Privacy Policy

This Privacy Policy explains which personal data we process when you use Make a Beat, for which purpose, on which legal basis, and for how long. The controller within the meaning of Art. 4 (7) GDPR is:

Jonas Niemann c/o IP-Management #9655 Ludwig-Erhard-Straße 18 20459 Hamburg Germany Email: contact@make-a-beat.com

An email to the address above is enough for any privacy-related request. We have not appointed a data protection officer because the statutory thresholds (§ 38 BDSG) are not met; the controller handles your requests personally.

Exception for classroom use: where Make a Beat is used by a school in class, the school is normally the controller for pupil data and we act as a processor. See section 11.

This is a translation for convenience. The German version at make-a-beat.com/de/datenschutz/ is the authoritative one.

Make a Beat runs entirely on servers we operate ourselves at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The servers are located exclusively in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Every core part of the service runs on that infrastructure: the website, our database (PocketBase), the audio and AI service, and our self-hosted workflow automation (n8n) used for form notifications. There is no external database and no external analytics server holding your content.

Legal basis: Art. 6 (1) (b) GDPR (providing the service) and Art. 6 (1) (f) GDPR (legitimate interest in secure, stable operation).

We create encrypted database backups regularly to prevent data loss. Deleted data may still be contained in a backup for a transition period of up to 30 days, after which it is overwritten. Legal basis: Art. 6 (1) (f) GDPR (data security).

Each time our pages are requested, the upstream web server (reverse proxy) automatically records technical access data: your IP address, date and time of the request, the requested address and amount of data transferred, the HTTP status code, the referrer URL, and browser type and operating system taken from the user-agent string.

This data is technically required to deliver the page and is further used for troubleshooting and to defend against attacks and abuse. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in IT security and availability). These logs are not combined with your user account.

Access logs contain the full IP address. They are rotated automatically and deleted after 14 days at the latest; longer storage happens only where a specific security incident has to be investigated.

Most features require an account. There are two ways to create one:

A. Email address and password — We process your email address, a username of your choice, and your password. Passwords are stored exclusively as a cryptographic hash, never in clear text. To confirm your address we send a verification email (see section 9). Following that link signs you in directly, without your password being transmitted again.

B. Sign in with Google (OAuth) — If you use "Sign in with Google", you authenticate with Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google provides us with your email address, your name and your profile picture. Google is an independent controller for the sign-in process itself; Google's privacy policy applies (https://policies.google.com/privacy). A Google script is loaded for this sign-in method when you open the login dialog — not when you merely open a page.

Legal basis for both: Art. 6 (1) (b) GDPR (establishing and performing the user relationship).

Device type at registration — During registration we derive only the device type ("desktop", "mobile" or "tablet") from the user-agent string and store that single value on the account, to understand which kinds of devices our users start on. Neither the full user-agent string nor IP address, location, browser or OS version is stored. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in improving the service).

Our database runs on our own servers in Germany. The following is stored with your account:

Core data: email address, username, an optional profile picture you upload, password hash, verification status, creation and modification timestamps, device type at registration, language preference.

Content you create: your beats including project data (sequences, instruments, BPM, title), your AI-generated sounds including the text descriptions ("prompts") you entered, your keywords for them and the generated audio files, your own uploaded samples, and the "likes" you give.

Usage and contract data: your balance of AI generations, the time a top-up started, the number of beat downloads used, your plan and subscription status including expiry, a marker that a checkout was started, plus your Stripe customer ID and the ID of the last payment event processed (to prevent duplicate credits).

Voluntary information: if you answer the short onboarding question about what you want to use Make a Beat for, we store that choice on your account. It is optional and can be skipped. Legal basis: Art. 6 (1) (a) GDPR (consent).

Playful elements (such as collected coins and the avatar options you pick) are also stored on the account.

Legal basis for core data, content and usage/contract data: Art. 6 (1) (b) GDPR (performance of the contract); for credit handling and abuse prevention additionally Art. 6 (1) (f) GDPR.

Your progress in practice levels and tutorials, as well as interface settings, are stored only locally in your browser and are not transmitted to us (see section 13).

Transparency notice under Art. 50 of Regulation (EU) 2024/1689 (AI Act): Make a Beat uses artificial intelligence to generate and process audio. Sounds, loops and vocal tracks produced by the AI are artificially generated content.

When you use an AI feature, we transmit the input required for it to the respective provider — usually only your text description and technical parameters such as instrument or tempo, not your name, email address or IP address.

ElevenLabs, Inc., 169 Madison Ave, New York, NY 10016, USA (generation of sounds, loops and vocals): your text prompts and parameters are transmitted.

Replicate, Inc., 340 S Lemon Ave, Walnut, CA 91789, USA (splitting music into stems, and loop generation): the audio file to be processed, or the prompt, is transmitted. According to the provider, processing is temporary and serves to execute the request.

