. There is already a mandatory tick box in this exact slot, and it is a different thing. prototype/song/index.html renders a required checkbox payConsent — "согласен на обработку email — для чека и чтобы песня сохранилась за мной" — which blocks payment when unticked. The Art. 16(m) box must be separate from it and separately actioned. Merging them, or reusing that control, defeats Art. 16(m) (Guidance §5.7 rules out consent given through general acceptance) and simultaneously makes the data-protection consent non-specific. See Annex C, item 2.

The Russian string, since the interface is Russian by default, is in Annex A together with the evidence the system has to keep.

4.3 What has to be true for the right to actually be lost

Four things, all of them, cumulatively (CRD Art. 16(m)):

1. Performance has begun.
2. You gave prior express consent to performance beginning during the withdrawal period.
3. You acknowledged that you thereby lose the right of withdrawal.
4. We provided you with the confirmation of the concluded contract on a durable medium, as required by CRD Art. 8(7).

Miss any one of them and the right survives — see §6. Point 4 is the one traders forget: the confirmation email is not a courtesy, it is a condition.

"Express" means you did something positive, by analogy with CRD Art. 22. Commission Guidance §5.7 is explicit that a pre-ticked box, or acceptance of the general terms and conditions, does not satisfy Art. 16(m).

4.4 When performance begins for a Gigapop song

Your song is written and generated before you pay — that is what the free preview is. So performance of the paid contract is not the act of generating the song. It is:

• the full track being made available to you (the lock coming off, so you can play the whole thing or download it), and
• the karaoke video being rendered and made available.

If we deliver by sending you a link, then per Commission Guidance §5.7 performance begins when you activate that link — not when we send it. An email sitting unopened in your inbox means your withdrawal right is still alive.

4.5 The order things must happen in

1. You tick the box at checkout. Before payment.
2. Payment is taken.
3. We send you the confirmation on a durable medium, containing the full contract information and a confirmation of the consent and acknowledgement you gave (CRD Art. 8(7)(a) and (b)).
4. Only then do we unlock the song and start the karaoke render.

Step 3 before step 4 is not a nicety. Because your consent is taken before the confirmation is sent, Guidance §5.7 requires the confirmation to carry that consent and acknowledgement with it. If the confirmation ever goes out after performance has started, we owe you a separate additional confirmation of the consent and acknowledgement before performance begins — and at that point the flow is already fragile.

Drafting note. This ordering is the single most important implementation change in the document, and the current code does the opposite: the Dodo webhook calls _settle_paid_order, which unlocks the song and enqueues the karaoke render immediately, with no confirmation email of any kind from Gigapop. See Annex C, item 4.

Resolve the "we" in this section against §1 before publication. Art. 16(m)(iii) requires the confirmation from the trader. §1 says the trader is Dodo; steps 1, 3 and 4 here are written as Gigapop's. Either Dodo issues an Art. 8(7) confirmation carrying the consent and acknowledgement, or Gigapop issues it as Dodo's agent under a documented arrangement. A confirmation sent by a party that is not the trader, with nothing allocating the duty, is the kind of gap that only surfaces when someone contests it.

4.6 What counts as a durable medium

The confirmation must be on a durable medium: something addressed to you personally, that you can store and reproduce unchanged, and that we cannot quietly edit later (DCD Art. 2(13)).

• An email to your own mailbox qualifies. That is what we use.
• A link to a page on our website does not (C-49/11 Content Services).
• An in-account receipt page qualifies only if you can store and reproduce it unchanged, we cannot unilaterally alter it, and we take active steps to draw your attention to it (C-375/15 BAWAG) — which is why we send the email regardless.

5. How to withdraw

5.1 The withdrawal function on the site

Under CRD Art. 11a, applicable since 19 June 2026, we provide a withdrawal function on the site:

• a control labelled "Withdraw from contract here", in legible text, prominently displayed and continuously available throughout the withdrawal period;
• it lets you send the withdrawal statement online and give or confirm your name, the details identifying the contract, and the electronic address to which we send the confirmation;
• a second control labelled "Confirm withdrawal" submits it;
• when you submit, we send you an acknowledgement of receipt on a durable medium, including the content of your withdrawal and the date and time you submitted it, without undue delay (Art. 11a(4));
• submitting before the 14 days expire counts as exercising the right in time.

You do not need to be signed in to reach it, and you do not need to install anything (Recital 37 of Directive (EU) 2023/2673).

Drafting note — build this without creating a data-leak. An unauthenticated form that takes a name, a contract identifier and a free-text "electronic address", and then emails back an acknowledgement containing the content of the withdrawal, is a ready-made way for a third party to (a) cancel someone else's contract and (b) have that person's order details posted to an attacker-chosen address. Both are foreseeable, and GDPR Arts. 5(1)(f) and 32 require the design to account for them. The Art. 11a(4) acknowledgement should go to the address already held on the order, not to whatever address the form was filled in with; where the two differ, treat the withdrawal as effective but confirm out of band. Do not reach for sign-in as the fix — accessibility of the function is itself the Art. 11a obligation.

5.2 Any other clear statement also works

You are not obliged to use that function. Under CRD Art. 11(1) any unequivocal statement works — an email to hi@gigapop.app saying you withdraw is enough. You may use the model form in Annex B, but you do not have to. We cannot impose extra formalities, demand a reason, or require a particular format.

