Privacy Policy

4.1 Server Log Files

Each time you access our website, the following data is automatically collected by the web server:

• •IP address of the requesting device
• •Date and time of access
• •Name and URL of the requested page
• •Amount of data transferred
• •Browser type and version
• •Operating system
• •Referrer URL (previously visited page)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring smooth operation and security). Data is deleted after 30 days.

4.2 Registration and User Account

When you create a user account, we collect:

• •Name
• •Email address
• •Password (stored encrypted)
• •Phone number (optional, for notifications)
• •Profile picture (optional)
• •Notification preferences

Legal basis: Art. 6(1)(b) GDPR. Data is stored for the duration of the contractual relationship and thereafter in accordance with statutory retention periods.

4.3 Identity Verification (KYC)

To enable payouts of earnings, identity verification is required. We collect:

• •First and last name
• •Date of birth
• •Country and postal address
• •Business details (company name, registration number, VAT number) for business accounts

Legal basis: Art. 6(1)(b) and (c) GDPR (contract performance and legal obligations, in particular tax reporting requirements). Data is stored for up to 10 years per Section 147 of the German Fiscal Code.

4.4 Music Distribution

In the context of music distribution, we process:

• •Artist name and release metadata
• •Audio files and cover artwork
• •ISRC and UPC codes
• •Revenue and streaming data
• •Payout information (e.g. PayPal email)

As part of distribution, your release data is transmitted to the music platforms you select (e.g. Spotify, Apple Music, YouTube Music, Amazon Music, Deezer). These stores process the data as independent controllers. We recommend reading their respective privacy policies.

Legal basis: Art. 6(1)(b) GDPR.

5.1 Technically Necessary Storage

The following data is stored without consent as it is strictly necessary for operation (Section 25(2) TDDDG):

5.2 Analytics Cookies (Consent Required)

The following cookies are only set with your express consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR):

You can withdraw your consent at any time via "Cookie Settings" in the footer. Withdrawal does not affect the lawfulness of prior processing.

6.1 Description and Scope

We use PostHog, a web analytics service operated on servers within the EU (hedgehog.bbn.music). No personal data is transferred to third countries.

With your consent, PostHog processes: pseudonymous user ID, page views and click behavior, browser type, OS, screen resolution, referrer URL, IP address (for geolocation), and performance metrics.

6.2 Session Recording

With your consent, we record mouse movements, scroll behavior, click events, and DOM snapshots.

6.3 Identification of Logged-in Users

If you are logged in and have consented, we link your analytics data with your user ID, email address, username, and administrator status. Without consent, no identification takes place.

6.4 Legal Basis and Withdrawal

Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. The PostHog SDK is only loaded after your consent. Withdraw at any time via "Cookie Settings" in the footer.

6.5 Data Processing Agreement

We have concluded a data processing agreement (DPA) with PostHog Inc. in accordance with Art. 28 GDPR. PostHog processes data exclusively on our behalf and according to our instructions.