Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Julien Purchess (Waymakers)
Lieselotte-Berger-Straße 72A, 12355 Berlin, Germany
Email: kontakt@waymakersglobal.com

No data protection officer has been appointed.

2. Overview

AltarPad generates all sounds locally in your browser. Audio and your fader settings do not leave your device unless you choose to save a preset in your account. We use cookieless, anonymous usage statistics (see section 9a) and no advertising tools or marketing cookies.

3. Hosting and server log files

This website is hosted on the Lovable platform. When you open the site, the hosting infrastructure automatically processes technical access data, in particular your IP address, the date and time of the request, the requested URL, the amount of data transferred, and browser and operating system information. This is necessary to deliver the site, to keep it secure and to prevent abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website). Log data is deleted by the hosting provider after a short period.

We have a data processing agreement with the hosting provider. Where data is processed outside the European Economic Area, this is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

4. User account

You can use the pads without an account. If you create an account to save presets, we process your email address and your password (stored only as a salted hash, never in plain text). We also process technical data needed to sign you in, such as session tokens, and we send you transactional emails, for example to confirm your address or to reset your password. The legal basis is Art. 6(1)(b) GDPR (providing the account you requested).

The account is operated with the backend service of the Lovable platform (Lovable Cloud, built on Supabase), which acts as our processor. We keep your account data until you delete your account. You can ask us to delete it at any time by email, and we will do so without undue delay.

5. Presets

If you save a preset, we store its name and the settings (layer levels, filters, reverb, tone, tempo, rhythm settings and chord sequences) together with your account. The legal basis is Art. 6(1)(b) GDPR. Presets are deleted when you delete them or your account.

If you are signed in and use the MIDI feature, we also store your MIDI controller assignments (which controller message operates which control) with your account, so they are available on every device you sign in on. The legal basis is Art. 6(1)(b) GDPR. They are deleted when you delete your account.

6. Sign in with Google

You can optionally sign in with your Google account. If you do, you are redirected to Google, which processes your data under its own responsibility and in accordance with its privacy policy. After a successful sign-in, Google tells us your email address and, if available, your name. We use this to create and operate your account (Art. 6(1)(b) GDPR). Signing in with Google is voluntary; you can use email and password instead.

7. Cookies and local storage

We only store information on your device that is strictly necessary for the site to work:

• your sign-in session, if you are signed in,
• temporary state so that your settings survive a sign-in redirect,
• your MIDI controller assignments, if you use the MIDI feature (when you are signed in, they are also stored in your account, see section 5),
• copies of this site's own files (pages, scripts, fonts and images) in the browser cache, so that AltarPad starts without an internet connection. They contain no personal data.

If you use a MIDI controller, your browser asks you for permission to access MIDI devices. The messages from your controller are processed in your browser only. They are not sent to us or to anyone else, and the assignments stay on your device.

If you share or open a preset link, the sound is in the fragment of the address (the part after the #). Your browser never sends that part to a server.

This storage is technically necessary and does not require consent (§ 25(2) no. 2 TDDDG). Subsequent processing is based on Art. 6(1)(f) GDPR. You can delete this data at any time in your browser settings; you may then need to sign in again.

8. Fonts

The fonts used on this site are delivered from our own server. Your browser does not connect to Google or other font providers for this purpose.

9. Recipients and third countries

Recipients of personal data are the hosting and backend provider (processor) and Google if you sign in with Google (each as described above). We do not sell your data. If data is transferred to a country outside the EEA, this only happens on the basis of an adequacy decision or appropriate safeguards under Art. 44 et seq. GDPR.

9a. Usage statistics (PostHog)

To improve AltarPad we measure anonymous usage with PostHog (PostHog Inc., data stored in the EU, Frankfurt): page views with the page you came from (without anything after a # in the address), and app events such as playing a key, using the chord sequencer, the rhythm or Stage Mode, opening the MIDI bar (and how many controls are assigned, never which controller messages), saving or sharing a preset, opening a shared link, how you sign in (without your email address or any identity), switching the language, opening a question in the FAQ, and installing the app. No cookies or local storage are used for this, no profiles are created, no session recordings are made and IP addresses are not stored. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the service). A data processing agreement with PostHog is in place.

10. Your rights

You have the right, under the statutory conditions, to:

• access your data (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw a consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, email us at kontakt@waymakersglobal.com.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.

12. Changes

We update this policy when the site or the legal situation changes. The current version is always available on this page.