5.3 Either company can receive it

You can send your withdrawal to Gigapop (hi@gigapop.app) or to Dodo Payments, and the 14-day refund clock starts when the first of us is informed. We do not send you back and forth between us, and we do not treat a refund as discretionary.

6. If we got the flow wrong

If you withdraw and it turns out we did not obtain your prior express consent, or did not obtain your acknowledgement that the right would be lost, or did not give you the Art. 8(7) confirmation, then under CRD Art. 14(4)(b) you bear no cost at all for what was supplied.

In plain terms: you get 100% of your money back, and there is no deduction for the song you already received. There is no proportionate set-off for digital content — that exists for services (Art. 14(3)) and not here. Commission Guidance §5.8.3 confirms you are entitled either not to pay, or to be reimbursed what you paid.

We would rather say this out loud than bury it: a defective checkout costs us the entire purchase price, not part of it.

Drafting note — one consumer-side obligation is missing from this section and needs checking. As amended by Directive (EU) 2019/2161, the CRD also imposes duties after withdrawal that this draft never states: the trader's duties in respect of content the consumer provided or created (mirroring DCD Art. 16(2)–(4)), and — the drafter believes, but could not verify — an obligation on the consumer to refrain from using the digital content and from making it available to third parties once they have withdrawn. Confirm the article numbering and the exact scope, then decide whether to state it. It cuts against the consumer, so it must be stated accurately or not at all; and note that it does not turn into a right to condition the refund on the consumer deleting the files, which would be a separate problem under §12.

7. Refunds after a withdrawal

• We reimburse all payments received from you, including VAT.
• Without undue delay, and in any event within 14 days of being informed that you withdraw (CRD Art. 13(1)). The 14 days are a backstop, not an entitlement to sit on your money: if we can pay you back sooner, we owe it sooner.
• Using the same means of payment you used, unless you expressly agree to something else.
• No fee. We do not deduct a processing charge, a payment-provider fee or an administrative cost. Payment-provider settlement and payout cycles are our problem, not yours, and are not a reason to be late.

Your bank or card issuer may apply its own currency-conversion rate if your account is not in euro. That is between you and your bank; we return the full euro amount you paid.

8. Your legal guarantee — this is separate, and it cannot be waived

Everything above is about changing your mind. This section is about something being wrong. They are two independent regimes and they do not cut each other down.

Ticking the immediate-unlock box does not shorten this guarantee by a single day. Under DCD Art. 22 and CRD Art. 25 you cannot waive these rights in advance, and any clause that tries to is simply not binding on you.

8.1 What we owe you

Your song has to match what we agreed (DCD Art. 7) and what you can objectively expect (DCD Art. 8):

• It must be fit for the purpose digital content of this kind is normally used for, and come with the quality, functionality, compatibility, accessibility, continuity and security you can reasonably expect.
• It must match the public statements we made about it, including our advertising.
• It must correspond to the preview. This one matters more than any other for Gigapop: DCD Art. 8(1)(b) requires the content to conform to any trial version or preview made available before the contract was concluded. The free preview is that preview. Concretely, what you are shown before you pay is an excerpt — roughly the first 45 seconds — of each version we generated for you, and what you unlock is the full length of those same versions. If the full track is a different song, a different mix, a different set of lyrics, or the part beyond the excerpt is noticeably worse than the part you heard, that is a lack of conformity — not a matter of taste.

Drafting note. Confirm the excerpt length and the number of versions against the code - It must come with the instructions and customer assistance you can reasonably expect.

Where we can deviate, we have to do it properly. DCD Art. 8(5) is the only route: we must specifically inform you that a particular characteristic departs from what you would otherwise be entitled to, and you must expressly and separately accept that deviation when concluding the contract. A general "the service is provided as is" clause in a wall of terms does not do it and is not effective against you.

Drafting note. The current Russian Terms (prototype/terms/index.html, §05) say the service is provided «как есть» and disclaim continuity, absence of errors, and any match between the result and expectations, and the Oferta §8 repeats it. Against an EU consumer those clauses are void under DCD Art. 22 — and objective conformity under Art. 8(1) expressly includes continuity and security, so they are disclaiming precisely what cannot be disclaimed. Do not port that language into the EU terms. There is also a genuine tension to resolve with product: honest, specific statements about what AI generation can and cannot do are legitimate and useful, but they belong in the pre-contractual description under Art. 8(5), individually surfaced and separately accepted — not in a blanket disclaimer.

8.2 If the song never arrives

Under DCD Art. 13, if we fail to supply, you call on us to do so. If we then fail to supply without undue delay, or within any further period you and we expressly agree, you may terminate and get your money back. You may terminate immediately, without the extra step, if we have declared we will not supply, or if it is otherwise clear we will not, or if you told us before ordering that delivery by a particular time was essential — which for a birthday, a wedding or an event is very often the case, so tell us the date.

The burden of proving that the content was actually supplied is on us (DCD Art. 12(1)).

8.3 If the song arrives but is wrong

Your remedies, in order (DCD Art. 14):

1. We bring it into conformity — in practice, we regenerate or re-render, free of charge, within a reasonable time from being told, and without significant inconvenience to you. We can decline this route only if it is impossible or would be disproportionate.
2. A price reduction, or termination with a refund, if bringing it into conformity is impossible or disproportionate, if we do not do it, if we try and it is still wrong, if the problem is serious enough to justify going straight there, or if we declare we will not fix it.

