Privacy Policy

The legally binding version is the German policy at loading-screen-lounge.com/datenschutz. This English translation is provided for convenience only.

1. Privacy at a Glance

The following notes provide an overview of what happens to your personal data when you visit this website or use the related platform services (shop, in-store player, API, charts, account area).

2. Hosting and Infrastructure

Cloudflare Pages (Frontend)

The static website loading-screen-lounge.com is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). A data processing agreement under Art. 28 GDPR (Cloudflare Data Processing Addendum) is in place. Cloudflare is certified under the EU-US Data Privacy Framework; additionally Standard Contractual Clauses (SCCs) per Art. 46(2)(c) GDPR are in place.

Cloudflare Turnstile (bot protection on forms)

To protect our forms (free download, newsletter, contact, in-store waitlist) from automated abuse we use Cloudflare Turnstile. Turnstile checks technical browser signals (including IP address, browser characteristics and interaction behaviour) to determine whether a request comes from a human and only passes a verification token to us; a puzzle ("captcha") is usually not required. The legal basis is our legitimate interest in a secure, abuse-free operation (Art. 6(1)(f) GDPR). Provider: Cloudflare, Inc. (see above); transfers to the USA rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.

Hetzner Online GmbH (API and Object Storage)

The LSL platform API api.loading-screen-lounge.com, the database, and the object storage (audio files, license PDFs, repertoire certificates) are hosted at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). Data processing agreement under Art. 28 GDPR is in place. Data location: Germany.

3. Responsible Entity

Mignuti Media / Loading Screen Lounge
Eduard Ditler
Pfarrer-Mengesstr. 5, 56112 Lahnstein, Germany
Phone: +49 1556 0926046
Email: info@loading-screen-lounge.com

4. Website Data Collection

Cookies

We exclusively use strictly necessary cookies: after a login we set the session cookie lsl_session (on HTTPS with the __Host- prefix; HttpOnly, SameSite=Lax, 90 days sliding, re-login required after 180 days at the latest) that keeps you signed in to your account. During login via a magic link we briefly set a security cookie lsl_login_csrf (10 minutes, login path only) that prevents cross-site request forgery. Without a login no cookie is set; settings such as volume, saved tracks and the cart live in localStorage. No tracking, analytics or advertising cookies; consent is not required under § 25 (2) TDDDG.

Server Logs

The provider automatically collects information your browser transmits: browser type and version, operating system, referrer URL, hostname, request timestamp, IP address. Data is stored for a maximum of 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Rate Limiting (API protection)

To protect our public API endpoints from abuse, we use pseudonymised rate limiting. Your IP address is SHA-256-hashed; only the hash fragment is kept in memory for at most five minutes. Clear-text IPs are not stored for this.

Contact Form

If you contact us via the form, we store your input (name, email, subject, message, privacy consent). Legal basis: Art. 6(1)(a) GDPR (consent). Retention: up to 24 months unless a legal retention requirement applies.

Favourites, cart and likes (stored in your browser)

Your saved tracks (♥), your cart and the information which tracks you have already hearted are stored exclusively in your browser (localStorage). This storage is necessary for the function you explicitly requested (§ 25 (2) no. 2 TDDDG); no personal data is transmitted to us. You can delete the data at any time in your browser settings.

Anonymous usage statistics ("Popular") and abuse protection

For the "Popular" lists and the charts we count, per track and day, how often a preview was played for at least 10 seconds, a heart was set or a purchase was completed. Only these totals are stored — no user IDs, no cookies. To avoid counting one device several times a day we derive a SHA-256 hash from the IP address, the browser identifier and a secret salt that changes daily; it is deleted after 24 hours and can be turned back into neither the IP address nor the person. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a tamper-resistant popularity display).

Customer account (magic-link login)

You can log in without a password using your e-mail address: we send a one-time login link (15 minutes). In the account we store your e-mail address, the times of creation and last login, your favourites and the purchases associated with your e-mail address (product, licence, amount, date, Stripe session id) so that you can download purchased tracks again. Login links and sessions are stored only as hashes; a session ends after 90 days without use or when you log out. Legal basis: Art. 6 (1) (b) GDPR (performance of contract). You can have the account deleted at any time by e-mailing us.

5. Account Area and Platform Use

In-store device profile

For in-store subscribers we store, per paired device: a random device ID, the name the customer gave it, the platform (browser, Windows, Android, Fire, website, Alexa), the selected music profile and activity timestamps. There is no password login — access runs through the magic link above, and a pairing code binds the device to the subscription. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Play logs

For in-store subscribers we log, per play: track ID, timestamp, device ID and subscription ID. Nothing else — in particular nothing about people in the venue. The logs exist solely for the monthly repertoire certificate and the display in the customer account. Retention: three years (the period the certificate must be provable), then automatic deletion.

