Privacy policy

Last updated: 30 August 2026

This Privacy Policy describes how Voxalized collects, uses and shares your personal data when you visit voxalized.com, buy a vocal license, or sell vocals through the platform — and which rights you have under the General Data Protection Regulation (GDPR).

1. Controller

Voxalized — Kilian Kramer, Friesischer Bogen 17, 24983 Handewitt, Germany — email: support@voxalized.com, phone: +49 151 70508777

We are the data controller for the processing described here. Where singers sell their vocals through Voxalized, the license agreement is concluded between you and the singer; the singer receives the data needed to issue and honour that agreement (see section 5).

2. What we collect

Account data — email address, display name, password (stored hashed by our authentication provider), and for singers: legal name, address, stage name, profile texts and images, tax and payout details held by Stripe.

Order data — the vocals and licenses you buy, prices, VAT, billing name and country as provided at checkout, order and download history, and the personalised license agreement issued for each purchase. Payment card and PayPal details go directly to Stripe; we never see or store them.

Store analytics — when you view a singer's store or a vocal, play a preview, add to basket or buy, we record the event together with a pseudonymous visitor hash (a daily-rotating hash of your IP address and browser signature that we cannot reverse). Singers see these numbers aggregated for their own vocals only.

Usage data — server logs with IP address, browser type, pages requested, time and date, referring page, and error diagnostics.

Newsletter data — first name and email address, the time and source of your sign-up.

Cookies and similar technologies — see section 7.

Data from the previous Voxalized store — accounts, orders, download entitlements and singer profiles created on the previous version of voxalized.com were migrated to this platform so that existing customers keep their purchases and singers keep their catalogue. Singer accounts were migrated in a locked state and are only activated by the singer via a personal link.

3. Why we process it and on which legal basis

To run your account and the store (Art. 6(1)(b) GDPR — contract): registration, login, password resets, showing your purchases and downloads, singer dashboards and payouts.
To fulfil purchases (Art. 6(1)(b) and (c) GDPR): processing payments through Stripe, calculating VAT, issuing the license agreement between you and the singer, providing downloads, keeping records required by tax law.
To pay singers (Art. 6(1)(b) GDPR): passing the sale, the buyer's country and the singer's share to Stripe Connect.
Security and abuse prevention (Art. 6(1)(f) GDPR — legitimate interest): server logs, rate limits, bot detection, protecting download links.
Store analytics for singers (Art. 6(1)(f) GDPR): pseudonymous event counts so singers can see how their vocals perform. No profile of you is built from this data.
Web analytics and advertising measurement (Art. 6(1)(a) GDPR — consent): Google Analytics, Google Ads and the Meta Pixel / Conversions API run only after you accept the "Performance" or "Targeting" categories in our cookie banner. You can change your choice any time under "Cookie settings" in the footer.
Newsletter (Art. 6(1)(a) GDPR — consent): fresh vocals and discounts by email; every email contains an unsubscribe link.
Transactional emails (Art. 6(1)(b) GDPR): registration and password emails, order confirmations, download links, sale notifications for singers.
Legal obligations (Art. 6(1)(c) GDPR): retaining invoices and order records, responding to lawful requests.

4. Service providers (processors)

We use the following providers, each bound by a data processing agreement:

Supabase (Supabase Inc.) — database, authentication and file storage. Our project is hosted in the European Union (AWS eu-west-1, Ireland).
Vercel (Vercel Inc.) — hosting and delivery of the website; our server functions run in Frankfurt, Germany. Vercel processes request logs (IP address, user agent) to deliver and secure the site.
Stripe (Stripe Payments Europe, Ltd.) — payment processing (cards, PayPal and local methods), VAT calculation (Stripe Tax) and singer payouts (Stripe Connect). Stripe is an independent controller for the payment data it collects; see https://stripe.com/privacy.
Google (Google Ireland Ltd.) — Google Tag Manager, Google Analytics 4 and Google Ads conversion measurement, loaded only with your consent. Data may be transferred to the USA under the EU–US Data Privacy Framework. See https://policies.google.com/privacy.
Meta (Meta Platforms Ireland Ltd.) — Meta Pixel and Conversions API for measuring our ads, loaded only with your consent. With your consent we may send hashed purchase events (for example a hashed email address) server-side so that ad results can be attributed. See https://www.facebook.com/privacy/policy.
Email service provider — sending of account, order and newsletter emails on our behalf. We use Brevo (Sendinblue SAS, France); see https://www.brevo.com/legal/privacypolicy/.

When you buy a license, the singer who sells the vocal receives your name and country as stated on the personalised license agreement, plus the sale amount. Singers do not receive your email address or payment details.

We do not sell personal data. We disclose data to authorities only where required by law, and to advisers or successors in the event of a business transfer, in which case this policy continues to apply.

6. International transfers

Our systems run in the European Union. Where a provider processes data outside the EU/EEA (Google, Meta, Stripe's US entities), transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We use a small number of first-party cookies and local storage entries:

Necessary — session and login cookies, your basket, your cookie choice, the player volume. Always active.
Functional — remembering preferences such as filters. Set only with your consent.
Performance — Google Analytics via Google Tag Manager. Set only with your consent.
Targeting — Google Ads and Meta Pixel for measuring and personalising ads. Set only with your consent.

The banner appears on your first visit; "Ok" accepts all categories, "Settings" lets you pick. You can reopen it at any time via "Cookie settings" in the footer and withdraw consent with effect for the future. Blocking cookies in your browser also works, but the basket and login need the necessary cookies.

8. Retention

Account data: until you delete your account, then removed within 30 days unless we must keep parts for legal reasons.
Orders, license agreements and invoices: 10 years (German commercial and tax law), then deleted.
Store analytics events: up to 24 months, pseudonymous.
Server logs: up to 30 days.
Newsletter data: until you unsubscribe, plus a suppression entry so we do not email you again.
Migrated singer accounts that are never activated: deleted after 12 months on request of the singer or at our discretion.

9. Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to receive it in a portable format, and to withdraw any consent at any time with effect for the future. Most account data can be changed by you under Account. For everything else write to support@voxalized.com; we may ask you to verify your identity.

You may lodge a complaint with a supervisory authority, in particular the one responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany — https://www.datenschutzzentrum.de.

10. Security

Data is transmitted over TLS, stored in encrypted databases and buckets, and access is restricted by role. Download links are personal, expire, and are logged. No method of transmission or storage is completely secure, so please use a strong, unique password.

11. Children

Voxalized is not directed at children under 16. We do not knowingly collect personal data from anyone under 16; if you believe a child has provided us with data, contact us and we will delete it.

We run pages on Facebook and Instagram (Meta). When you visit them, Meta processes your data as described in its own privacy policy; for page insights Meta and we are joint controllers under Meta's Page Insights addendum.

13. Links to other websites

Our pages link to other websites (singers' social profiles, streaming platforms). Their privacy practices are their own; please review them.

14. Changes

We update this policy when our processing changes and show the date of the last update at the top. Material changes are announced on the site or by email before they take effect.

15. Contact

support@voxalized.com

Last updated 29/08/2026