Termination is available unless the problem is minor — and if we say it is minor, we have to prove it (DCD Art. 14(6)).

8.4 How long, and who has to prove what

• The guarantee runs for at least two years from supply for a one-off delivery (DCD Art. 11(2)). Some Member States give longer; whichever is more generous where you live applies.
• For the first year after supply, we have to prove the content was conforming when supplied, not the other way round (DCD Art. 12(2)).
• That burden shifts to you only in two narrow situations, and telling you the technical requirements is by itself not one of them (DCD Art. 12(4)–(5)):
• we demonstrate that your own digital environment — your device, your connection, your software — is not compatible with the technical requirements of the content, and we had told you those requirements clearly and comprehensibly before you bought (see §9). Both limbs, not just the second; or
• you do not cooperate with a check of whether the cause lies in your digital environment, where cooperating was reasonably possible and necessary, the check was the least intrusive technically available means, and we had told you clearly and comprehensibly before you bought that this cooperation may be needed.

Drafting note. The earlier draft of this bullet said the burden shifted if we had "clearly informed you of the technical requirements before you bought" — full stop. That dropped the requirement that the trader demonstrate incompatibility, which is the whole point of Art. 12(4), and it handed us a burden-shift the law does not give. Corrected. It is worth checking the rest of the document for the same failure mode: a condition stated with one of its cumulative limbs missing reads as a right and is not one.

8.5 If you terminate for non-conformity

• We reimburse all sums paid, without undue delay and in any event within 14 days of being informed, by the same means of payment, with no fee (DCD Art. 16(1), Art. 18).
• You owe nothing for having used the content during the period it was non-conforming (DCD Art. 17(3)).
• We stop using content you provided or created, other than your personal data (which the Privacy Policy covers), subject to the narrow exceptions in DCD Art. 16(3).
• On your request we make your non-personal content available to you — your lyrics, your audio, your video — free of charge, without hindrance, within a reasonable time and in a commonly used, machine-readable format (DCD Art. 16(4)). This is a separate right from GDPR data portability, which covers personal data only.
• We may disable your access or your account after termination, but that does not cut down the export right above (DCD Art. 16(5)).

8.6 Concrete cases

Drafting note. The double-charge row is not hypothetical. core/dodo.py and api/server.py both record that Dodo exposes no API to cancel an open checkout session, so a stale hosted checkout page can be paid a second time; mark_paid_and_unlock is idempotent and merely logs "DOUBLE CHARGE?", and the money then has to be returned by hand in the Dodo dashboard. That is a live refund obligation with no automated detection and no owner. See Annex C, item 9.

9. What you need in order to use what you bought

We state this before you buy, both because CRD Art. 6(1)(r) and (s) require it and because it is one of the two things DCD Art. 12(4) requires before the burden of proof can shift to you — the other being that we actually demonstrate your own digital environment is the cause, which telling you the requirements does not do on its own (see §8.4).

• Playback: the full track is delivered as MP3; the karaoke video as MP4 (H.264/AAC). Both play on any current browser, phone, or standard media player without extra software.
• Browser: any current version of Chrome, Safari, Firefox or Edge. Playback in the site player needs JavaScript enabled.
• Connection: streaming needs a normal mobile or broadband connection; downloading the karaoke video needs enough space on your device.
• No DRM on the files themselves. The MP3 and MP4 carry no copy protection, no device limit, no activation limit and no cap on how many times you may play them. Once you have a copy, it is yours to keep and use on the terms set out in the Terms.
• Getting the MP3 does require an account. Streaming the full track works as soon as it is unlocked, but the download control for the MP3 is only shown once you are signed in — which today means giving us either a Telegram account or an email address. We state this here because it is an access condition on something you have paid for, not a detail: if you do not want to give us a contact, you can still play the full track, but you cannot currently take the audio file away.
• Language: lyrics and karaoke text are generated in Russian. The interface is Russian by default; an English translation exists but does not yet cover every screen. If you need lyrics in another language, this product cannot give you that — it is a limit on what the product does, disclosed before you buy, not a defect you can claim against later.
• Account: you need a Gigapop account to keep your song in your library, and (see above) to download the MP3.

Drafting note — the first bullet used to read "No technical protection measures … The files are yours to keep", and that is not what the product does. prototype/song/index.html renders the MP3 download button with display:none and maybeRecommendAuth() only reveals it after a successful /api/me/songs call; the code comment is explicit — "Гейт скачивания: mp3 качают только авторизованные… Аноним слушает целиком, но скачать может лишь «забрав себе»". Three consequences, all of which need a decision rather than more drafting:

• As an information matter, an access restriction of this kind is exactly what CRD Art. 6(1)(r)/(s) is for, and it was not disclosed. Now it is.
• As a data-protection matter, conditioning delivery of content the consumer has already paid for on handing over a contact needs a hard look. If the contact is genuinely necessary to deliver the purchase, GDPR Art. 6(1)(b) covers it and the gate is defensible. If the real reason is list-building, it is not, and consent obtained that way is not freely given (Art. 7(4)). Whichever it is, it must match what the Privacy Policy says.
• As a conformity matter, §10 tells consumers that downloading their files is the one thing that makes them independent of us. That advice is worth very little if the download is gated. The cleanest fix is the one already recommended in §2: offer a real download of both files at the moment of unlock, to the person who just paid, without a further gate.