For both providers: they process the data on our behalf to deliver the feature you requested, and their own privacy policies apply in addition (https://elevenlabs.io/privacy, https://replicate.com/privacy). For transfers to the USA, see section 19.

We also store your prompts and the generated audio files in your account so you can reuse them later (see section 5). You can delete individual generated sounds in your profile at any time.

Legal basis: Art. 6 (1) (b) GDPR (carrying out the function you triggered).

Some features work with audio you record or upload: humming or singing a melody ("voice to MIDI"), the rap battle mode, the pitch and key finder, and splitting a song into stems.

Your microphone is accessed only after you explicitly grant permission in your browser, and only while you start a recording. The recording is transmitted for analysis to our own audio service on our servers in Germany, where it is converted into a note sequence or a score; the uploaded file is deleted from the server immediately after processing. Recordings from these analysis features are not stored permanently unless you save the result as a sound or beat in your account yourself.

We do not use speaker recognition or biometric identification, we do not create a voiceprint, and we do not use your recordings to train models of our own.

Third-party exception: when splitting a song into stems, the audio file is transmitted to Replicate, Inc. (USA), because the model used runs there (see section 6). So if you feed your own vocal recording into that feature, the recording leaves the EU. Please do not use the feature if you do not want that.

Legal basis: Art. 6 (1) (b) GDPR (performing the processing you requested); for the use of the microphone additionally your consent under Art. 6 (1) (a) GDPR, which you can withdraw at any time through your browser's permission settings.

Payments are processed exclusively by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). We use no other payment provider.

Checkout runs on a page hosted by Stripe (Stripe Checkout) that you are redirected to. No payment script is loaded on our own domain. We never receive or store your full card details.

Data processed via Stripe: name, email address, payment method details (card brand, last four digits, expiry date), billing country, IP address, currency, amount, and transaction metadata (our internal user reference, plan, language). What is reported back to us and stored in your account is only your Stripe customer ID, the payment status and the ID of the processed event.

To that extent Stripe is our processor under Art. 28 GDPR on the basis of the Stripe data processing agreement (https://stripe.com/legal/dpa); for its own purposes such as fraud prevention and its own regulatory obligations, Stripe additionally acts as an independent controller. Stripe privacy policy: https://stripe.com/privacy.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (c) GDPR for invoicing and statutory retention.

Invoices are generated automatically through Stripe. Invoice and accounting records are retained for ten years due to commercial and tax law obligations (§ 147 AO, § 257 HGB); they are excluded from account deletion.

Cookies: Stripe sets the cookies __stripe_mid, __stripe_sid and m on its own domain (checkout.stripe.com) for fraud prevention. These are strictly necessary to carry out the payment (§ 25 (2) no. 2 TDDDG) and require no consent.

We send no advertising related to abandoned checkouts: if you cancel, we merely reset the internal "payment pending" marker. You will not receive a "your cart is waiting" email from us.

For the technical delivery of our emails we use Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor. A data processing agreement is in place with Resend; delivery runs via infrastructure in the European Union, although access from the USA cannot be ruled out (see section 19).

Your email address and the content of the respective message are transmitted. According to Resend, delivery data is stored only briefly — no longer than 30 days — for delivery and troubleshooting purposes and is then deleted (https://resend.com/legal/privacy-policy).

We only send the following messages: the confirmation email verifying your address, a one-off welcome email after your account is activated, and password reset emails when you request one. Legal basis: Art. 6 (1) (b) GDPR.

We send no newsletter, no marketing emails and no reminders about abandoned checkouts. Should we offer a newsletter in the future, it will require explicit double opt-in sign-up and will be added here.

If you use our contact or feedback form, we process the details you enter — depending on the form your name, email address, the selected topic and the content of your message — plus the time of submission. Transmission is TLS-encrypted.

Form data is processed by our self-hosted workflow automation (n8n) on our Hetzner servers in Germany and sent as a notification to our mailbox; section 9 applies to the delivery of that notification.

Legal basis: Art. 6 (1) (a) GDPR (your consent by voluntarily submitting) and Art. 6 (1) (b) or (f) GDPR where your request relates to entering into or performing a contract or to handling your enquiry.

If you email us directly, we process the details contained in your message in order to reply. Please note that unencrypted email can be read in transit.

We keep enquiries until your matter has been resolved and delete them afterwards — where no statutory retention obligation applies, after twelve months at the latest.

Make a Beat offers a classroom area for teachers. Where a school uses it, we process pupil data on the school's instructions as a processor under Art. 28 GDPR. The school (or its public body) is then the controller. We provide schools with a data processing agreement on request at contact@make-a-beat.com; it must be concluded before classroom use.

