Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed because the statutory requirements (Article 37 GDPR, Section 38 BDSG) are currently not met. Please send data protection enquiries to the email address above.

2. General information about data processing

We generally process our users' personal data only insofar as this is necessary to provide a functioning platform, our content and our services. Processing is regularly based on the following legal grounds:

• Article 6(1)(b) GDPR — Processing is necessary for the performance of a contract or for taking steps at the request of the data subject prior to entering into a contract (e.g. account creation and providing uploads, messaging and matching features).
• Article 6(1)(a) GDPR — Consent, e.g. for optional email notifications, which you can withdraw in your account settings.
• Article 6(1)(f) GDPR — Legitimate interests, particularly in the security, stability and abuse prevention of the platform (rate limiting, security logs, fraud and spam prevention) and in anonymised reach measurement.
• Article 6(1)(c) GDPR — Processing is necessary for compliance with a legal obligation, where applicable.

3. Registration, login and user account

A user account is required to use nextfeature. During registration, we process the following data:

• Registration with an email address and password: — Registration takes place in two stages. We first send a confirmation link to the email address provided; the link is valid for 30 minutes. No account is created if the link is not clicked. Your password is never stored in plain text, but exclusively as a cryptographic hash.
• Sign-in with Google (OAuth): — Alternatively, you can sign in with your Google account. Google provides us with your email address, name and, if applicable, profile picture. Google's privacy policy also applies: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• We also store your role (e.g. listener, artist), the time of registration, the time of email verification and your notification settings (in-app / email).

Sign-in uses a server-signed session cookie transmitted exclusively over HTTP ("HttpOnly"); see Section 9.

4. Profile and artist data

Users with a public artist profile can voluntarily provide additional information that is visible to everyone when the profile is public: display name, profile URL ("handle"), short biography, profile picture and externally linked profiles (e.g. social media or music platform links with their associated icon). This information is used exclusively for the platform's reach and collaboration features (Article 6(1)(b) GDPR) and can be changed or set to "private" at any time in the account settings.

5. Uploaded content

When you publish music, we process the audio files you upload (up to 1 GB), cover graphics and the metadata you enter (title, genre, BPM, key). We automatically calculate a preview (streaming-compatible MP3), a waveform representation and technical characteristics (BPM, key) from the audio file. Files are encrypted and stored in Cloudflare R2 (see Section 13) without being publicly accessible; playback and downloads take place exclusively via short-lived, signed links. For public tracks, you can also create time-limited, token-based sharing links for third parties (Section 7).

6. Communication and networking between users

nextfeature provides features that allow users to get in touch with one another:

• Direct messages: — Message content between users is stored to provide the conversation history, along with technical read and delivery information (e.g. unread, last read).
• Collaboration profiles, swipes and matches: — If you create a collaboration request (e.g. a wanted or offered role, genre), we store it and your ratings of other requests ("swipes"). If there is a mutual match, it is stored permanently as a "match" and a conversation thread is opened. No automated decision with legal effect within the meaning of Article 22 GDPR takes place — the matching only shows you suitable requests; you alone make the final decision (swipe, message).
• Following/followers: — We store which artist profiles you follow.
• Blocking and reporting: — You can block other users or report content (e.g. for copyright infringement); the associated information (blocking/reporting person, reason, time) is stored to prevent abuse.

7. Downloads and sharing links

For the original download of a track and for private sharing links, we generate access tokens that are valid once and for a limited time. Expired tokens are automatically removed from our database.

8. Feedback function

If you submit a message, category or rating via the integrated feedback function, we associate it with your account to enable follow-up questions and prevent abuse.

9. Cookies and similar technologies

We use a technically necessary session cookie that maintains your login for the duration of your session (Article 6(1)(b), (f) GDPR). The cookie is "HttpOnly" (not readable by JavaScript), is transmitted only over encrypted connections ("Secure") and protects against cross-site request forgery through its "SameSite" attribute. It contains no advertising or third-party tracking identifiers. Because this cookie is technically essential, no separate consent is required under Section 25(2) TTDSG. We do not use marketing or third-party tracking cookies.

