Privacy policy

Who is responsible

The controller is high5 ventures GmbH, Speicherstr. 1, 60327 Frankfurt am Main, Germany, represented by Christian Wendler. Contact: info@h5ventures.de, +49 69 87005060.

Visiting the website

Our hosting provider Vercel processes connection data to deliver pages, fonts, images, videos and audio: IP address, time, requested URL, browser information, referring page where transmitted, and response status. The purposes are delivery, operation and protection against misuse. Our legal basis is our legitimate interest in a reliable and secure website under Article 6(1)(f) GDPR.

Assets are served with the website. We do not integrate advertising trackers, analytics or third-party video players. The website code does not set cookies or persist your language or theme choice in browser storage. Vercel processes technical data to deliver and secure the website. More information is available in Vercel’s privacy notice.

Hosting and international transfers

Vercel Inc. is based in the United States and operates a global delivery network. Processing is not limited to Germany. Vercel’s data processing addendum describes processor obligations and international-transfer safeguards, including standard contractual clauses. Information about its subprocessors and transfer mechanisms is available there.

Connection and security records are retained only as long as needed to deliver and protect the service, investigate incidents or meet legal retention duties. They are deleted when those purposes no longer apply. The applicable period depends on the type of record and the hosting service.

Contact and contract requests

When you contact us, we process your contact details and the contents of your request to respond, support you or handle your contract. The legal basis is Article 6(1)(b) GDPR for contract-related requests, Article 6(1)(c) for legal duties and otherwise Article 6(1)(f) for our legitimate interest in answering enquiries. We delete correspondence once it is no longer needed, unless legal retention duties or the defence of legal claims require longer storage.

The cancellation and withdrawal editors prepare a notice locally in your browser. They do not send your entries or store them on a server. You can download the notice and send it yourself. If you use an email link, your email provider processes the message you send.

Payment and licences

If you purchase through Stripe Managed Payments / Link, the merchant processes the information needed for the purchase, such as email address, billing address, payment method and order details, under its privacy policy. We receive the order and subscription information needed to provide and support your licence, including purchase, renewal, cancellation and refund status. We do not receive full payment card numbers. We process the data required for your licence under Article 6(1)(b) GDPR and data required to meet statutory obligations under Article 6(1)(c).

Licence and trial administration use our service hosted by Hetzner Online GmbH in Germany and the Keygen licence software. This involves a derived device identifier, licence and subscription references, activation status and rendered trial seconds. Connection data is required for those requests. These data serve contract performance and enforcement of the trial and two-Mac limits under Article 6(1)(b) and, for abuse prevention, Article 6(1)(f) GDPR. Rendering audio is not uploaded for payment or licence checks. Licence records are needed during the entitlement and for settling related claims. Trial identifiers are needed to enforce the one-time budget. We retain these records only while those purposes or legal retention duties apply.

Music, Claude and local files

midiflow renders on your Mac. The engine does not connect to a cloud rendering service. Claude receives the conversation and tool information through the Claude application you use; Anthropic’s terms and privacy rules apply to that separate service. Third-party instruments and effects may have their own network and licensing functions.

Internal render jobs and their audio are removed after 24 hours. Files you explicitly export remain in your chosen folder. Local report drafts are removed after 24 hours and local copies of sent reports after 30 days. These local periods are different from server-side report retention.

midiflow can retrieve update information and a list of free plug-ins from the product website at startup and then once a day. Those requests expose ordinary connection data to the website host; they do not upload your music. A download requested through import_url contacts the provider of the URL you supplied.

Optional problem reports

A problem report is shown to you in full before sending. It is sent only after you explicitly approve that individual report. The report contains your description, midiflow and macOS versions, Mac model, plug-in information, error and warning messages and a limited engine-log excerpt. A message may mention a file or preset. User and computer names and home-folder paths are redacted. Do not enter personal information in the free-text description.

Reports do not attach audio, notes, MIDI files, render requests, presets, plug-in state, licence data, serial numbers or a device identifier. There is no automatic usage telemetry.

The report passes through our server at Hetzner in Germany and is stored in a private GitHub area in the USA for diagnosing and fixing the problem. The intake uses your IP address in memory for up to one hour to limit requests; it does not include it in the report. Access is limited to the product support and development process.

The legal basis is your consent under Article 6(1)(a) GDPR. Sending a report to GitHub in the USA requires your separate, explicit consent to the transfer under Article 49(1)(a). US authorities may have access to data and legal remedies may be more limited than in the EU. You may decline without losing the ability to use midiflow. This privacy policy itself does not constitute consent.

Reports are retained until the issue is resolved and for 12 months after closing, then deleted. You can withdraw consent by emailing info@h5ventures.de with the report number. Withdrawal does not affect processing that was lawful before withdrawal. We then stop consent-based processing and delete the report unless a separate legal duty requires retention.

Your rights

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. You may withdraw consent at any time. Where we rely on legitimate interests, you may object on grounds relating to your particular situation under Article 21. Contact info@h5ventures.de.

You may lodge a complaint with a data protection supervisory authority, in particular in the country of your residence, workplace or the alleged infringement. Our competent authority is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

The website does not make solely automated decisions with legal or similarly significant effects. Providing contact information is voluntary; without the necessary details we may be unable to answer your enquiry. Purchase and device information are needed to provide the paid licence.