Legal information
Privacy policy
This notice explains which personal data is processed when you use this website and how you can exercise your rights.
Controller and contact
The controller is Michael Akischin, Michael Nox Studio, c/o POSTFLEX PFX-274-666, Emsdettener Straße 10, 48268 Greven, Deutschland. For privacy requests, contact webmaster@michael-nox.com.
Website hosting and server logs
Hosting is provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Connection data such as IP address, request time, requested page and browser information is processed to deliver and secure the website. Error and security events may be logged to investigate faults or abuse. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in reliable and secure operation. Logs are needed for fault diagnosis and investigation of security incidents; relevant records may need to be retained until an incident or related legal claim is resolved.
Booking form and email communication
The service request form processes the name, email address and information entered about the requested service, project, delivery, notes, file link and any coupon code. The data is used to answer the request, prepare an offer and, if accepted, perform the agreed service. The legal basis is taking steps at the user's request before entering a contract and performing a contract; any additional purpose requires its own legal basis.
Required information and project files
Submitting an inquiry is voluntary and does not itself place a binding order. Required fields are needed to respond and assess the project; without them the online form cannot be submitted. Linked audio files are accessed to review or perform the requested service. Your chosen file-sharing provider processes uploads under its own terms; share only files you are entitled to disclose. We do not make decisions with legal or similarly significant effects solely by automated processing.
Form draft in this browser
While the service request form is being filled in, its current values are stored in this browser tab's sessionStorage so a reload does not immediately erase them. The stored fields are service type, stem count, analog processing, delivery time, name, notes, file link, email, email confirmation and coupon code. This browser storage is not sent to the server until the form is submitted and is normally cleared when the tab session ends or after a successful submission.
Cloudflare Turnstile
The service request page uses Cloudflare Turnstile to reduce automated abuse. The Turnstile script is loaded when that page is opened, and the resulting verification is sent to Cloudflare; the server validates the response with Cloudflare. Connection and device data needed for the check, including the IP address, may be processed. Cloudflare states that Turnstile does not access, store or transmit form entries or other page inputs. The legal basis is the legitimate interest in protecting the form and service against abuse.
Email inbox: mailbox.org
Our business mailboxes use mailbox.org, operated by Heinlein Hosting GmbH in Germany. Email addresses, message contents, attachments and delivery metadata are processed for correspondence and project handling under Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for other inquiries. Incoming studio copies of website requests are also stored in this mailbox.
Transactional email
Automated request confirmations and project messages are sent through Twilio SendGrid. Sender and recipient addresses, message contents and delivery metadata are processed for this purpose. Our application records recipient, subject, timestamp and delivery status for troubleshooting. The legal bases are Art. 6(1)(b) GDPR for requested project communication and Art. 6(1)(f) GDPR for reliable delivery and fault diagnosis. We explicitly disable SendGrid open tracking, click tracking and Google Analytics tracking for these messages. Processing may take place in the USA; Twilio describes transfer mechanisms, including standard contractual clauses, in its Data Protection Addendum.
Payment processing
The website does not currently process online payments. Project scope, payment method, and timing are agreed individually by email. No card or bank payment details are collected by this website. If an online payment provider is introduced later, this notice will be updated before it is used.
Analytics and cookies
Optional analytics and external media require your consent under Art. 6(1)(a) GDPR and, for optional storage or access on your device, section 25(1) TDDDG. Rejecting them leaves the inquiry form available. You can withdraw or change your choice using Cookie settings in the footer; withdrawal does not affect processing lawfully carried out beforehand. Necessary consent, language and security functions rely on section 25(2)(2) TDDDG where strictly necessary for the requested service, and Art. 6(1)(f) GDPR for operating and securing it.
Website statistics
After analytics consent, our own statistics record interaction types and project-related events, such as starting or submitting an inquiry, service selection and coupon usage. These events can include an internal booking reference. They are processed on our server; the current statistics store is held in application memory and is cleared when the application restarts. Older events are filtered out under the configured retention rule. This statistics store does not retain IP addresses, referrers, browser fingerprints or persistent visitor identifiers.
Google Analytics
Google Analytics, provided by Google Ireland Limited, is loaded on public information pages only after analytics consent. It measures page views and selected interactions using browser and device information and cookie identifiers. Our integration excludes private offer and review links and form pages, omits URL query strings and does not send form entries or coupon codes to Google. Advertising personalization and Google Signals are disabled in our integration. Google may process data outside the EEA, including in the USA. Google's privacy and transfer information and cookie documentation are linked below.
External reference players
Reference players, for example from Spotify AB in Sweden, are blocked until you consent to external media. Once enabled, the provider receives connection information such as your IP address, browser information and the requested content. If you are signed into the provider, it may associate use with your account. Providers may use cookies or similar technologies and process data internationally under their own policies. Withdrawing consent blocks further embeds on subsequent page loads; it does not erase data already held by the provider.
Security provider and international processing
Turnstile is provided by Cloudflare, Inc., USA. The legal basis for our security check is Art. 6(1)(f) GDPR. Cloudflare acts as our processor for the website protection check and as an independent controller when using signals to improve its bot detection. Its Turnstile notice describes these purposes and international processing. Where applicable, device access must also meet section 25 TDDDG. If the check prevents an online inquiry, you can contact us by email. For providers outside the EEA, an appropriate transfer mechanism under Art. 44 et seq. GDPR is required in addition to the legal basis for the processing itself. Provider privacy and contractual information is linked here; information on safeguards applicable to your data can also be requested from us.
Cookies and browser storage
AudioServicePlatform.Language stores the manually selected language for six months. AudioServicePlatform.Admin is used only for admin authentication. Short-lived technical cookies are used during Spotify authorization; a temporary site-access cookie is used only while that deployment gate is enabled. The booking form also uses tab-scoped sessionStorage as described above. These functions are separate from analytics and external-media consent.
Recipients and retention
Recipients are the operator and the service providers described above, to the extent needed for their respective functions. No payment provider is integrated for the initial launch. Inquiry data is needed while the inquiry or offer remains open; project data while the project and agreed revisions are handled. After that, retention depends on outstanding claims, evidence needed for their assertion or defence (Art. 6(1)(f) GDPR), and statutory tax or accounting obligations for the relevant documents (Art. 6(1)(c) GDPR). These obligations do not justify retaining every audio file or unrelated message indefinitely. Deletion requests are assessed against these purposes and obligations, including copies in email and backups.
Your rights
Subject to the statutory conditions, you have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR). Under Art. 21 GDPR, you may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time. Consent may be withdrawn at any time for the future (Art. 7(3)). Contact the controller above. Under Art. 77 GDPR you may complain to a supervisory authority, particularly in the member state of your habitual residence, place of work or the alleged infringement.