Transparent, auditable data handling standards for Mindbreakz Audio Engineering.
1. Data Controller (Art. 4(7) GDPR)
Mindbreakz Audio Engineering
Author & Controller: Lars Zahl
Schulstraße 28, 68766 Hockenheim, Germany
Email: info@mindbreakz.com
2. Legal Bases for Processing (Art. 6(1) GDPR)
- Art. 6(1)(b) GDPR (Contractual Performance): Processing user account credentials, audio file uploads, and mastering DSP processing parameters to render master outputs requested by you.
- Art. 6(1)(c) GDPR (Legal Obligations): Invoicing and financial order audit data stored under commercial and tax retention statutes.
- Art. 6(1)(f) GDPR (Legitimate Interests): Rate limiting, brute-force defense, anti-scraping tokens (10-min TTL), and cryptographic SHA-256 verification receipts to guarantee service availability and integrity.
- Art. 6(1)(a) GDPR (Consent):With your consent, we measure page views, page transitions and active time to improve Mindbreakz. Disable this at any time in Cookie Settings. When signed in, we link these statistics to your account; authorized Mindbreakz admins can see your email address, visited areas and active time.
Optional visit statistics
With your consent (Art. 6(1)(a) GDPR), we store page categories, page transitions and active time on our IONOS infrastructure in Germany. Random session and page identifiers are hashed on the server; the session identifier is kept in browser session storage. Hidden or unfocused tabs and inactivity after 60 seconds do not count as active time. When signed in, we link these statistics to your account; authorized Mindbreakz admins can see your email address, visited areas and active time. We use your account ID only for new visits after this consent. Earlier anonymous visits remain anonymous. No tracking across other websites. Retention: 30 days with automatic hourly cleanup. Withdrawing consent in Cookie Settings stops measurement and deletes the current session data.
Regardless of this choice, we count public page requests on the server as daily totals by area, including requests without analytics consent. This analysis stores no IP addresses, accounts, session identifiers or full URLs, links no requests and identifies no individual visitors. Bots, internal requests and repeats may be included. The basis is our legitimate interest in a data-minimised reach overview (Art. 6(1)(f) GDPR); no additional access to your device and no external analytics services. Totals are retained for 30 days.
3. Audio Processing & Subprocessor Sovereignty (Art. 28 GDPR)
Direct stereo mastering: Audio is processed on Mindbreakz hosting and GPU infrastructure at IONOS in Germany. New mastering requests do not send audio to Fadr or any other stem-separation service. For older Fadr-processed projects, deletion of provider-held copies remains unconfirmed. Payment processing uses Stripe; account emails use IONOS mail.
4. Storage & Automated Retention Erasure (Art. 5(1)(e) & Art. 17 GDPR)
- One-time packages: Purchased master downloads remain available according to the retention period shown for the purchased package.
- Pro Studio: Masters are archived in the user's secure Cloud Vault during an active subscription.
- Legacy purchases: Previously acquired credits and subscriptions retain the storage terms agreed at the time of purchase.
Legal declarations and customer requests
We store the accepted terms version, its document hash and timestamp, and processing-rights declarations linked to your account, project and uploaded file. Rights reports, withdrawal and cancellation declarations include your supplied contact details, identified content or contract and receipt time. We use these records to perform contracts, meet legal obligations and establish or defend legal claims (Art. 6(1)(b), (c) and (f) GDPR as applicable). Legal-request correspondence may remain after account deletion where needed for those purposes. Access is limited to the operator and necessary service providers. Such records are reviewed for deletion when the purpose and applicable retention or limitation periods end.
5. Your Rights as a Data Subject (Art. 12–22 GDPR)
- Right of Access (Art. 15 GDPR): Self-service export of all personal data, audio metadata, and billing records as machine-readable JSON via your Account Settings.
- Right to Rectification (Art. 16 GDPR): Direct editing of profile details, artist names, and operational mode in Account Settings.
- Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Account deletion in Account Settings removes account-linked profile, project and audio data from Mindbreakz, subject to technical completion and lawful retention. It does not automatically cancel subscriptions or delete Fadr-held copies; use the subscription cancellation function as well.
- Right to Data Portability (Art. 20 GDPR): Structured, machine-readable JSON data export.
- Right to Withdraw Consent (Art. 7(3) GDPR): Ability to change or revoke cookie preferences at any time.
6. Competent Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our headquarters is:
State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Phone: +49 (0) 711 615541-0 · Web: www.baden-wuerttemberg.datenschutz.de
