Privacy

1. Controller

The controller for the processing described here is Dominic Drüseberg, Emser Straße 55, 12051 Berlin, Germany. You can reach us at kontakt@klangbruecke-gate.de.

2. Visiting the website

When you visit Klangbrücke Gate, the technical systems used to deliver and protect the website process connection data such as your IP address, the requested page, date and time, browser and device information. This is necessary to operate the site reliably and securely. The legal basis is our legitimate interest in the secure provision of the service (Article 6(1)(f) GDPR).

To protect the service from misuse, we apply request limits to selected actions such as sign-in-link requests, gate checks and upload preparation. For this purpose, our application stores only a protected, keyed hash of the relevant IP address, email address or authenticated account identifier — never the raw IP address or email address in the rate-limit record. These records are deleted after two days.

3. Contact requests and content reports

If you use our contact or content-report form, we process the details you provide to answer your request or review the report. A content report may include your name, email address, the link you report, the reason for the report and your explanation. The forms send messages to our contact mailbox through Resend; they are not stored in the Klangbrücke Gate application database. The legal basis is our legitimate interest in responding to enquiries, protecting the platform and reviewing potentially unlawful content (Article 6(1)(f) GDPR).

4. Creator access and releases

Creator access is invitation-only. For invited creators, we process the email address, access role, one-time sign-in-link records and session data. Creators may also provide artist names, public social-profile links, campaign details, cover artwork and audio files. We use this information to provide the creator area, publish campaigns selected by the creator and securely deliver the associated files. The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide the requested service, and Article 6(1)(f) GDPR for account and platform security.

5. Download gates and internal analytics

Starting a gate creates a pseudonymous browser session. We store a protected session token, the relevant campaign, the progress of required actions, download authorisations and event timestamps. We use these records to run the gate, prevent misuse, deliver the requested file and show creators aggregated campaign activity such as starts, completed gates and downloads. We do not use advertising pixels or sell personal data.

The gate-session cookie is essential for this process and expires after 24 hours. We do not use advertising or cross-site tracking storage.

6. SoundCloud connection

If you choose to connect SoundCloud, SoundCloud handles the sign-in and permission screen. Klangbrücke Gate never receives your SoundCloud password. We receive and process the SoundCloud account identifier/URN, username, granted scope, token-expiry information and encrypted access and refresh tokens. We use them only to carry out or verify the SoundCloud actions that you specifically initiate in the active gate, such as following, liking or posting a comment. If you post a comment through the gate, its text is sent to SoundCloud and stored with the verification record for that gate session.

After a completed download, the page offers an option to remove the stored SoundCloud connection. This deletes the stored OAuth credentials and the connection-specific verification records for that browser session from Klangbrücke Gate. You can also revoke app access directly in your SoundCloud settings. SoundCloud's own privacy information and terms apply to its service.

7. Optional Spotify and Instagram links

Spotify and Instagram support links are optional. When you choose one, a new tab opens the relevant external service. That provider then processes data under its own privacy policy. Klangbrücke Gate does not receive your login details for Spotify or Instagram and does not verify those actions.

8. Service providers

We use carefully selected service providers to run Klangbrücke Gate. Depending on the feature used, they process data on our behalf or as independent providers:

• Vercel for hosting and technical delivery of the application.
• Neon for the application database.
• Cloudflare R2 for private storage of uploaded audio and artwork.
• Resend for creator invitations, sign-in emails and contact-form messages.
• SoundCloud when you voluntarily connect a SoundCloud account or use its service.

We configure the project to use European regions where available. Some providers may nevertheless process data outside the European Economic Area, for example through global infrastructure or support. Where required, we use an applicable transfer mechanism and appropriate safeguards.

9. Retention

One-time creator sign-in links become unusable after 30 minutes and are deleted seven days after expiry. An unaccepted creator invitation and the associated unused creator account are deleted 90 days after the invitation expired. Expired or revoked creator sessions are deleted after seven days. Protected rate-limit records are deleted after two days.

A gate session, its SoundCloud credentials, verification records (including a comment submitted through the gate) and download grants are deleted no later than 48 hours after that gate session expired. Using the SoundCloud disconnect option deletes the SoundCloud credentials and connection-specific verification records immediately. Download delivery events are retained only as anonymised, campaign-level analytics.

Campaign and artist content is retained while it is active. Unused uploads are scheduled for deletion after 30 days. When an artist profile is deleted, its now-unused uploaded files enter a 30-day recovery window before their permanent deletion from private storage. Aggregated analytics events are deleted after 12 months. Contact requests are not stored in the application database and are deleted manually from the contact mailbox within 12 months after the request is resolved, unless a legal obligation requires longer retention.

10. Your rights

Subject to the legal requirements, you may request access to, rectification, erasure or restriction of your personal data, object to processing based on legitimate interests and request data portability. You may withdraw consent at any time with effect for the future. To exercise these rights, contact us at kontakt@klangbruecke-gate.de.

You also have the right to lodge a complaint with a data-protection supervisory authority. Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.

11. No automated decision-making

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

12. Changes to this notice

We update this privacy notice when the platform or legal requirements change. The version shown on this page is the current one.