Drafting note. The Russian-lyrics point is stated as a functionality limitation under CRD Art. 6(1)(r), disclosed before purchase, rather than as an Art. 8(5) deviation. That is the right frame — it is a description of what the product is — but confirm the checkout actually surfaces it before payment, in both language versions. If it only appears in the terms, it is not disclosed.

10. How long we keep your song available, and updates

Under DCD Art. 8(2)(b), even for a one-off delivery we owe you updates — including security updates — for the period you may reasonably expect, and under Art. 8(1) the content has to keep working.

• We keep your purchased song and karaoke video available in your account and by download for at least [PERIOD — decision required, see Annex D] from the date of purchase.
• Within that period we keep playback and download working, and apply any security updates needed to keep the service safe.
• Download your files. It is the only thing that makes you independent of us, and we would rather say so than have you assume hosting is forever. Note the access condition in §9: the MP3 download control appears once you are signed in.
• If we ever intend to stop hosting purchased songs, we will tell you in advance on a durable medium and give you a fair chance to download everything first.

Drafting note. The bracketed period is the only unfilled value in the body text and it must be a real number before publication — a bare "as long as necessary" is not compliant, and from 27 September 2026 CRD Art. 6(1)(lc) requires the minimum update period to be stated pre-contractually. Recommendation: 24 months minimum, paired with the download-at-unlock change recommended in §2, which is what makes 24 months defensible rather than stingy. Decide with product; it is a hosting-cost question, not a legal one.

11. If we change the service

Where we supply something over a period of time, we may modify it beyond what is needed to keep it conforming only on the conditions in DCD Art. 19: the contract must allow it and give a valid reason, it must cost you nothing extra, and we must tell you clearly and in good time.

The valid reasons we rely on, stated specifically rather than as a general right to change anything:

1. Adapting to a change in an upstream provider we depend on — the music generation model, the language models, or the hosting — including where a provider changes its terms, discontinues a model, or ceases to be available to us.
2. Complying with a legal or regulatory requirement, or a court or authority order.
3. Fixing a security vulnerability or protecting the service and its users against abuse.

If a change has more than a minor negative impact on your access to or use of what you bought, we will tell you in advance, on a durable medium, setting out what is changing and when, and you may terminate free of charge within 30 days (DCD Art. 19(2)) — unless we enable you to keep the unmodified version, in conformity and at no extra cost (Art. 19(4)).

12. Things we cannot do, and will not try to

Stated plainly because these clauses are common and are all void:

• We cannot say "all sales are final" or "no refunds on digital goods". Such a term is not binding on you (CRD Art. 25, DCD Art. 22) and is separately likely to be an unfair commercial practice.
• We cannot deem the service accepted after 24 hours, or any other short window, so as to cut off your conformity rights. The legal guarantee is at least two years and cannot be shortened in advance.
• We cannot make refunds "at the discretion of Gigapop" or send you to the other company as though your right depended on them.
• We cannot charge a fee for a refund, or net one out of it.
• We cannot require a reason, a form, a phone call, or a particular wording for a withdrawal.
• We cannot rely on a general "as is" disclaimer to escape the conformity rules.
• We cannot make your refund conditional on you deleting the files, returning them, closing your account, giving up the karaoke video, or agreeing not to say anything about it.
• We cannot steer you into giving up the withdrawal right — by pre-selecting the immediate-unlock box, by making it a condition of buying, by bundling it with acceptance of the terms or with any data-protection consent, by making the option that keeps your rights harder to find or uglier to click, or by telling you that most other customers waive it. Presenting the two options even-handedly is part of the obligation, not a courtesy.
• A choice of Kazakh law would not deprive you of the protection of the mandatory consumer rules of the country you live in — see §14.

Drafting note. Each bullet above corresponds to a clause that exists today in the live Russian documents: Oferta §6 ("возврат за уже сгенерированную песню не производится"), Oferta §5.3 (deemed accepted after 24 hours), Oferta §8 and Terms §05 ("как есть"). Those documents are drafted to ст. 26.1 / ст. 32 ЗоЗПП and are fine for the Russian instance. They must not be reused, translated or linked for the EU instance — see Annex C, item 1.

13. Complaints, and getting help outside the courts

Write to hi@gigapop.app. Tell us the order and what went wrong. We aim to reply within 5 working days, and the legal deadlines above run regardless of our internal targets.

If we cannot resolve it between us:

• Your national consumer ADR body. The Commission publishes the list of certified dispute resolution entities in the Member States, Norway and Iceland at https://consumer-redress.ec.europa.eu/dispute-resolution-bodies.
• The European Consumer Centre (ECC-Net) in your country helps consumers with cross-border purchases and is the right first stop for a purchase like this one: https://www.eccnet.eu/.

Drafting note — do not reinstate the ODR link. The European Online Dispute Resolution platform was discontinued on 20 July 2025 following Regulation (EU) 2024/3228, and the old ec.europa.eu/consumers/odr address now serves only a relocation notice (verified 2026-07-25). Nearly every refund-policy template still in circulation links to it. Linking a dead platform as your Art. 6(1)(t) redress route is both wrong and conspicuous.

