DaLoop8 Privacy Policy / RGPD Statement
Last updated: 8 August 2026
1. Who is responsible for your data (the “controller”)
Under the EU General Data Protection Regulation (“GDPR”/“RGPD”), the data controller for the personal data described below is:
- MixticStudio
- Contact: mixticstudiopro@gmail.com
MixticStudio is an independent developer rather than an incorporated company. If that changes, the registered entity and its address will be named here and the “Last updated” date above will change. Email is the fastest and most reliable way to reach us about anything in this document, and it reaches a person rather than a ticket queue.
This document covers the DaLoop8 desktop/plugin application, its companion web portal, the daloop8.com website and waitlist, and its jam-session (real-time collaboration) servers.
2. What data we collect
2.1 Account data
When you create a portal account, we collect and store:
- A Nickname you provide to identify you with other users
- Email address
- Password, stored hashed (never in plain text)
2.2 Payment data
Paid full-license purchases are processed by Stripe, an independent payment processor. DaLoop8 and MixticStudio never receive or store your card number, expiry date, or CVC. Stripe acts as an independent data controller for the payment details you provide it directly on its hosted checkout page; see Stripe’s own privacy policy for how it handles that data. We store only the outcome of a payment (e.g. that a purchase completed, its tier/amount/currency, and Stripe’s session/transaction identifiers) so we can grant and support your license.
2.3 Service event logs
To operate, secure, and improve the service (including diagnosing problems
during multi-user jam sessions), the portal and jam servers record a
machine-readable stream of user-meaningful events. This is the same event
log documented for engineering purposes in USER_EVENTS.md; the honest,
current list is:
| Event | What it records | Why |
|---|---|---|
login_attempt |
account identifier, success/failure, reason | account security, abuse detection |
portal_connect |
successful in-app login (from the JUCE application) | service diagnostics |
download |
which build was downloaded, including IP address, and the account (if any) | license/download tracking, abuse detection |
room_connect / room_disconnect |
which account joined/left which jam room, and when | jam session operation, capacity planning |
commit |
that a track/loop was committed during a jam session (not the audio content itself, only the event) | jam session operation, diagnostics |
room_perf |
aggregate, throttled per-room latency and performance samples (not tied to identifying content) | reliability/performance engineering |
These events are written to local log files on our servers and, for cross-server analytics, to a MongoDB database we operate. They are not sold, rented, or shared with any third party for marketing purposes.
2.4 Jam session audio you record
When you take part in an online jam session, the loops you commit are stored on the jam server hosting that room, so that the room can be replayed, its history browsed, and the session resumed later. What is stored is:
- the audio itself, as compressed audio files;
- the per-commit record describing the session state at that moment – tempo, time signature, key/scale, which track changed, and the DaLoop8 name of the person who contributed each loop.
This is content data rather than event-log data, and it is kept separately
from the event stream described in Section 2.3. Access to stored jam audio
and room history requires a signed-in DaLoop8 account. We do not use this
audio to train machine-learning models and we do not license it to anyone who
does – see Section 8, and the DaLoop8 Content and Licensing Terms
(CONTENT_TERMS.md), which govern who else may access or reuse what you
record, and which differ between public jam rooms and private band rooms.
2.5 What we do NOT collect
We do not record the audio content of your loops as part of the service event logging described in Section 2.3 – those logs record that a commit happened, not what it sounded like. Jam audio is stored separately and only as described in Section 2.4. Audio you record offline, without joining a jam session, is never transmitted to or stored by us at all.
We do not use hardware fingerprinting for license activation – see
docs/ACTIVATION_DESIGN.md for the account-based approach used instead.
2.6 The website and the early-access waitlist
The daloop8.com website is a static site. It sets no cookies, and it does not use local storage, advertising trackers, or device fingerprinting. You can read every page of it without anything being stored on your device and without giving us any information at all.
Two things are collected only if you choose to act:
If you join the waitlist, we store:
- the email address you type in – this is the whole point of the form, and it is the only piece of information we ask you for;
- the IP address and browser user-agent of the request that submitted it;
- a random confirmation token, and which campaign link brought you to the
page (for example
utm_source=reddit) so we can tell which announcements actually reached people.
The IP address and user-agent are kept for two narrow reasons: they are our record that a specific request opted in, and they let us rate-limit and block scripted spam signups. They are not used to profile you, and they are not combined with anything else about you.
The waitlist is double opt-in. Submitting the form does not add you to anything: it sends one email asking you to confirm, and if you never click the link, the entry expires and no further mail is ever sent to you. That single confirmation email is the only message you receive unless you confirm.
Audience measurement. We count page views using a self-hosted, cookieless analytics tool running on our own server. It records the page visited, the referring site, and a coarse country, and it does not set a cookie, does not store anything on your device, and does not build a profile that follows you across sites or visits. Because nothing is stored on or read from your device, this does not require a consent banner under the ePrivacy Directive – which is precisely why we chose a tool that works this way rather than one that needs you to dismiss a dialog.
Unsubscribing. Every marketing email we send carries a working one-click unsubscribe link. You can also email us and we will remove you. Removal means the address is deleted or suppressed, not merely flagged.
