1. Controller and scope
Lars Anlauf, Clemensstraße 7, 80803 München, Germany. Email: [email protected]. This notice covers the supplied Sound Paintings Archive and Sound Lab. It describes the Netlify hosted-edition profile; an offline copy does not send hosting requests. Third-party destinations have their own privacy notices.
2. Current Sound Lab v2.7 data behavior
The current public Sound Lab uses synthesized starter sounds and keeps the editable pattern, mute state, tempo, grid, groove and in-session album drafts in page memory. It does not request microphone access, does not expose audio-file import or recording, and does not upload musical content to the operator, an AI provider or a cloud account.
The current Lab does not create an account, public gallery, analytics profile, contact form, cookie preference or application-level user database. It does not write Sound Lab drafts to cookies, localStorage or IndexedDB. Reloading or closing the page therefore discards those in-memory drafts. Normal browser caching of static site files is controlled by the browser and hosting layer.
The codebase contains a technical adapter for a possible future licensed ten-slot sample pack, but that adapter is not a user upload service and no third-party sample pack is bundled in this release. If microphone recording, user file import, cloud saving or analytics are added later, this notice and the site permissions must be reviewed before that feature is published.
3. Website delivery and hosting logs
In the supplied hosted-edition profile, Netlify, Inc. delivers the static pages and assets. Connecting to a website necessarily discloses connection information, including the IP address, request time, requested URL, browser/user-agent and technical response data. This is separate from the audio processed locally. The purpose is reliable delivery, troubleshooting, security and abuse prevention; the legal basis is Article 6(1)(f) GDPR.
Operational connection data is kept for as long as necessary for those purposes and the hosting provider’s documented operational retention periods; security incidents or legal requirements may justify longer retention. This package does not enable a separate analytics log or an application-level user database. The operator can provide the retention information applicable to the deployed hosting account on request.
Netlify and its subprocessors may process connection data outside the EEA, including in the United States. The appropriate contractual transfer safeguards must be part of the operator’s hosting agreement, including Standard Contractual Clauses where applicable. See Netlify’s privacy policy and data-protection information. Sound Lab patterns and synthesized audio are not sent to the hosting provider as application content; normal website connection data still applies as described above.
4. Domain resolution
The operator’s existing domain uses Cloudflare for DNS. When this project is served under that domain, the DNS infrastructure may process the technical queries needed to locate the website. This notice does not assume Cloudflare proxies all web traffic. For a standalone Netlify subdomain, the hosting provider’s domain-resolution infrastructure applies. If a different host, DNS service, proxy or monitoring service is used, this notice must be adapted before publication.
5. Optional Spotify player — archive only
The Lab has no Spotify audio access. On the archive page, the Spotify iframe is absent until you choose Allow Spotify & load player. Ordinary external links do not intentionally load a player or contact the linked provider before you follow them.
Loading the player connects your browser to Spotify AB and its service providers. They receive connection data such as your IP address, requested page and device/browser information, and may use device storage or cookies under their own policies. International processing may occur. See Spotify’s privacy policy. For this optional activation we rely on your consent (Article 6(1)(a) GDPR and § 25 TDDDG where applicable).
Choose Remove player to stop future requests from this embedded player. This cannot undo information already sent or delete cookies under Spotify’s control; use your browser’s privacy controls for that. No player choice is remembered by this site. You can instead use the ordinary “Open on Spotify” link without enabling an embed.
6. Email correspondence
Messages you send to the published address are processed to respond to your request: Article 6(1)(b) GDPR for contractual/pre-contractual enquiries, or Article 6(1)(f) GDPR for other correspondence. Emails are deleted when no longer necessary, subject to applicable retention obligations. Do not send medical, financial or other sensitive information in an audio example.
7. Your rights
Subject to applicable requirements, you can request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. Consent may be withdrawn for the future. The operator cannot remotely delete files kept solely on your device or sessions you shared independently.
You can complain to a data-protection supervisory authority. For this private-sector operator in Bavaria, the usual authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
There is no automated decision-making with legal or similarly significant effects and no application-level profiling. The current v2.7 Lab does not request microphone or file-import permission.
Last reviewed: 8 September 2026 for the Sound Lab v2.7 Netlify deployment profile. Live DNS, account-level retention and contractual settings still require operator verification after deployment.