Separately, the reviewer should confirm whether Gigapop or Dodo is subject to an ADR scheme, since CRD Art. 6(1)(t) requires disclosure of the out-of-court mechanism only where the trader is subject to one. The two links above are offered as help, not as a claim of submission to any particular body — keep that distinction in the final wording.

14. Which law applies

We are established in Kazakhstan and Dodo is established outside the EU, but that does not reduce your rights. Under Art. 6 of the Rome I Regulation, where a trader directs its commercial activities to the country where you live, the law of that country governs the contract, and any choice of a different law cannot deprive you of the protection of the mandatory rules that would otherwise apply. The withdrawal and conformity rights in this document are exactly such mandatory rules (CRD Art. 25).

Gigapop is offered in euro, with a Russian- and English-language interface, to customers living in the EU. We therefore apply EU consumer law and do not argue otherwise.

Where you can sue, and where we can. Under the Brussels Ia Regulation (EU) No 1215/2012, Art. 18(1), you may bring proceedings in the courts for the place where you are domiciled — and that applies regardless of the fact that neither of us is domiciled in the EU, because we direct our activities to your Member State. The protection runs the other way too: under Art. 18(2) we may sue you only in the courts of the Member State where you are domiciled. An agreement about jurisdiction made before a dispute arises cannot take either of those away from you (Art. 19).

Drafting note. The earlier draft gave only the consumer's right to sue at home, described the connecting factor as habitual residence rather than domicile, and did not say why Brussels Ia bites at all against two non-EU parties. Half a jurisdiction clause reads, to a regulator, as the half that suits the trader. Confirm the article numbering with the lawyer, and confirm the enforcement reality in Kazakhstan separately — a favourable forum the consumer cannot enforce a judgment in is worth flagging honestly rather than implying otherwise.

15. Contact

• Withdrawals, refunds, complaints, conformity claims: hi@gigapop.app
• Withdrawal function: on gigapop.app, labelled "Withdraw from contract here", available throughout the withdrawal period without signing in
• Invoices, VAT and payment records: Dodo Payments, as Merchant of Record, on the details shown on your invoice
• Postal address and telephone: to be inserted — CRD Art. 6(1)(c), see Annex D
• Seller of record — full legal name, registered address, and contact details: to be inserted for the Dodo Payments entity — see Annex D. If Dodo is the trader, these are the Art. 6(1)(c) details, and this document cannot be published without them.

16. What changes on 27 September 2026

Directive (EU) 2024/825 applies from 27 September 2026 (transposition deadline was 27 March 2026). From that date this document and the checkout must additionally carry:

• CRD Art. 6(1)(lb) — a standalone reminder of the legal guarantee of conformity for digital content and digital services. §8 already says it; from that date it must be presented as its own pre-contractual item, not merely as part of a longer policy.
• CRD Art. 6(1)(lc) — the minimum period during which software updates are provided, where the provider makes that information available. This is the same number as §10, and it must appear pre-contractually, not only here.
• CRD Art. 8(2) — the pre-order summary shown immediately before the order button changes from points (a), (e), (o), (p) to (a), (e), (la), (o), (p).

Nothing else in this document changes on that date. It is flagged now because a checkout built to the pre-September text will go stale roughly two months after the planned EU launch.

Annex A — the exact strings and evidence the checkout must capture

Implementation specification. Not part of the consumer-facing text, other than the strings themselves, which are shown verbatim.

A.1 The tick box

One checkbox, unticked by default, actioned separately from any terms acceptance, positioned immediately above the order button:

English

☐ Unlock my song immediately. I ask Gigapop to begin performance of the contract straight away, during the 14-day withdrawal period, and I acknowledge that I lose my right of withdrawal as soon as the full song has been made available to me.

Russian

☐ Открыть песню сразу. Прошу Gigapop приступить к исполнению договора немедленно, не дожидаясь окончания 14-дневного срока отказа, и подтверждаю, что теряю право на отказ от договора, как только полная версия песни станет мне доступна.

If it is left unticked, the purchase still completes; delivery is scheduled for the day after the withdrawal period ends, and the confirmation email says so.

This control must be new. Do not reuse, extend or relabel the existing payConsent checkbox in prototype/song/index.html ("согласен на обработку email…"), and do not place the two so that one tick can plausibly be read as answering both. They are different consents, under different instruments, with different consequences, and merging them breaks both. The two options must also be presented with equal prominence: no highlighting, pre-selection, ordering trick, or copy suggesting the immediate-unlock option is the normal one.

A.2 The order button

Label it, in legible text, only with:

• English: Order with obligation to pay
• Russian: Заказ с обязательством оплаты

or an unambiguous equivalent. This is CRD Art. 8(2), and the sanction for getting it wrong is severe: "the consumer shall not be bound by the contract or order" — the whole contract unwinds, which is a far worse outcome than any withdrawal. купить / открыть полностью — 29 ₽ (which is what the pay button actually renders today, ruble symbol and all — see Annex C, items 3 and 15) is not sufficient. Note that the label has to be fixed in the same change as the currency, or the fix will ship a compliant button showing the wrong currency.

