Privacy policy

Last updated: 25 September 2026

Who is responsible

The controller for the data described here is Horizon Labs GmbH, registered in Berlin, Germany. Our postal address, registration details and contact information are in the Impressum.

The short version

• Playing the drum pad collects nothing. No account, no sign-up, no tracking.
• We set no cookies and embed no analytics or advertising scripts.
• The only personal data we hold is the email address of people who deliberately sign up for the weekly lesson, plus a record proving that sign-up was genuine.
• You can unsubscribe from every email, at any time, in one click.

Using the drum pad

You can play the pad without giving us anything. There is no account, and playing it sends nothing to us — the sounds are downloaded to your browser and everything after that happens on your device.

If you connect a MIDI controller and remap the pads, that mapping is saved in your own browser's local storage so it survives a reload. It never leaves your device and we cannot read it.

Signing up for the weekly lesson

What happens to your address. The mailing list itself is held by MailerLite. They record your email address, the time you confirmed, and the IP address you confirmed from — the standard evidence that a real person asked for these emails, as double opt-in requires.

What we keep. We do not keep our own copy of the sign-up list. We do store a technical log of the notifications MailerLite sends us about subscriptions — someone confirming, unsubscribing, a message bouncing. Those notifications contain your email address, your subscription status and the IP address recorded at sign-up. We keep them so that a fault in our own software cannot silently lose a record of what you asked for. This log is deleted after 12 months.

Double opt-in. Submitting the form does not subscribe you. It sends you one email with a confirmation link. If you never click it, you receive nothing further and your address is never added to the list.

Legal basis. Your consent, under Article 6(1)(a) GDPR. You may withdraw it at any time under Article 7(3) — the unsubscribe link in every email does exactly that. Withdrawing does not affect the lawfulness of anything done before.

What you get. One finger drumming lesson a week and the occasional update about cut.fm. Nothing else, and we never sell, rent or share your address.

How long we keep it. Your address stays on the list until you unsubscribe. After that we keep the minimum needed to honour the unsubscribe and to show the original sign-up was lawful, for three years, then delete it.

Who processes your data for us

We use two processors. Both act only on our instructions.

• MailerLite (UAB "MailerLite", Lithuania) runs the mailing list, sends the confirmation email and delivers the weekly lesson. Subscriber data is stored in the EU. They act for us under their standard data processing terms.
• Cloudflare hosts the site, provides the bot protection on the sign-up form, and stores the event log described above in a database located in Western Europe. They act for us under their standard data processing terms.

Cloudflare, Inc. is based in the United States. Where data reaches them outside the EU, the transfer is covered by the European Commission's Standard Contractual Clauses, which form part of their data processing terms.

Bot protection

The sign-up form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. It is a deliberate alternative to reCAPTCHA: it sets no tracking cookies and does not profile you across sites. To do its job it processes technical information about your browser and your IP address. Legal basis: our legitimate interest in keeping the list free of fake sign-ups, Article 6(1)(f) GDPR.

Turnstile runs invisibly, so you will normally see nothing at all. Cloudflare's handling of the data it collects is described in the Cloudflare Turnstile Privacy Addendum.

Hosting and server logs

The site runs on Cloudflare Pages. Like any web server, Cloudflare processes connection data needed to deliver the page and to defend against attacks. How long they retain it is governed by their own privacy policy. Legal basis: our legitimate interest in operating the site securely, Article 6(1)(f) GDPR.

What this site deliberately does not do

• No cookies. We set none.
• No analytics or advertising. There is no Google Analytics, no advertising pixel, no social media tracker.
• Fonts are served from this domain. The site uses the Geist typefaces, hosted here. Your browser makes no request to Google Fonts or any other font service, so no font provider ever sees your IP address.
• No profiling and no automated decision-making.

Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data deleted (Art. 17);
• restrict how we process it (Art. 18);
• receive it in a portable form (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw your consent at any time (Art. 7(3)).

To exercise any of these, write to us using the contact details in the Impressum. For unsubscribing, the link at the bottom of any lesson is faster and works immediately.

Complaints

If you think we have handled your data improperly you can complain to a data protection supervisory authority. The one responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes

If this policy changes we will update the date at the top. Material changes affecting how we use your email address will be announced in the newsletter itself.