Privacy Policy

Privacy Policy

Protecting your personal data is important to us. We process your data exclusively on the basis of applicable law (GDPR, applicable national legislation).

Controller

Steffen Janssen
House U10, Toscana Hills, Poumboulinas Street 8873
Argaka, Polis, Cyprus
Email: [email protected]

Data We Collect and Why

Registration and User Account

When you register, we collect your name, email address, and an encrypted password. This data is required to provide your user account and platform features (Art. 6(1)(b) GDPR).

Uploaded Content

Audio files, images, and metadata you upload to LUMETRAX are stored on our servers and processed for display on the platform. By uploading, you confirm that you hold the necessary rights to the content.

Usage Data and Logs

When you access our platform, technical data (IP address, browser, timestamp) is recorded in server logs. This data is used for security and error analysis and is deleted after 30 days (Art. 6(1)(f) GDPR).

Cookies

We use only technically necessary cookies for operating the platform (session management, authentication). These cookies are required for the platform to function and cannot be disabled. We do not use any tracking or marketing cookies.

Data Retention

Your data is stored only as long as necessary for providing our services or as required by law. After account deletion, your personal data will be removed within 30 days, unless statutory retention obligations apply.

Your Rights

You have the right to:

• Access the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

To exercise your rights, please contact us at: [email protected]

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection authority. The supervisory authority in Cyprus is the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).

Third-Party Service Providers

To operate our platform, we use the following third-party service providers. All providers process data in accordance with GDPR:

• Supabase Inc. (database hosting) — Data stored in the EU (eu-central-1, Frankfurt, Germany). Privacy policy
• Cloudflare Inc. (media storage via Cloudflare R2) — Audio files and images. Certified under the EU-U.S. Data Privacy Framework. Privacy policy
• Resend Inc. (transactional email) — Used to send account confirmation and notification emails. Only your email address is transmitted. Privacy policy
• Stripe Inc. (payment processing, if applicable) — Processes payment data independently. Privacy policy

We do not share your personal data with any other third parties, except as required by law.

Data Retention

We retain your data only as long as necessary:

• Account data (name, email): For the duration of your account, deleted within 30 days after account deletion.
• Uploaded audio files and images: For the duration of your account, deleted within 30 days after account or content deletion.
• Stream and play statistics: Retained for up to 12 months for royalty calculation, then anonymised or deleted.
• Server logs (IP address, browser, timestamp): Deleted after 30 days.
• Payment records: Retained for 7 years as required by tax law (Art. 6(1)(c) GDPR).

Updates to This Policy

This privacy policy is currently valid. As our platform evolves, updates may be necessary. The current version is always available at /privacy.