Privacy Policy

Last updated: September 16, 2026

This Privacy Policy explains how musikuss-records.com ("we," "us," or "the Site") collects, uses, and discloses personal information when you visit or interact with our website.

1. Controller

The controller responsible for data processing on this website is:

musikuss
Hamburg, Germany
Email: office@musikuss-records.com

If you have any questions about this Privacy Policy or our data practices, please contact us using the details above.

2. Overview of Processing

We aim to keep data collection on this Site to a minimum. The Site is built and delivered using the following third-party services, each of which is described in detail below:

  • Vercel - Website hosting (serverless)
    • Cookies set: No (see Section 3)
    • Provider location: United States
  • Sanity - Headless content management (backend only)
    • Cookies set: No
    • Provider location: United States / EU (Google Cloud)
  • Resend - Contact form email delivery
    • Cookies set: No
    • Provider location: United States
  • Umami (app on Vercel) + Neon (database) - Cookie-free web analytics
    • Cookies set: No
    • Provider location: Application: United States (Vercel); Database: EU - AWS eu-central-1, Frankfurt (Neon)

Note: Our analytics tool (Umami) is currently hosted as an application on Vercel, using Neon's Frankfurt (AWS eu-central-1) region as its database backend, rather than on our own VPS. If we migrate Umami back to our own server in Germany, this Privacy Policy will be updated accordingly.

3. Hosting: Vercel

This Site is hosted on the serverless infrastructure of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.

When you visit the Site, Vercel's edge network automatically processes technical information necessary to deliver the page to your browser, including:

  • IP address
  • Browser type and version, operating system
  • Referring URL and pages requested
  • Date and time of the request
  • Approximate location derived from your IP address (city/country level only)

This data is processed in server logs for the purposes of operating, securing, and troubleshooting the Site (e.g., detecting abuse, preventing denial-of-service attacks, and diagnosing errors). Vercel states that server/request logs are typically retained for a limited period unless a longer retention is required for a security investigation.

Cookies: We do not use Vercel's own analytics products (Web Analytics / Speed Insights) and the Site does not implement any login or session system of its own. For a plain serverless deployment like this one, Vercel's hosting layer itself does not set any cookies in the visitor's browser. According to Vercel's documentation, even its own first-party Web Analytics product is cookieless and identifies visitors only through a daily-rotated hash of the incoming request rather than a stored identifier. Cookies on a Vercel-hosted site typically only appear if the site itself implements authentication/sessions or if additional third-party scripts are added - neither applies here.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a functioning, secure, and reliable website).

International transfer: Vercel is a U.S. company and may process data on servers in the United States and other countries. Vercel is certified under the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, and relies on this certification, together with Standard Contractual Clauses where applicable, as a transfer mechanism.

More information: Vercel Privacy Policy.

4. Content Management: Sanity

We use Sanity (Sanity.io, with entities in Norway and the United States; registered address referenced by Sanity as 132 Hawthorne Street, San Francisco, CA 94107, USA) as a headless CMS to manage and deliver the content shown on this Site (e.g., release information, artist bios, images).

Sanity operates purely on the backend as part of our content pipeline. In normal operation, visitors to musikuss-records.com do not interact directly with Sanity's servers, and no personal data about Site visitors is knowingly sent to Sanity through regular page views. No cookies related to Sanity are set in the visitor's browser. Sanity's own documentation notes that it logs technical connection data (such as IP address, timestamp, browser type, and performance metrics) only when its services or APIs are accessed directly, and retains or anonymizes such logs within 90 days [web result: Sanity Privacy Policy].

Because Sanity is not directly contacted by end-user browsers on this Site's front end in a way that processes visitor personal data, its relevance under the GDPR is limited for visitors. We include it here for transparency, since Sanity acts as a processor for the content infrastructure behind the Site, and content requests could theoretically be routed through Sanity's CDN.

Sanity's infrastructure is hosted on Google Cloud Platform, with EU data hosting available depending on configuration [web result: Sanity Schrems II answer]. Sanity provides a Data Processing Addendum incorporating Standard Contractual Clauses for any international transfers.