3. Purposes and legal bases for processing
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and operating your account | account data | Performance of a contract (Art. 6(1)(b)) |
| Processing your purchase | payment outcome (via Stripe) | Performance of a contract (Art. 6(1)(b)) |
| Operating jam sessions / real-time collaboration | account data, room connect/disconnect, commit events | Performance of a contract (Art. 6(1)(b)) |
| Storing and replaying jam room content | jam audio and commit records (Section 2.4) | Performance of a contract (Art. 6(1)(b)) |
| Security, abuse prevention, fraud detection | login attempts, download IP addresses | Legitimate interest (Art. 6(1)(f)) |
| Diagnosing and improving service reliability | room_perf, aggregate event logs | Legitimate interest (Art. 6(1)(f)) |
| Responding to support requests | contact/account data you provide | Legitimate interest (Art. 6(1)(f)) / consent where applicable |
| Sending you early-access and launch email | waitlist email address (Section 2.6) | Consent (Art. 6(1)(a)), given by confirming the double opt-in link and withdrawable at any time |
| Proving that a waitlist signup was genuine, and blocking spam signups | waitlist IP address and user-agent (Section 2.6) | Legitimate interest (Art. 6(1)(f)) |
| Counting page views on the website | cookieless, non-identifying analytics (Section 2.6) | Legitimate interest (Art. 6(1)(f)) |
4. Data retention
Service event logs described in Section 2.3 are retained for 12 months from the event date, after which they are deleted or anonymized.
Waitlist entries (Section 2.6) are kept until early access opens and the launch announcements have gone out, or until you unsubscribe – whichever comes first – and are then deleted. An entry that is never confirmed expires after 7 days and is not mailed again. The IP address and user-agent attached to a signup are deleted with the entry.
Jam audio and commit records (Section 2.4) are retained as part of the room’s
history for as long as the room exists, so that the room stays playable. For
private band rooms, retention after a subscription ends is governed by the
Content and Licensing Terms (CONTENT_TERMS.md, Section 9.2): access in the
application stops, while band members keep read-only access and export through
the portal for a stated window before the content may be archived or deleted.
You may request removal of your own contributions at any time, subject to the
limits explained in CONTENT_TERMS.md.
Account data is retained for as long as your account remains active, plus a reasonable period thereafter to comply with legal and accounting obligations (e.g. purchase records, which tax law generally requires us to keep for several years), after which it is deleted upon request or account closure per Section 5.
5. Your rights (GDPR Articles 15-21)
If you are located in the European Economic Area (or another jurisdiction with equivalent rights), you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Erasure (“right to be forgotten”) of your data, subject to legal retention obligations (Art. 17)
- Restrict processing in certain circumstances (Art. 18)
- Data portability – receive your data in a structured, commonly used, machine-readable format (Art. 20)
- Object to processing based on legitimate interest, including for security/analytics purposes described above (Art. 21)
To exercise any of these rights, contact us at mixticstudiopro@gmail.com. We will respond within the timeframe required by applicable law (generally one month under the GDPR, extendable in complex cases with notice to you).
6. Hosting and international transfers
The website, the portal, the jam servers, the database and the analytics all run on a single virtual server rented from netcup GmbH (Karlsruhe, Germany), physically hosted in Austria. Both are inside the European Union, so the core service involves no transfer of your data outside the EEA.
Two processors we rely on are established in the United States, and using them means the data described below reaches that country:
| Processor | What reaches it | Why |
|---|---|---|
| Stripe | payment details you enter directly on its checkout page (see Section 2.2) | processing purchases |
| Resend | your email address and the contents of the emails we send you | delivering verification, password-reset and waitlist email |
Both are engaged under data processing terms incorporating the European Commission’s Standard Contractual Clauses. We use them because self-operating a payment stack or a mail sender would be materially worse for your security and for deliverability, not because your data is worth anything to us in the United States.
7. No sale of data
We do not sell your personal data. We do not share it with third parties for their own marketing purposes. Data is shared only with the service providers strictly necessary to operate DaLoop8 – Stripe for payment processing (Section 2.2) and Resend for sending email (Section 6) – each acting under their own applicable data protection terms.
We do not use an advertising network, we do not run retargeting pixels, and we do not embed third-party social or tracking scripts on the website.
8. No use of your recordings for AI training
We do not use your recordings to train machine-learning models, and we do not license, sell, or otherwise make them available to any third party that does. This applies to public jam rooms and private band rooms alike, and it is not conditional on your subscription tier.
We expressly reserve all text and data mining rights in the content hosted on
our services, including for the purposes of Article 4(3) of Directive (EU)
2019/790. That reservation is also expressed in machine-readable form, through
our robots.txt, through TDM reservation headers served with our responses,
and through the policy published at /.well-known/tdmrep.json.
The full commitment, including its limits, is set out in Section 5 of the
DaLoop8 Content and Licensing Terms (CONTENT_TERMS.md).
9. Cookies
The daloop8.com website sets no cookies at all. It stores nothing on your device, and our audience measurement is cookieless by design (Section 2.6). That is why you are not being asked to dismiss a cookie banner: there is nothing to consent to.
The DaLoop8 web portal – the separate application you sign in to – uses cookies and local storage limited to the authentication tokens that keep you signed in. Those are strictly necessary to provide a service you asked for, and are exempt from the consent requirement for that reason.
We do not use third-party advertising or tracking cookies anywhere.
10. Children
DaLoop8 is not directed at children and is not knowingly used to collect data from children under the age of digital consent in their jurisdiction.
11. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date above and, where required by law, communicated to registered users.
12. Contact
For any question about this policy or to exercise your rights, contact: mixticstudiopro@gmail.com