Repertoire Certificate

For in-store customers we generate, upon request, a PDF repertoire certificate for submission to collecting societies (GEMA, AKM, SUISA). It contains customer master data, license period, and a work list from the lease logs. Retention: as long as the certificate is valid plus statutory retention period.

In-store player and paired devices (subscribers)

If you use an in-store subscription, you pair playback devices with your account via a 6-digit code. Per device we store the name you assign, the device type (browser, Windows, Android, Fire, website, voice assistant), the app version, the time of the last contact (devices report once a minute while running), whether playback is active, and a play log (title, time, duration per device). Pairing codes are deleted after 10 minutes, device credentials are stored as a hash only; we do not store device IP addresses. Purpose: performance of the contract — limiting playback to the booked number of devices, the day-part programme and the monthly repertoire certificate (Art. 6(1)(b) GDPR). For the certificate we additionally use company and billing address from your Stripe customer record or the licensee details stored in the account. We keep the play log for up to three years after the end of the contract (regular limitation period for collecting-society claims); device data is deleted on unpairing or at the end of the contract.

6. Stripe (Payments)

For payment processing (one-shot sync license, subscriptions) we use Stripe (Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA). During purchases, payment data (e.g. credit-card number, email) is transmitted directly to Stripe. We do not store any credit-card data. Stripe is certified under the EU-US Data Privacy Framework; SCCs are in place. DPA under Art. 28 GDPR signed. For the payment processing itself Stripe acts as a processor; for legally required purposes such as fraud prevention and anti-money-laundering compliance Stripe is an independent controller (see Stripe's privacy policy). Legal basis: Art. 6(1)(b) GDPR.

Download Links

After successful purchase you receive a download link by email. We store: email (for delivery), license information (track, tier, purchase date), the download token (random 32 bytes). Payment records are archived for up to 10 years per § 147 AO, § 257 HGB.

6a. Free Download (Free Licence) and Newsletter

Email capture on free download

When you download a track marked "Free", we collect your email address. The free download is a contract for the supply of digital content in exchange for personal data (§ 327(3) BGB); we send the download link to that address — providing it is necessary to perform the contract (Art. 6(1)(b) GDPR). For accountability we also store the timestamp and version of the Free licence terms you accepted, plus a SHA-256-hashed value of your IP address (Art. 6(1)(f) GDPR in conjunction with Art. 7 GDPR — proof of consent); clear-text IPs are not stored for this. Retention: 24 months from your last activity. Delivery is handled by our processor Resend, Inc.

"Fresh Friday" newsletter (optional)

You receive our weekly newsletter (new free tracks, new arrivals, top tracks, offers) only if you sign up through one of our forms (home page, footer, /newsletter, purchase success page) or the separate, non-pre-selected box during the free download, and confirm via double opt-in. We store your e-mail address, language, sign-up source, time and version of the consent, a hash of your IP address and the time of confirmation as proof of consent. Legal basis: Art. 6(1)(a) GDPR (consent). Consent is voluntary and not a condition for the free download or a purchase (no coupling).

Performance measurement: With your consent we record whether an issue was opened (tracking pixel of the delivery provider), which links were clicked and whether you listen to tracks on our website via a link from the mail (personalised link parameter, stored in your browser for 30 days). We use this data solely to improve the newsletter; it is not passed on to third parties.

Delivery: The e-mails are sent on our behalf by Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (processing under Art. 28 GDPR, EU standard contractual clauses). The subscriber list itself lives in our database at Cloudflare (see section 2).

Unsubscribe: at any time with one click via the link at the end of every e-mail, via the settings page or by writing to info@loading-screen-lounge.com — no login required. After unsubscribing your address remains stored as a suppression entry so it is not re-added by mistake; the lawfulness of processing up to that point remains unaffected. Unconfirmed sign-ups are deleted after 7 days.

In-store waitlist (early access)

If you register for the launch of in-store streaming, you send us your email address and – when chosen via an industry page or plan card – the industry and the plan you are interested in, plus your language. We also store the time, the version of the consent text and a truncated hash of the IP address (no plain text) as proof of consent. The registration is non-binding; no payment obligation arises.