A.3 What must be persisted, per order

CRD Art. 6(9) puts the burden of proving compliance on the trader, so none of this can be reconstructed later:

The natural home is a new columns-or-side-table on the existing song payment record created in db.create_song_payment (api/server.py), which today stores only order id, owner, amount, ref_order_id and promo code.

Drafting note — this evidence set is personal data, and the Privacy Policy does not cover it yet. Every row above is linked to an identified consumer, and the "first activation" row is behavioural telemetry: when a named person first played or downloaded a specific track. Before this is built, three things have to exist alongside it:

• A legal basis, stated per purpose. The compliance-evidence purpose is not consent and should not be built as consent — the honest analysis is a legal obligation or a legitimate interest in being able to discharge the CRD Art. 6(9) burden of proof, and the Privacy Policy's own drafting notes are already careful about not dressing Kazakh obligations up as EU ones. Pick the basis deliberately.
• A retention period tied to that purpose, not an open-ended one. The evidence is needed while a withdrawal or conformity claim is possible; the Privacy Policy already runs a 5-year retention for transaction records, so decide whether this rides on that or gets its own, shorter clock.
• A row in the Privacy Policy's purpose table and in the record of processing. docs/legal-eu/privacy.md currently flags Art. 16(m) consent capture and the Art. 11a function as out of scope, noted for completeness. The moment this annex is implemented, that is no longer true, and the two documents will be inconsistent — which is the first thing a supervisory authority reads them for.

The Art. 11a withdrawal function raises the same point: it collects a name, a contract reference and an electronic address from a person who may not be signed in. See §5.1.

A.4 The Art. 8(7) confirmation email

Sent to the consumer's own mailbox — Resend is already wired into the codebase (_send_track_email, api/server.py) — before the unlock, containing:

1. all the CRD Art. 6(1) pre-contractual information, unless already given on a durable medium;
2. confirmation of the consent and acknowledgement the consumer gave (Art. 8(7)(b));
3. the total price paid including VAT, and who the Merchant of Record is;
4. information about the withdrawal right, when it is lost, and the placement of the Art. 11a withdrawal function;
5. the model withdrawal form.

Attach or inline the content. Do not send a bare link to a page — C-49/11 Content Services. The existing track email sends a link to the song page and does not qualify.

Annex B — model withdrawal form (CRD Annex I(B))

Complete and return this form only if you wish to withdraw from the contract. You do not have to use it — any clear statement is enough.

To: Gigapop — Ivan Smetanin, hi@gigapop.app (and/or Dodo Payments, on the details shown on your invoice)

I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract of sale of the following goods (*)/for the provision of the following service (*),

Ordered on (*)/received on (*): ................................ Name of consumer(s): ................................ Address of consumer(s): ................................ Order or song reference: ................................ Signature of consumer(s) (only if this form is notified on paper): ................................ Date: ................................

(*) Delete as appropriate.

Annex C — known gaps between this document and the live product

The most useful part of this draft. Every item below is a real difference between what this policy says and what gigapop.app does today, verified against the code on 2026-07-25. Items 1–14 are ordered by how expensive they are to get wrong. Items 15–18 were added in the 25 July adversarial review and are not in that order — item 15 belongs near the top.**

1. The EU instance has no EU-facing contract documents at all. The only legal pages are prototype/oferta/, prototype/terms/ and prototype/privacy/, drafted in Russian to Russian law (ст. 26.1 / ст. 32 ЗоЗПП, 54-ФЗ, 152-ФЗ), naming T-Kassa as the payment operator and gigapop.ru / @gigapop_music_bot as the service. The Oferta states "возврат за уже сгенерированную песню не производится" — no refund for an already-generated song. Against an EU consumer that is void (CRD Art. 25, DCD Art. 22). The EU instance needs its own documents; translating these would import the defect.

2. No Art. 16(m) consent or acknowledgement is captured anywhere — and the slot it belongs in is already occupied. The buy pane (prototype/buy/index.html) shows only a passive line — "Нажимая «купить», вы принимаете Оферту" — which is precisely the pattern Commission Guidance §5.7 rules out. Neither limb (i) nor limb (ii) is satisfied anywhere in the flow. Consequence: the withdrawal right survives every sale, and under CRD Art. 14(4)(b) every customer can demand a full refund and keep the song. This is the single most expensive gap.

Correction to the earlier draft of this item, which said "there is no checkbox". There is one, in the song pay pane where the Art. 16(m) box has to go: prototype/song/index.html renders a required payConsent checkbox — "согласен на обработку email — для чека и чтобы песня сохранилась за мной" — and blocks payment when it is unticked ("нужно согласие на обработку email"). That matters twice over. First, the obvious implementation is to bolt the withdrawal wording onto the control that already exists, which destroys the Art. 16(m) consent (it must be separate and specific) and makes the data-protection consent non-specific at the same time. Second, on its own terms that checkbox is questionable: an email needed to deliver the purchase and issue the receipt is GDPR Art. 6(1)(b) territory, not consent, and consent that is a precondition of buying is not freely given (Art. 7(4)). Fix both together, not one at a time. See §4.2 and Annex A.1.

