Privacy policy
Last updated: 25 September 2026
Draft for review. This describes exactly what cut.fm does with your data, written from the site's own code and configuration. It has not yet been reviewed by a lawyer. [TO BE PROVIDED] confirm the retention periods and the processor agreements marked below before treating this as final.
Who is responsible
Horizon Labs GmbH
Gleimstraße 50
10437 Berlin, Deutschland
Email: peter@cut.fm
Full company details are in the Impressum.
The short version
- Playing the drum pad collects nothing. No account, no sign-up, no tracking.
- We set no cookies and embed no analytics or advertising scripts.
- The only personal data we hold is the email address of people who deliberately sign up for the weekly lesson, plus a record proving that sign-up was genuine.
- You can unsubscribe from every email, at any time, in one click.
Using the drum pad
You can play the pad without giving us anything. There is no account, and playing it sends nothing to us — the sounds are downloaded to your browser and everything after that happens on your device.
If you connect a MIDI controller and remap the pads, that mapping is saved in your own browser's local storage so it survives a reload. It never leaves your device and we cannot read it.
Signing up for the weekly lesson
What we store. When you submit the sign-up form we record:
- your email address;
- the date and time you gave consent;
- the exact wording of the consent you agreed to;
- your IP address and browser user agent at that moment.
The IP address and timestamp exist for one purpose: to show, if it is ever questioned, that a real person at a real address asked for these emails. This is the standard evidence for a double opt-in sign-up. We do not use them to profile you, and they are never combined with anything else.
Double opt-in. Submitting the form does not subscribe you. It sends you one email with a confirmation link. If you never click it, you receive nothing further and your address is never added to the list.
Legal basis. Your consent, under Article 6(1)(a) GDPR. You may withdraw it at any time under Article 7(3) — the unsubscribe link in every email does exactly that. Withdrawing does not affect the lawfulness of anything done before.
What you get. One finger drumming lesson a week and the occasional update about cut.fm. Nothing else, and we never sell, rent or share your address.
How long we keep it. Your address stays on the list until you unsubscribe. After you unsubscribe we keep the consent record ([TO BE PROVIDED] confirm period — commonly three years, matching the standard German limitation period) so that we can answer any later question about whether the sign-up was lawful, then delete it. Addresses that are never confirmed are removed automatically.
Who processes your data for us
We use two processors. Both act only on our instructions.
- MailerLite (UAB "MailerLite", Lithuania) runs the mailing list, sends the confirmation email and delivers the weekly lesson. Subscriber data is stored in the EU. [TO BE PROVIDED] confirm the data processing agreement is in place and note its reference.
- Cloudflare hosts the site and stores our copy of the consent record in a database located in Western Europe. Cloudflare also provides the bot protection on the sign-up form. [TO BE PROVIDED] confirm the Cloudflare data processing agreement.
Cloudflare, Inc. is based in the United States. Transfers outside the EU are covered by the European Commission's Standard Contractual Clauses. [TO BE PROVIDED] confirm this reflects the agreement you have accepted.
Bot protection
The sign-up form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. It is a deliberate alternative to reCAPTCHA: it sets no tracking cookies and does not profile you across sites. To do its job it processes technical information about your browser and your IP address. Legal basis: our legitimate interest in keeping the list free of fake sign-ups, Article 6(1)(f) GDPR.
Turnstile runs invisibly, so you will normally see nothing at all. Cloudflare's handling of the data it collects is described in the Cloudflare Turnstile Privacy Addendum.
Hosting and server logs
The site runs on Cloudflare Pages. Like any web server, Cloudflare processes connection data needed to deliver the page and to defend against attacks. Legal basis: our legitimate interest in operating the site securely, Article 6(1)(f) GDPR. [TO BE PROVIDED] state Cloudflare's log retention period.
What this site deliberately does not do
- No cookies. We set none.
- No analytics or advertising. There is no Google Analytics, no advertising pixel, no social media tracker.
- Fonts are served from this domain. The site uses the Geist typefaces, hosted here. Your browser makes no request to Google Fonts or any other font service, so no font provider ever sees your IP address.
- No profiling and no automated decision-making.
Your rights
Under the GDPR you have the right to:
- access the data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict how we process it (Art. 18);
- receive it in a portable form (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw your consent at any time (Art. 7(3)).
To exercise any of these, email peter@cut.fm. For unsubscribing, the link at the bottom of any lesson is faster and works immediately.
Complaints
If you think we have handled your data improperly you can complain to a data protection supervisory authority. The one responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
Changes
If this policy changes we will update the date at the top. Material changes affecting how we use your email address will be announced in the newsletter itself.