1. Data Controller (Art. 4(7) GDPR)

Mindbreakz Audio Engineering
Author & Controller: Lars Henning Zahl
Schulstraße 28, 68766 Hockenheim, Germany
Email: info@mindbreakz.com

2. Legal Bases for Processing (Art. 6(1) GDPR)

• Art. 6(1)(b) GDPR (Contractual Performance): Processing user account credentials, audio file uploads, and mastering DSP processing parameters to render master outputs requested by you.
• Art. 6(1)(c) GDPR (Legal Obligations): Invoicing and financial order audit data stored under commercial and tax retention statutes.
• Art. 6(1)(f) GDPR (Legitimate Interests): Rate limiting, brute-force defense, anti-scraping tokens (10-min TTL), and cryptographic SHA-256 verification receipts to guarantee service availability and integrity.
• Art. 6(1)(a) GDPR (Consent): Optional anonymous performance diagnostics and client-side telemetry. Consent can be revoked at any time via Cookie Settings.

3. Audio Processing & Subprocessor Sovereignty (Art. 28 GDPR)

Mastering and Fadr cloud separation: Mindbreakz hosts its web service and GPU mastering on IONOS infrastructure in Germany. Each mastering request sends the uploaded source mix to the external provider Fadr for stem separation before mastering and downloads the resulting stems to Mindbreakz. Provider-side deletion has not been confirmed; do not assume that deleting a Mindbreakz project removes copies held by Fadr. Payment processing uses Stripe; account emails use IONOS mail.

4. Storage & Automated Retention Erasure (Art. 5(1)(e) & Art. 17 GDPR)

• One-time packages: Purchased master downloads remain available according to the retention period shown for the purchased package.
• Pro Studio: Masters are archived in the user's secure Cloud Vault during an active subscription.
• Legacy purchases: Previously acquired credits and subscriptions retain the storage terms agreed at the time of purchase.

Legal declarations and customer requests

We store the accepted terms version, its document hash and timestamp, and processing-rights declarations linked to your account, project and uploaded file. Rights reports, withdrawal and cancellation declarations include your supplied contact details, identified content or contract and receipt time. We use these records to perform contracts, meet legal obligations and establish or defend legal claims (Art. 6(1)(b), (c) and (f) GDPR as applicable). Legal-request correspondence may remain after account deletion where needed for those purposes. Access is limited to the operator and necessary service providers. Such records are reviewed for deletion when the purpose and applicable retention or limitation periods end.

5. Your Rights as a Data Subject (Art. 12–22 GDPR)

• Right of Access (Art. 15 GDPR): Self-service export of all personal data, audio metadata, and billing records as machine-readable JSON via your Account Settings.
• Right to Rectification (Art. 16 GDPR): Direct editing of profile details, artist names, and operational mode in Account Settings.
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Account deletion in Account Settings removes account-linked profile, project and audio data from Mindbreakz, subject to technical completion and lawful retention. It does not automatically cancel subscriptions or delete Fadr-held copies; use the subscription cancellation function as well.
• Right to Data Portability (Art. 20 GDPR): Structured, machine-readable JSON data export.
• Right to Withdraw Consent (Art. 7(3) GDPR): Ability to change or revoke cookie preferences at any time.

6. Competent Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our headquarters is:
State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Phone: +49 (0) 711 615541-0 · Web: www.baden-wuerttemberg.datenschutz.de