3. The order button is mislabelled. prototype/song/index.html renders 🎵 ${_unlockWord} — ${priceRub} ₽, i.e. "открыть полностью — 29 ₽"; the buy page renders купить. CRD Art. 8(2) requires "order with obligation to pay" or an unambiguous equivalent, and the sanction for failing is that the consumer is not bound by the contract at all. (The earlier draft of this item cited line 564 and a 29 € label; the line is 565 and the label carries a ruble symbol — see item 15, which is the more serious half of the same defect.)

4. Gigapop sends no durable-medium confirmation, and unlocks before any confirmation exists. _settle_paid_order (api/server.py) calls mark_paid_and_unlock and mark_karaoke_pending straight from the Dodo webhook. Only Dodo sends anything, and it is an invoice that will not contain the consent and acknowledgement. Art. 16(m)(iii) is therefore unsatisfied even if a checkbox is added, until the ordering in §4.5 is implemented.

5. The existing delivery email is not a durable medium — and it is not a delivery email. _send_track_email sends "ссылка «прослушать на сайте» (не вложение mp3)" — a link to the song page, which C-49/11 Content Services is directly on point about. But it is worse than the earlier draft of this item implied: the email is not sent automatically on payment at all. It goes out only when the consumer actively requests it, through POST /api/song/<id>/email-track, which additionally requires a gb_user cookie and a valid share key. A consumer who buys and never presses that button receives nothing from Gigapop. The email also signs itself "— Gigapop · gigapop.ru" and refers the recipient to gigapop.ru, a third brand/domain alongside gigapop.app and Dodo — see the Wathelet note in §1.

6. There is no Art. 11a withdrawal function. Nothing on the site is labelled "withdraw from contract here", there is no "confirm withdrawal" control, and no durable-medium acknowledgement of receipt. This has been mandatory since 19 June 2026. Because CRD Art. 6(1)(h) now also requires information about the existence and placement of that function, its absence plausibly triggers the Art. 10(1) twelve-month extension of the withdrawal period on top of national penalties — Germany contemplates fines up to EUR 50,000 or 4% of turnover, and consumer associations send warning letters.

7. No performance-start telemetry. Nothing records when the consumer first plays or downloads the full track. Without it we cannot prove performance began, which is limb one of Art. 16(m) and squarely our burden under Art. 6(9).

8. No geographical address or telephone number is published. CRD Art. 6(1)(c) requires both, in addition to email. Today there is only hi@gigapop.app.

9. Duplicate charges are possible and are refunded by hand. core/dodo.py and api/server.py both record that Dodo offers no API to cancel an open checkout session, so a stale hosted checkout page can be paid twice; the code merely logs DOUBLE CHARGE? and the money must be returned manually in the dashboard. There is no detection, no alert routed to a person, and no defined turnaround — against a hard 14-day refund clock.

10. The withdrawal/refund split with Dodo is undocumented. Nothing allocates, as between Gigapop and Dodo: who hosts the Art. 11a function, who receives withdrawal statements, who issues the Art. 11a(4) acknowledgement, who funds and executes refunds inside the 14-day windows, who fronts conformity claims, and who performs the DCD Art. 16(4) export. That allocation binds only between the two of us and never against the consumer, but without it the 14-day clocks have no owner. A DCD Art. 20 redress route should be agreed at the same time.

11. No DCD Art. 16(4) export path exists. There is no way for a consumer to retrieve their lyrics, audio and video in a commonly used machine-readable format on request. This is separate from GDPR portability and is not covered by the privacy work.

12. Delivery is link-and-hosting based, which weakens the digital-content classification. See §2. Offering a real download at unlock is both a conformity improvement and the cheapest available support for the classification this whole document rests on.

13. The classification itself is unreviewed. If a lawyer concludes the paid unlock is a digital service under C-234/25, then §4 must be rebuilt on CRD Art. 8(8) (express request plus acknowledgement) and Art. 16(a) (right lost only on full performance), with Art. 14(3) proportionate compensation replacing the clean Art. 16(m) cut-off.

14. Two SKUs, one flow. The jam video at EUR 99 goes through the same pay-init path with a different Dodo product id. Every fix above must cover both, and the EUR 99 SKU carries more than three times the refund exposure per incident.

15. The EUR 29 price is displayed to EU consumers with a ruble symbol. The back end returns a currency field for exactly this reason and documents that on the EUR instance the historically-named price_rub field carries euros. prototype/script.js defines a currency-aware formatter, window.GBMoney, for exactly this reason too. prototype/song/index.html — the page that carries the price, the CTA and the whole pre-contractual description for the EUR 29 SKU — uses neither: it hard-codes ₽ in six places, in the pay button, the promo line and the "что это" strip. prototype/clip/index.html (EUR 99) does call GBMoney.fmt, so the bug is confined to the main SKU, which makes it easy to miss and easy to fix. Consequences: no valid total price under CRD Art. 6(1)(e); a misleading action on price under UCPD Art. 6(1)(d); §2 of this document asserts "EUR 29, VAT included" about a page that says otherwise; and the Art. 8(2) button fix in item 3 touches the same line, so ship them together. This belongs immediately after item 2 in cost order.