10. Reach measurement and analytics

We use Vercel Web Analytics and Vercel Speed Insights (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA) to measure page views and loading times in an aggregated way without cookies. These services use no cookies and do not recognise individual people across sessions based on their IP address; no individual user profiles are created. The legal basis is our legitimate interest in analysing and improving the platform (Article 6(1)(f) GDPR).

When tracks are played, we also record a purely technical, pseudonymous performance event (time until playback starts), containing only the track ID and technical metrics, not a user identifier.

For statistics on plays and views of individual tracks (e.g. in the artist dashboard), we store events with a daily rotating, hashed IP identifier that is automatically deleted after 30 days and cannot be used to derive the actual IP address.

11. Server log files, security and abuse prevention

When our platform is accessed, our hosting provider processes technically necessary connection data (including IP address, date and time of the request, amount of data transferred and user agent) to ensure trouble-free and secure operation (Article 6(1)(f) GDPR).

To protect against abuse (e.g. automated login attempts), we limit the number of requests per sender. The IP address is never stored in plain text: it is first cryptographically hashed with a secret key (HMAC), and only this hash is retained for the duration of the relevant time window — it cannot be used to infer the original IP address.

We record security-relevant events (e.g. failed login attempts and administrative actions) in a security audit log that is automatically deleted after 90 days. Automated browser reports about blocked content (Content Security Policy reports) are analysed in anonymised form and reduced to categories.

12. Email delivery

We send transactional emails (e.g. registration confirmation, notices about new messages, new followers, new matches or published tracks) via an SMTP service. Registration and security-related emails are required to use the account (Article 6(1)(b) GDPR); you can disable all other notification emails at any time in your account settings (Article 6(1)(a) GDPR).

13. Data recipients and processors

We do not share personal data with third parties except where this is necessary to provide our services. The following service providers process data for us as processors or as joint or independent controllers; we have concluded an agreement under Article 28 GDPR with all processors:

• Vercel Inc. (USA) — hosting, running the application, Web Analytics and Speed Insights.
• Cloudflare, Inc. — object storage (R2) for audio files, covers and profile pictures, as well as preview conversion ("transcoding" worker); storage is configured for the EU jurisdiction by default.
• Google Ireland Limited (Ireland) — exclusively for users who sign in with a Google account (Section 3).

14. Transfers to third countries

Some of the providers named above (in particular Vercel and Google) also process data in the USA or outside the EU/EEA. Where no European Commission adequacy decision exists, we base these transfers on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR) and additional technical and organisational measures taken by the respective providers. Copies of the relevant safeguards can be requested from us at the address named in Section 1.

15. Storage period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations:

• Account data: until you delete your account.
• Unconfirmed registration requests: automatically deleted no later than 30 minutes after creation if the confirmation link is not used.
• Download and sharing tokens: automatically deleted after expiry or use.
• Anonymised playback and view statistics: automatically deleted after 30 days.
• Security audit log: automatically deleted after 90 days.
• Uploaded content, profile and communication data: until you delete the relevant content or account, or request its deletion.

A self-service function for completely deleting accounts and data is currently being developed. Until it is available, we process deletion requests manually via the contact address named in Section 1.

16. Your rights as a data subject

You have the following rights concerning your personal data:

• Access to the data we process (Article 15 GDPR),
• Rectification of inaccurate data (Article 16 GDPR),
• Erasure of your data (Article 17 GDPR),
• Restriction of processing (Article 18 GDPR),
• Data portability (Article 20 GDPR),
• Object to processing based on legitimate interests (Article 21 GDPR),
• Withdraw consent with effect for the future, e.g. for optional notification emails (Article 7(3) GDPR), and
• Lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Article 77 GDPR).

To exercise these rights, please contact the address named in Section 1.

17. No automated decision-making

We do not use solely automated decision-making, including profiling within the meaning of Article 22 GDPR, that produces legal effects concerning you or similarly significantly affects you.

18. Minimum age

Our services are not directed at children under 16. Persons under 16 may not create a user account without the consent of a parent or guardian (Article 8 GDPR).

19. Changes to this Privacy Policy

We will adapt this Privacy Policy as soon as changes to data processing make this necessary. The current version published on this page applies in each case.