More information: Sanity Privacy Policy.

5. Contact Form: Resend

If you use the contact form on this Site, the information you provide (name, email address, and message content) is transmitted via Resend (Plus Five Five, Inc., operating as Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA) in order to deliver your message to us by email.

Resend processes, on our behalf:

  • The recipient data you enter (your email address, name if provided)
  • The content of your message
  • Technical delivery metadata (e.g., delivery logs, timestamps)

Resend does not set any cookies in your browser; it operates purely as a backend email-delivery API triggered when you submit the form. Resend stores the transmitted data on servers in the United States. According to Resend's own documentation, message content, delivery logs, and account records are retained for 30 days while an account is active, and remaining data is deleted within 90 days of account termination.

Legal basis: Art. 6(1)(b) GDPR (to take steps requested by you prior to entering into an agreement, or to respond to your inquiry) and, alternatively, Art. 6(1)(f) GDPR (our legitimate interest in responding to inquiries addressed to us).

International transfer: Resend is a U.S. company and processes data on servers located in the United States. Resend states it is certified under the EU-U.S. Data Privacy Framework (DPF) and the UK Extension, and is SOC 2 and GDPR compliant, relying on this certification and/or Standard Contractual Clauses as a transfer safeguard.

We do not use the contact form data for any purpose other than answering your inquiry, and we do not use it for marketing without your separate consent.

More information: Resend Privacy Policy and Resend GDPR overview.

6. Analytics: Umami (currently hosted on Vercel, with Neon as database)

We use Umami, an open-source, cookie-free web analytics tool, to understand aggregate visitor numbers and usage patterns on the Site. Umami itself does not use persistent identifiers, fingerprinting, or cookies to track individual users across sessions or websites. It collects only aggregate, largely anonymized technical data such as:

  • Page URL visited and referrer
  • Approximate country/region (derived from IP address, which is not stored in identifiable form)
  • Browser and operating system type
  • Screen size and session duration

Current infrastructure: Our Umami instance is presently deployed as an application on Vercel (Vercel Inc., Covina, CA, USA - see Section 3 for Vercel's general data handling) and uses Neon (Neon, Inc., 2261 Market Street STE 22601, San Francisco, CA 94114, USA) as its underlying PostgreSQL database. Our Neon database project is configured to run in Neon's AWS eu-central-1 (Frankfurt, Germany) region, meaning the collected analytics data itself is stored on database infrastructure located within the European Union.

Because Neon, Inc. is a U.S.-headquartered company, U.S. law (including the U.S. CLOUD Act) may in principle apply to Neon regardless of where the underlying servers are physically located, even though the database and the data within it remain hosted in Frankfurt. Neon states that it is GDPR-compliant, provides a Data Processing Agreement, and relies on Standard Contractual Clauses to the extent any support or administrative access occurs from outside the EU. Similarly, the Umami application layer runs on Vercel's infrastructure (see Section 3 regarding Vercel's own data handling and its EU-U.S. Data Privacy Framework certification).

No cookies are set at any point in this analytics setup, and no individual visitor profiles are created or shared with third parties.

We are in the process of evaluating a migration of Umami back to our own virtual private server (VPS) located in Germany, which would remove the Vercel/Neon infrastructure layer entirely. Once completed, this section will be updated accordingly.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding and improving the use of our Site). Because no cookies or persistent cross-site identifiers are used, this processing does not require consent under the ePrivacy rules; we nonetheless disclose the underlying infrastructure providers above for full transparency.

7. Your Rights

Depending on your location, you may have the right to:

  • Request access to the personal information we hold about you.
  • Request correction of inaccurate personal information.
  • Request deletion of your personal information.
  • Object to or request restriction of certain processing.
  • Request a portable copy of your data.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with a supervisory authority, such as the German data protection authority for the state of Hamburg (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit) or another competent authority.

To exercise any of these rights, contact us using the details in Section 1.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Site or to the services we use (for example, when Umami is migrated to our own server, or if embedded video content is added in the future). The "Last updated" date at the top of this page indicates when it was last revised.