Privacy

Controller

Responsible for data processing on Lataloop:
Stephen Mitchell
c/o flexdienst – #21659
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Germany
E-Mail: contact@stevemitchell.music

Hosting and server logs

This site is hosted on servers operated by Hetzner Online GmbH in Germany. When you visit, the web server processes your IP address, user agent, and request timestamps in server logs for operating and securing the service (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Logs are retained for 7 days. DNS for this domain is provided by Cloudflare, Inc., which also stores and serves the application downloads.

Anything you send us is stored in a single database on that server. It is backed up daily to Cloudflare R2, encrypted before it leaves our server with a key we do not share with them, so the backups are unreadable to whoever stores them. Backups are kept for 30 days and then deleted.

Contact form and email

If you use the contact form, we process the details you provide (name, email address, message) to answer your enquiry (legal basis: Art. 6(1)(b) or (f) GDPR). Messages are stored on our own server at Hetzner rather than passed to a third-party helpdesk, and are retained for 12 months. If you email us instead, our mail provider is Proton AG (Switzerland).

Launch waitlist

If you ask to be told when we launch, we store your email address for that one purpose on the basis of your consent (Art. 6(1)(a) GDPR). It is held on our own server at Hetzner and kept until 30 days after the product launches, then deleted. We will send you one message asking you to confirm the subscription; if you do not confirm, you will receive nothing further. You can withdraw consent at any time by emailing us, which does not affect processing carried out beforehand.

Purchases

Purchases are processed by Polar Software Inc. as merchant of record. When you buy a licence, Polar processes your name, email address, and payment details as the contractual seller; we receive the data needed to provision your licence (email address, licence key, product). See Polar's privacy policy: polar.sh/legal/privacy.

Analytics

We use Umami, which we host ourselves on the same German infrastructure as this site. It is cookieless, does no cross-site tracking, builds no profiles, and does not store IP addresses — it records only aggregate counts of pages and a small number of named actions (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, no consent banner is required under § 25 TDDDG. No data is shared with any third party.

Cookies

There are no tracking, profiling or advertising cookies on this site, and nothing here is shared with an advertising network. The site does not use your browser's local storage. One thing can be stored on your device, only because it is needed to give you what you asked for, which is why § 25(2) TDDDG requires no consent banner for it.

If you have been given a preview link to parts of this site that are not public yet, following it sets a cookie that keeps you signed in to that preview for 30 days; it records nothing about you beyond the fact that the link was used.

Your rights

You have the right to access, rectification, erasure, restriction of processing, and data portability. Where processing rests on consent, you may withdraw it at any time with effect for the future.

You have the right to object. Where we process your data on the basis of our legitimate interests — server logs, and the aggregate analytics described above — you may object at any time on grounds relating to your particular situation, and we will stop unless we can show compelling legitimate grounds that override your interests. Email us and it is done.

Nothing here involves automated decision-making or profiling in the sense of Art. 22 GDPR. We build no profiles and make no decisions about you by machine.

You also have the right to lodge a complaint with a data protection supervisory authority — for us, the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Recipients and processors

Processors under Art. 28 GDPR: Hetzner Online GmbH (hosting), Cloudflare, Inc. (DNS, and delivery of application downloads), Proton AG (email), and flexdienst (Matthias Dully, Kaiserslautern), which receives and forwards post sent to the address in our Impressum, together with Polar Software Inc. for licence and activation data. Data processing agreements: all five are in place.

Polar Software Inc. is additionally the merchant of record for the sale itself. In that role it is the seller and a controller in its own right rather than acting on our instructions, and its own privacy policy governs what it does with your purchase.

Transfers outside the EU

Hetzner is in Germany, so its processing involves no transfer at all. Proton AG is in Switzerland, which the European Commission has recognised as providing an adequate level of protection, so no further safeguard is required.

Cloudflare, Inc. and Polar Software Inc. are in the United States, so data does leave the EU. Both transfers are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914/EU), incorporated into their respective data processing terms. Cloudflare additionally certifies under the EU–US Data Privacy Framework.