This Privacy Policy explains how personal data is processed when you use Klangly. It is a draft and should be finalised with a data-protection professional before launch.
1. Controller
The controller responsible for data processing is Tido Schmidt, Alter Postweg 6, 26607 Aurich, Germany, tido.schmidt@googlemail.com. A data protection officer is not required for a business of this size; data-protection enquiries go to the email above.
2. Data we process
- Account data — name, email address, password (stored hashed by our auth provider), role.
- Profile data (creators) — display name, bio, social links, avatar, payout and tax information.
- Purchase data — products purchased, amounts, status, timestamps.
- Payment data — processed by our payment service provider; we do not store full card numbers.
- Usage and technical data — IP address, device/browser information, log data, interactions.
- Communication data — support requests and related correspondence.
3. Purposes and legal bases
- Providing the platform, accounts and purchases — performance of a contract (Art. 6(1)(b) GDPR).
- Payment processing, fraud prevention and security — contract and legitimate interests (Art. 6(1)(b), (f) GDPR).
- Legal and tax retention obligations — legal obligation (Art. 6(1)(c) GDPR).
- Analytics and product improvement — legitimate interests or consent (Art. 6(1)(f), (a) GDPR).
- Marketing emails — consent (Art. 6(1)(a) GDPR), revocable at any time.
4. Processors and recipients
We use external service providers acting as processors, in particular: Supabase (database, authentication, storage), Stripe (payments and payouts), our email/SMTP provider, our hosting provider (Vercel) and error monitoring (Sentry). Where data is transferred to third countries, appropriate safeguards (e.g. EU Standard Contractual Clauses) are used.
5. Cookies and similar technologies
Klangly uses cookies and similar technologies that are technically necessary for operation, and — only with your consent — optional analytics. See the [Cookie Notice](/legal/cookies) for details and to manage your choices.
6. Retention
Personal data is retained only as long as necessary for the stated purposes or as required by statutory retention periods (e.g. tax and commercial law). Account data is deleted after account closure unless retention obligations apply.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority. To exercise your rights, contact tido.schmidt@googlemail.com.
8. Changes
We may update this Privacy Policy to reflect changes in our processing or legal requirements. The current version is always available on this page.