Teacher account: in addition to the account data in section 4, we store the teacher flag and — where provided — the name of the school and a work email address. Legal basis: Art. 6 (1) (b) GDPR.

Classes: class name, the owning teacher, and a join code that lets pupils be assigned to the class. The teacher can close joining at any time.

Pupil accounts: deliberately data-minimising. We store a display name (chosen by the teacher — a first name or initials is fine), a login ID, a four-digit PIN (stored as a hash only), the class assignment and the position in the list. An email address is not required for pupil accounts and we do not ask for one; an optional field for it stays empty unless the school uses it. Pupil accounts do not sign in via Google.

Assignments and submissions: a class can be given assignments with a title, description and due date. When a pupil submits work, we store the project state, an audio file generated from it and — once entered by the teacher — a grade and feedback. Only the pupil concerned and the teacher of that class can see this; it is never public and never appears in the leaderboard.

For pupil accounts: no advertising, no analytics cookies, no reach measurement via Google Analytics or PostHog, no sharing with ad networks, no profiling. AI features can be enabled or blocked per class by the teacher.

Minors: outside a school context our service is aimed at people aged 13 and over; for minors under 16, consent-based processing requires the authorisation of a parent or guardian (Art. 8 GDPR). In a school context, obtaining the necessary permission is the school's responsibility.

Deletion: teachers can delete pupil accounts, classes, assignments and submissions themselves at any time; deleting a class automatically deletes its pupil accounts, assignments and submissions. On a school's request we delete all data of a class. Absent such a request, we delete class data no later than twelve months after the class was last active.

Your beats are private by default. Only when you explicitly publish a beat do your username, profile picture, the title and the audio file become publicly visible and appear in the leaderboard, where other signed-in users can "like" it. Legal basis: Art. 6 (1) (a) GDPR (consent).

You can withdraw that consent at any time by unpublishing the beat in your profile or deleting it. Please note that content that has already been publicly accessible may have been copied by third parties or cached by search engines, which is outside our control.

If you create a share link for a beat, that beat remains accessible via the link until you delete it.

Strictly necessary (no consent required, § 25 (2) no. 2 TDDDG): your authentication token, so that you stay signed in, and the mab-cookie-consent entry, in which we record your cookie decision for one year — without it we would have to ask you again on every visit.

Functional entries in your browser (local storage): your progress in practice levels and tutorials, interface settings (e.g. simple or advanced view), notices you have already seen, a session ID for the rap battle mode, and intermediate steps of registration. This data stays on your device, is not transmitted to us, and can be cleared at any time in your browser settings.

Analytics (only with your consent, § 25 (1) TDDDG together with Art. 6 (1) (a) GDPR): see section 14. Before you consent, no analytics services are loaded and no analytics cookies are set.

You can change or withdraw your cookie decision at any time via the "Cookie settings" link at the bottom of the page. Withdrawal takes effect for the future; the lawfulness of processing carried out until then is unaffected.

We additionally count page views for purely statistical purposes. To do so we store a per-day marker in your browser (e.g. "analytics_unique_2026-08-08") so that a device is counted only once per day, and increment two counters on the server: page views and visitors per day. This produces aggregate totals only — no IP address, no identifier, no link to your account — so we cannot identify you from it. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in knowing how much our service is used).

Both services below are loaded only after you have explicitly agreed in the cookie banner. If you decline or make no choice, nothing is transmitted to these providers.

Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): collects interactions such as page views, time on page, approximate region, device and browser, plus an identifier stored in the cookies _ga (2-year lifetime) and _ga_EFRWFQ861C (1-year lifetime). Google truncates the IP address and does not store it permanently. We set consent signals ("Consent Mode") so that advertising and personalisation features are permanently disabled; we do not use Google Signals, advertising audiences or demographic reports. Privacy information: https://policies.google.com/privacy.

PostHog (PostHog, Inc., EU Cloud): captures page views, clicks and custom events, linked after sign-in to your user ID, email address, username and language setting, as well as session replays that reconstruct your interaction with the interface. Input into text and password fields is masked automatically. We use the PostHog EU Cloud exclusively, with storage in Frankfurt am Main, Germany.

The purpose in both cases is to find bugs and understand which features are used, in order to improve the service. Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings at the bottom of the page; PostHog then stops capturing immediately and Google Analytics is no longer loaded.

Retention: event data collected by Google Analytics is deleted automatically after 14 months; events and session replays at PostHog are deleted according to its retention periods (replays typically after 30 days).

For transfers to third countries see section 19. These services are not used for pupil accounts in the classroom (section 11).

Our learning content (for example the sight-reading masterclass) embeds videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

The videos are not loaded automatically. You first see only a placeholder with a button; the connection to YouTube is established only when you click it. Google then receives your IP address, which of our pages you are on and device information, and — if you are signed in to your Google account — can associate playback with that account. We use the extended privacy mode (youtube-nocookie.com), which reduces cookie setting until playback starts.

Legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, which you give by clicking "Load video". Alternatively you can watch the video directly on YouTube via the link we provide. More information: https://policies.google.com/privacy.

All fonts are served from our own server. There is no connection to Google Fonts or any other font CDN, so your IP address is not transmitted to third parties for that purpose.

Apart from the services named in this policy (Google sign-in, Stripe Checkout, analytics after consent, YouTube after a click), our pages load no content from third-party servers. We use no ad networks, no social media plugins, no chat widgets and no tracking pixels.

We store personal data only for as long as it is needed for the respective purpose or as long as statutory retention obligations require.

Account data and content: until your account is deleted. If you delete your account, or ask us by email to do so, we remove your account together with your beats, generated sounds, uploads and likes; backups may still contain the data for up to 30 days (section 2).

Server logfiles: 14 days at most (section 3). Enquiries via forms and email: until resolved, at the latest after twelve months (section 10). Analytics data: see section 14. Class and pupil data: see section 11.

Invoices and accounting records: ten years under § 147 AO and § 257 HGB. This data is legally bound, is not covered by account deletion, and is kept exclusively for tax and accounting purposes.

We do not share your data for advertising purposes and we do not sell it. The only recipients are the following service providers, each limited to the data required to deliver their part:

Hetzner Online GmbH (Germany) — hosting of the entire platform, processor. Stripe Payments Europe Ltd. (Ireland) — payment processing, processor and, for fraud prevention, independent controller. Resend / Plus Five Five, Inc. (USA, delivery via EU infrastructure) — technical email delivery, processor. ElevenLabs, Inc. (USA) — AI audio generation, processor. Replicate, Inc. (USA) — audio processing and loop generation, processor. Google Ireland Limited (Ireland) — Google sign-in, Google Analytics (consent only), YouTube videos (after a click only). PostHog, Inc. (EU Cloud, Frankfurt) — product analytics, consent only, processor.

Beyond that, we disclose data where we are legally obliged to or where it is necessary to enforce our rights (Art. 6 (1) (c) and (f) GDPR).

Processing takes place in Germany and the EU as a rule. With the US-based providers named in section 18 (Resend, ElevenLabs, Replicate), and with Google and Stripe, access from the USA cannot be ruled out.

Such transfers take place on the basis of an adequacy decision of the European Commission where the provider is certified under the EU-U.S. Data Privacy Framework (this applies in particular to Google), and otherwise on the basis of the European Commission's Standard Contractual Clauses under Art. 46 (2) (c) GDPR together with supplementary safeguards.

Please note that the level of data protection in the USA is not equivalent to the EU in every respect and that access by US authorities cannot be entirely excluded. A copy of the relevant safeguards is available on request at contact@make-a-beat.com.

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The automatic scoring of practice levels or rap recordings exists solely to give you feedback on your own learning; the analysis of your usage (section 14) serves solely to improve the service.

You can use publicly accessible pages without providing personal data; only the technical access data described in section 3 is processed.

An account requires an email address and username (or the details supplied by Google) — without these we cannot maintain an account. A purchase requires payment and billing data. Everything else, in particular a profile picture, the onboarding question about your purpose, and the use of microphone or AI features, is voluntary; without it, only the feature in question is unavailable.

You have the right at any time to obtain information about the data stored about you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to receive the data you provided in a common, machine-readable format (Art. 20).

A message to contact@make-a-beat.com is enough to exercise these rights. We respond without undue delay and within one month at the latest. Information is provided free of charge.

Withdrawing consent (Art. 7 (3) GDPR): where you have given us consent — for analytics cookies, for loading a YouTube video, for publishing a beat, or for the optional onboarding answer — you can withdraw it at any time without affecting the lawfulness of processing carried out beforehand. The cookie settings at the bottom of the page, unpublishing the beat, or an informal email to us are sufficient.

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interests under Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where data is processed for direct marketing, you may object at any time without giving reasons, and the data will no longer be processed for those purposes. On direct marketing: we currently do none (see sections 8 and 9).

Right to complain (Art. 77 GDPR): you can lodge a complaint with a data protection supervisory authority at any time, in particular with the authority of your habitual residence or with the authority competent for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

The connection to our pages is TLS-encrypted throughout ("https://" in the address bar), so content such as login data cannot be read in transit. Passwords and pupil PINs are stored as hashes only.

Access to the database is limited to the controller and the internal services required to run it; administrative interfaces are not publicly reachable. Database access rules are set so that users see only their own data and teachers see only the data of their own classes.

We update this policy when we change features or the services we use. The version published on this page applies. Where a material change requires consent, we will obtain it again.

Last revised: August 2026.