16. The MP3 download is gated behind sign-in, and nothing disclosed that. prototype/song/index.html renders the download control with display:none and maybeRecommendAuth() reveals it only after /api/me/songs succeeds; the anonymous buyer's only route is "забрать трек себе" via Telegram or email. So a consumer can pay, stream the full track, and still not be able to take the file away without surrendering a contact. Three separate problems: an undisclosed access restriction under CRD Art. 6(1)(r)/(s); a GDPR question about whether the contact is necessary for performance (Art. 6(1)(b)) or is list-building dressed as delivery (Art. 7(4)); and the fact that it hollows out §10's advice to download your files. §9 has been rewritten to disclose it; disclosure is the minimum, not the fix.

17. The "English interface" is partial. prototype/i18n/en.json carries 58 interface strings and every page ships <html lang="ru">, with t() falling back to the Russian baked into the markup. Whatever else that is, it is not an English purchase path. It matters here because the Art. 8(2) button label, the Art. 16(m) consent string and the Art. 11a control labels have to be correct in the language the consumer actually transacts in, and because §9 of this document claimed the interface "is available in Russian and English". Toned down; verify what is really covered before publishing any claim about language.

18. Prices are mutable settings, not constants. song_price_eur and clip_price_eur are admin settings (defaults 29 and 99), and promo codes and a discount percentage sit on top. Any published document that hard-codes EUR 29 / EUR 99 will drift out of true silently, and a price in a published policy that differs from the price at checkout is its own Art. 6(1)(e) problem. Decide whether the policy states prices at all, or points at the checkout.

Annex D — open questions

Facts that are genuinely missing. None has been guessed at anywhere in this draft.

1. Geographical address and telephone number for the trader, as required by CRD Art. 6(1)(c), plus a separate complaints address if it differs (Art. 6(1)(d)).
2. The exact Dodo Payments legal entity name and registered address, taken from the merchant agreement, for §1 and for the checkout.
3. Is Dodo a principal/reseller or a disclosed agent? This decides who the trader is and who owes every duty in this document. Take it from the merchant agreement, not from the invoice.
4. What does Dodo's checkout actually render? Specifically: does it show an Art. 8(2)- compliant order button; does it send an Art. 8(7) durable-medium confirmation; can it carry a custom Art. 16(m) consent string; and does it expose an Art. 11a withdrawal function? If the answer to any of these is no, Gigapop must supply it before payment, on its own pages.
5. How long will purchased songs stay hosted and downloadable? Needed for §10, and required pre-contractually from 27 September 2026 under CRD Art. 6(1)(lc). Recommendation: 24 months.
6. Is either party subject to an ADR scheme? CRD Art. 6(1)(t) only requires disclosure where the trader is subject to one.
7. Who owns refund execution operationally, and within what internal turnaround, so the 14-day statutory clocks in CRD Art. 13(1) and DCD Art. 18(1) are never at risk?
8. Will the free preview always be offered before payment? §8.1 leans on the preview as the DCD Art. 8(1)(b) trial version. If a purchase path ever exists without a preview, the conformity analysis for that path is different and weaker.
9. Is an age gate needed at checkout? Not a refunds question as such, but the existing Russian Terms set a floor of 14, and the age at which a minor can validly contract varies by Member State. Flagged so it is not lost between documents.
10. Which Russian text is authoritative? The audience is Russian-speaking and the interface defaults to Russian, so the Russian version will be the one nearly every customer reads. Under CRD Art. 6(7) Member States may impose their own language requirements. Decide which language governs, and have the Russian translated by someone who can keep the statutory wording intact — especially the Art. 16(m) string and the Art. 11a labels, where the wording is prescribed rather than descriptive.
11. Is the free account a contract in its own right? The consumer supplies personal data rather than a price, which since Directive (EU) 2019/2161 can bring the arrangement within CRD Art. 3(1a) and DCD Art. 3(1) unless the data is processed exclusively to supply the service or to meet legal requirements. If it is in scope, it needs its own pre-contractual information, its own withdrawal treatment (the Art. 16(m) conditions are framed around a contract with an obligation to pay) and its own conformity analysis — none of which exists in any document today. Answer this against what the Privacy Policy says the data is actually used for, not against what the account "feels like". See §2.
12. Is the sign-in gate on the MP3 download necessary to perform the contract? If yes, GDPR Art. 6(1)(b) carries it and §9's disclosure is enough. If the real purpose is retaining a contact for later use, it is neither necessary nor freely consented to, and the gate should come off for the person who has just paid. This is a product-and-privacy decision, not a drafting one, and it has to be answered the same way in this document, the Privacy Policy and the checkout. See Annex C, item 16.
13. Do the authorities cited actually say what this draft says they say? Above all C-234/25 Sky Österreich Fernsehen in §2 — pull the judgment, check the ECLI, the date and the operative part, and check whether the quoted formulation survives in the terms used here. The classification of the paid unlock as digital content, the availability of the Art. 16(m) waiver, and therefore the entire immediate-delivery model, rest on it. Same exercise for the Commission Guidance section numbers, Recital 37 of Directive (EU) 2023/2673, Recital 30 of Directive (EU) 2019/2161, the Art. 6(1)(la)/(lb)/(lc) descriptions in §16, and the post-withdrawal consumer obligation flagged in §6.
14. Who owns the currency-display fix, and by when? It is a small code change (prototype/song/index.html → window.GBMoney with the currency field the API already returns), it must ship in the same change as the Art. 8(2) button label, and until it does, nothing in §2 of this document can be published as written. See Annex C, items 3 and 15.