Privacy Policy

1. Privacy at a glance

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Details are in the sections below.

Data processing on this website is carried out by the website operator. Contact details are in the “Controller” section. Some data is provided by you (for example your email when you buy). Other data is collected automatically by our IT systems when you visit, such as browser type, operating system or time of the request.

2. Controller

Joshua Hahn, Waldsteinweg 2, 95126 Schwarzenbach a. d. Saale, Germany, lowcutlabs@gmail.com.

3. Hosting

This website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA. When you visit the site, personal data such as your IP address, browser type and the pages requested are processed on Netlify servers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliable presentation of the website). Netlify privacy: https://www.netlify.com/privacy/

When you start a beat preview we store only the beat ID and a timestamp server-side (no plain IP, no assignment to you). Purpose: demand per beat. Legal basis: Art. 6(1)(f) GDPR.

4. Payments – Stripe

Payments are processed by Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. Payment data (card, Apple Pay, PayPal and similar) is sent directly to Stripe. Legal basis: Art. 6(1)(b) GDPR (performance of the contract). Stripe privacy: https://stripe.com/privacy

For payouts to external producers we use Stripe Connect. Bank and identity data is exchanged between the producer and Stripe. Lowcut Labs only receives the technical connection status, not full bank details.

Checkout requires a billing address. We store the buyer country from that address with the order so we can apply the correct VAT treatment (small-business exemption under § 19 German VAT Act) and meet record-keeping duties.

5. Email – Resend

Transactional emails (order confirmation, download links, withdrawal acknowledgement) are sent via Resend. Legal basis: Art. 6(1)(b) and (c) GDPR.

6. File storage – Cloudflare R2

Digital products (beat files) are stored with Cloudflare and delivered via time-limited download links. Legal basis: Art. 6(1)(b) GDPR.

7. Database – Neon

Order, account and analytics data is stored in a Postgres database operated by Neon in an EU region. Order and analytics data therefore does not leave the EEA for that storage.

8. Freebeat downloads and leads

If you request a freebeat we process the email address and related order data to send the files and the licence. Legal basis: Art. 6(1)(b) GDPR.

9. First-party analytics

Our own analytics runs only after you accept all cookies in the cookie banner. It does not store a plain IP address. You can withdraw consent at any time via “Cookie settings”.

10. Google Analytics

Google Analytics is used only with your consent via the cookie banner (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

11. Cookies and local storage

Technically necessary storage includes cart contents, cookie consent, language choice (kpb-locale, 12 months) and a short-lived marker for the automatic language notice (kpb-locale-auto, 5 minutes). Saved beats (likes) are stored locally on your device. Analytics and marketing cookies are set only after consent.

12. Storage period

We keep personal data only as long as needed for the stated purposes or as required by commercial and tax law.

13. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent. To exercise these rights contact lowcutlabs@gmail.com.

14. Right to lodge a complaint

You may lodge a complaint with a data-protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

15. Producer data (marketplace)

If you apply as a producer or operate a producer account we process the data needed for onboarding, payouts via Stripe Connect, tax documentation and the public profile you choose to show.

16. Electronic withdrawal function (§ 356a BGB)

If you use the electronic withdrawal form we process the data you enter (order number, email, name, declaration) to receive, acknowledge and handle the withdrawal. Legal basis: Art. 6(1)(b) and (c) GDPR.

17. Transfers to third countries

Some processors are based in the USA or process data outside the EEA: Netlify (hosting), Stripe (payments), Resend (email), Cloudflare (file delivery) and Google (Google Analytics, if consented).

Where the company is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Otherwise we rely on the Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the processor agreements.

In third countries the level of protection may not be equivalent to EU law; authorities there may under certain conditions access data, and enforcing your rights may be more difficult.

Our database (Neon) runs in an EU region. Order and analytics data does not leave the EEA for that storage.

18. Language of the website

The site is available in German and English. To show the matching version on a first visit we use the country of your internet access as derived by our host Netlify from your IP address, and the language preference sent by your browser (Accept-Language). The IP address itself is not stored for this purpose – only the derived country code is evaluated during the request.

Your language choice is stored in a technically necessary cookie (kpb-locale, 12 months) so the site does not switch again on later visits. A second, short-lived cookie (kpb-locale-auto, 5 minutes) only controls that the notice about an automatic language switch appears once.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a comprehensible presentation of the site). Storing the language choice is strictly necessary for the service you requested and is therefore exempt from consent under § 25(2) no. 2 TDDDG. You can change the language at any time with the switcher in the header.

19. Changes to this policy

We may update this privacy policy if the law or our processing changes. The current version is always available on this page.