The sole purpose is to notify you of the in-store streaming launch, including the promised early-bird condition (one free month), and possibly to ask about the plan you prefer. The legal basis is your consent (Art. 6(1)(a) GDPR), given via the checkbox in the form. We use a double opt-in: after signing up you receive a confirmation email, and the registration only becomes active once you click the link inside it (valid 7 days). Unconfirmed sign-ups are deleted once the link expires. The waitlist is kept separately from the newsletter – registering does not trigger any newsletter.

Recipients: the data is stored in our Cloudflare database (D1, see section 2); the confirmation email and the launch notification are sent via Resend (see section 8). The operator is notified internally of new registrations (by email, optionally via a messenger such as Telegram or a Slack/Discord webhook); this transmits the email address, industry and plan.

Retention: until withdrawal, at the latest six months after the launch notification. You can withdraw your consent at any time – by replying to one of our emails or writing to info@loading-screen-lounge.com; your entry is then deleted.

6a. Amazon Associates Programme (affiliate links)

On the subscription page we recommend tablets and link to amazon.de for them. These links are marked as "advertising" and are part of the Amazon Associates Programme (Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg): if you buy there after clicking, we receive a commission — the price does not change for you. No data is collected and nothing is loaded from Amazon on our site; only when you click do you leave our website, and Amazon sets a cookie on amazon.de to attribute the purchase. The legal basis for the link is our legitimate interest in financing the service (Art. 6(1)(f) GDPR). Details on data processing at Amazon: Amazon privacy notice.

7. Audio Content and AI Notice

The audio repertoire provided through Loading Screen Lounge was produced on behalf of and under the responsibility of LSL using generative audio models from Suno, Inc. (1209 Orange Street, Wilmington, DE 19801, USA) under a commercially licensed Pro tier. Suno does not process personal data of LSL platform end users during repertoire creation; generation happens only between LSL and Suno, before the finished repertoire is distributed via LSL.

8. Data Processors — Overview

We have agreements per Art. 28 GDPR with the following providers:

  • Cloudflare, Inc. (USA) — static website hosting, CDN, DNS, and the D1 database (download tokens, the email leads captured on free download, customer accounts, purchases, newsletter, in-store waitlist, anonymous usage statistics) and Cloudflare Turnstile (bot protection on forms). EU-US DPF + SCCs.
  • Hetzner Online GmbH (Germany) — API servers, object storage for audio and PDF certificates. DPA under German law.
  • Stripe, Inc. (USA) — payment processing, subscription management. EU-US DPF + SCCs.
  • Resend, Inc. (USA) — transactional emails (order confirmation, download link, certificate reminders). DPA and SCCs.
  • Suno, Inc. (USA) — AI model for generating the audio repertoire (not LSL-user data). EU-US DPF + Service Terms.

External uptime monitoring (Better Stack, if active) processes only aggregated service status data without reference to end users.

9. Your Rights (Art. 15–22 GDPR)

You have the right to:

  • Access your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Withdraw given consents (Art. 7(3) GDPR)

To exercise these rights, contact info@loading-screen-lounge.com. We respond within 30 days per Art. 12(3) GDPR.

10. Retention Periods — Overview

  • Contact requests: in the mailbox, up to 24 months (not stored in the database)
  • Purchase records: 10 years (German tax law); on account deletion the e-mail is replaced by a pseudonym
  • Download links: 7 days from issue, at most 5 downloads each
  • Free-download leads (e-mail): 24 months from last activity
  • Newsletter: until you unsubscribe; unconfirmed sign-ups after 7 days
  • Newsletter delivery log (open/click per issue): removed on unsubscribe or account deletion
  • Customer account and login links: account until deletion, login link 15 minutes, session at most 180 days
  • Play logs (in-store): 3 years
  • Paired devices: until unpaired; pairing codes 10 minutes
  • Waitlist: up to 12 months
  • Abuse-protection counters (hashed identifier, no clear-text IP): 1 hour to 1 day
  • Internal log of administrative actions: 12 months
  • Server logs at Cloudflare: per their policy, typically 30 days
  • Repertoire certificates: not stored — generated from the play log when requested

11. Automated Decision-Making and Profiling

No automated decision-making with legal effect per Art. 22 GDPR takes place. Track recommendations (/api/recommendations) are based on aggregated genre/mood matching and influence neither prices nor contract conditions.

12. Third-Country Data Transfers

Transfers of personal data to the USA (Stripe, Cloudflare, Resend, Suno) take place exclusively on the basis of the EU-US Data Privacy Framework (EU Commission adequacy decision of 10 July 2023) and additionally per Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

Last updated: September 2026