Privacy policy

1. Controller

Blickwerk Media UG (haftungsbeschränkt)Prinz-Carl-Anlage 1967547 WormsGermanyEmail: support@unlq.app

Represented by Leon Reis and Luca Gans. We are not required to appoint a data protection officer. For privacy questions, contact us at support@unlq.app.

2. Hosting and server logs

unlq is hosted by Vercel Inc. (USA). Our servers run in the Frankfurt am Main region. When you visit the site, Vercel processes technically necessary data such as your IP address, date and time, requested URL, referrer, browser and operating system in order to deliver the site and protect it against attacks. These logs are only kept for a short time. We do not store IP addresses in our own database. To protect against abuse, such as mass login attempts, fake sign-ups or automated downloads, we count requests per sender. For this we only store a hash derived from the IP address with a secret key, from which the IP address cannot be recovered, for no longer than one hour. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). We have a data processing agreement with Vercel. Transfers to the USA are based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.

3. Database and file storage

We store accounts, gates, leads and statistics in a PostgreSQL database by Neon (Neon Inc., USA) in the Frankfurt am Main data center (AWS eu-central-1). Uploaded files such as tracks, artwork and profile pictures are stored in Vercel Blob. Audio files are stored privately and only delivered through time-limited download links.

We have data processing agreements with both providers; transfers to the USA are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

4. Cookies

We only use our own cookies, no third-party tracking or advertising cookies. We set strictly necessary cookies without consent under § 25(2) no. 2 TDDDG:

• user_session: login for artists and admins, 14 days
• visitor_session: remembers which gate steps you completed as a fan, 14 days
• login_oauth, visitor_oauth: secure the SoundCloud sign-in, 10 minutes
• gate_resume: brings you back to the gate after signing in with SoundCloud, 2 minutes
• locale: your chosen language, 1 year
• cookie_consent: your cookie choice, 1 year

We count gate views as a plain total, without a cookie and without linking them to you, so artists can see how often their gates are opened (Art. 6(1)(f) GDPR). Only if you choose “Accept all” in the cookie banner do we link the view to your visitor session and store where you came from (referrer and UTM parameters) so artists can see how their tracks perform (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change your choice and withdraw your consent at any time via “Cookie settings” in the footer.

5. Sign in with SoundCloud

You can sign in as an artist or fan with your SoundCloud account. The provider is SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin, Germany. After you approve access on SoundCloud, we receive your SoundCloud ID, username, display name, profile link and profile picture as well as access tokens that allow us to act on your behalf.

As a fan, we only use this access to perform the steps you trigger for a download: following a profile, liking or reposting a track, following a playlist or posting a comment. These actions are publicly visible on SoundCloud under your name. As an artist, we use the access to show your tracks and playlists when you create gates and to import your profile picture.

The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). We delete fans' tokens no later than one day after the visitor session ends. We keep artists' tokens until they expire, you revoke the connection on SoundCloud or you delete your account. You can revoke access at any time in your SoundCloud settings.

6. Free downloads for fans

When you unlock a download, we store with your pseudonymous visitor session which steps you completed, when you downloaded the file and, if available, which source you came from (referrer and the link's UTM parameters). If a gate asks for your email address, we store it together with the gate.

If you tick the box for release updates in the email step, we send you a confirmation email (double opt-in). Only once you confirm the link in it do we store you as a subscriber of that artist, together with your email address, language and the times of sign-up and confirmation as proof. Unconfirmed sign-ups are deleted after 7 days. When the artist releases a new track, they can notify you by email via unlq. Every such email contains an unsubscribe link; once you unsubscribe, we delete your subscription and consent immediately.

Your email address is shared with the artist of that gate, who can view and export it in their dashboard, including the status of your consent. If the artist contacts you outside of unlq, the artist is responsible for that. You can withdraw your consent at any time via the unsubscribe link, towards the artist or us.

The legal basis is Art. 6(1)(b) GDPR for unlocking the download, Art. 6(1)(a) GDPR for release updates and Art. 6(1)(f) GDPR for the source analysis.

7. Artist accounts

For an artist account we process your artist name, username, email address, optionally your Instagram link, your profile picture, your chosen language, the time and version of your acceptance of the terms of use and the gates, files and texts you create. Your name, profile picture, username and published gates are publicly visible.

The legal basis is Art. 6(1)(b) GDPR. You can delete your account yourself at any time in your settings. After you confirm by email, we delete your profile, all gates, files, leads and statistics.

8. Emails and support

We use Resend (Plus Five Five, Inc., USA) to send login codes, confirmation emails (for example for account deletion or release updates) and release updates to fans. This involves processing your email address and the content of the message. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(a) GDPR for release updates. We have a data processing agreement with Resend; transfers to the USA are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

If you contact us by email, for example at support@unlq.app, Resend receives the message on our behalf. We store your email address, name, subject, message text and the names and sizes of attachments, as well as our replies, in our database in order to handle your request. If you have an artist account with the same email address, we link the request to that account. The legal basis is Art. 6(1)(b) GDPR where the request concerns your account or our services, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering requests.

9. Statistics for artists

We show artists how often gates were viewed, steps started and completed and files downloaded, as well as which source fans came from. These statistics are based on pseudonymous visitor sessions; artists do not see fans' IP addresses or SoundCloud accounts. We only count views with consent (see section 4); all other events are processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to give artists insight into how their gates perform.

10. External content, links and fonts

Artwork that comes from SoundCloud is loaded through our own server. Your browser does not connect to SoundCloud for this. Links to SoundCloud or Instagram (for example in a gate's Instagram step) only open the respective site when you click them; from then on the provider's privacy policy applies, for Instagram that of Meta Platforms Ireland Ltd.

All fonts are served from our own server. No connection to Google or other font providers is made.

11. Recipients

• Our processors Vercel, Neon and Resend, strictly on our instructions
• SoundCloud, insofar as you sign in there or complete gate steps
• The artist of a gate, for the email address you enter there and the pseudonymous statistics
• The public, for published artist profiles and gates

Beyond that, we only share data where we are legally required to do so.

12. Retention

• Login codes: valid for 10 minutes, permanently deleted after 24 hours at the latest
• Account deletion links: valid for 60 minutes, deleted afterwards
• Artist and admin logins: 14 days, deleted afterwards
• Fans' SoundCloud tokens: deleted no later than one day after the visitor session ends
• Pseudonymous step, download and source data: until the gate or artist account is deleted
• Artist accounts, gates, files and leads: until the gate or account is deleted
• Unassigned uploads: removed automatically every day
• Confirmed release updates: until you unsubscribe or the artist account is deleted
• Unconfirmed release update sign-ups: deleted after 7 days
• Hashes for abuse protection: no longer than one hour
• Support requests: up to 2 years after the request is closed, earlier on request

Statutory retention obligations remain unaffected.

13. Obligation to provide data and minimum age

You are under no legal or contractual obligation to provide data. Without the requested information, however, you cannot create an account or unlock a download.

unlq is intended for people aged 16 and over. If you are younger, please only use unlq with your parents' consent.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future; processing carried out until then remains lawful.

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just email us at support@unlq.app.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.

15. Security

All connections are encrypted with TLS. We only store login codes, deletion links and confirmation links as hashes. Unsubscribe links are cryptographically signed. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

16. Changes

We update this privacy policy when unlq or the legal situation changes. The version published here applies.