Privacy Policy / Datenschutzerklärung

§1 Controller (Verantwortlicher)

The controller within the meaning of Art. 4(7) GDPR for the processing of personal data on the CHOZEN platform is:

Thomas Ehresmann
Einzelunternehmen, Geschäftsbezeichnung CHOZEN
Reichenberger Str. 25, 36039 Fulda, Deutschland
E-Mail: privacy@chozen.io

See Impressum for full contact details and phone number.

§2 Categories of personal data we collect

2.1 Account data

• Full name (from Google OAuth)
• Email address (Google account email)
• Profile picture (imported from Google or uploaded by you)
• Username / display name; subscription tier and status; account creation date

2.2 Authentication data

• Google OAuth tokens (access / refresh)
• Session identifiers; login timestamps and IP address at login

2.3 Payment data

• Stripe Connect account ID, PayPal merchant identifier
• Transaction history (purchases, sales, payouts), invoice data, billing address (when provided)
• Full credit card numbers are never stored by CHOZEN — they are handled exclusively by Stripe / PayPal.

2.4 Content data

• Audio files (beats, instrumentals, stems, loops, samples, oneshot kits, templates)
• Metadata (title, BPM, key, genre, mood tags, description)
• Cover artwork and visual assets; license configurations and pricing

2.5 Interaction data

• Comments, direct messages, forum posts; votes, likes, saves, reposts
• Follow / unfollow relationships

2.6 Behavioural data

• Play history (tracks played, timestamps, duration of play)
• Search queries, Discover-feature swipes, page views, scroll depth
• Download history

2.7 Competitive data (FL Ranked)

• Matchmaking Rating (MMR) and rating history
• Match history (opponents, results, scores); division / rank progression
• Tournament participation and results; season statistics

2.8 Technical data

• IP address; device type, OS and version; browser type and version
• Mobile app version and build number; desktop app version
• App telemetry (crash reports, performance metrics)
• Screen resolution, viewport size, timezone and language preferences

2.9 Third-party integration data

• Google account information received via OAuth
• Embed-player interaction data from third-party sites

2.10 Collaborator data

• Collaborator names, roles, revenue-share percentages
• Collaborator contact email for split notifications

2.11 Producer-collected emails

• Email addresses of buyers / fans collected through the producer email-collection feature
• Opt-in timestamps and consent records; segment assignments
• For these emails the Producer is the Controller and CHOZEN is the Processor — see §12.

2.12 Screen capture data (CHOZEN Ranked Overlay desktop app)

The CHOZEN Ranked Overlay (desktop app for Windows / macOS) can capture video frames of your selected window or screen and the corresponding system audio for the duration of a ranked beat battle. This is used to generate the post-match Reel that is shown back to you (and, where you choose to publish it, to other users).

• Legal basis: Art. 6(1)(a) GDPR — your explicit, revocable consent. The capture only starts after you grant the OS-level recording permission AND toggle the feature on in overlay settings.
• Opt-in / opt-out: Capture is opt-in. You can disable it at any time in the overlay settings — ranked play continues to work without it; only the post-match Reel will not be produced.
• Data category: video frames + system audio of the screen region you select. We do not capture your camera, microphone, or any window you have not selected.
• Recipients: The capture is streamed to our rendering service (Render.com, US) which assembles the Reel, then to Cloudflare R2 for storage. No further sharing.
• International transfer: Render.com is US-based. A Data Processing Agreement with Render.com is currently being arranged. Transfer relies on the EU-US Data Privacy Framework (where the processor is certified) or Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Retention: Intermediate frames are deleted within 24 hours of render completion. The final Reel is retained as long as the associated match remains in your account, then deleted within 30 days of match deletion.
• Publication. Reels are never shown publicly without your explicit consent. Sharing to other users (lobby feed, public reel feed, shareable link) requires a separate explicit action and a separate consent under Art. 6(1)(a).
• Right of instant removal ("Take down my footage"). Any person who appears in, or is the source of, a published Reel can request immediate removal at any time using the Remove my footage button on the Reel page. Effect:
  1. The Reel is taken offline immediately (within seconds, before any human review).
  2. You provide a short reason for the removal.
  3. The case is queued for review in the admin / support dashboard.
  4. After review the Reel either remains offline permanently or is restored — you are notified of the outcome.
  This right applies in addition to the general right of erasure under Art. 17 GDPR and the consent-withdrawal right under Art. 7(3) GDPR; it is faster and does not require contacting support.
• Sensitive content: Because the capture mirrors a selected portion of your screen, you should not include sensitive personal data (banking apps, private messages, etc.) in the captured region.

2.13 YouTube Data API (CHOZEN Uploader desktop app)

The CHOZEN Uploader desktop application (Windows / macOS) uses YouTube API Services to let you upload your own videos to your own YouTube channel. When you connect your Google / YouTube account you authorize CHOZEN to:

• upload videos to your channel on your behalf (youtube.upload); and
• read your channel's public profile — name, handle and avatar — so the app can show you which channel you are connected to and confirm the correct upload target (youtube.readonly).

• Data received and stored. Google returns an OAuth access token and refresh token. We store these tokens, their expiry and the granted scope on our servers (Cloudflare D1), linked to your CHOZEN account, solely to perform uploads you initiate. We never receive your Google password. The only YouTube data we display back to you is your channel name, handle and avatar.
• Use. We use YouTube API data only to provide the upload feature that is prominent in the app's interface. We do not use it for advertising, we never sell it, and no human at CHOZEN reads it.
• Google Limited Use. CHOZEN's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Revoking access. You can disconnect YouTube at any time in the app (Settings → Disconnect YouTube), which deletes the stored tokens immediately. You can also revoke access at myaccount.google.com/permissions. Deleting your CHOZEN account deletes all stored YouTube tokens (cascade).
• YouTube Terms. Use of the upload feature is also subject to the YouTube Terms of Service.

§3 Legal bases for processing (Art. 6 GDPR)

3.1 Performance of contract (Art. 6(1)(b))

Account creation and management, providing platform features, processing transactions and payouts, subscription management, facilitating license agreements between Producers and Buyers, competitive features (FL Ranked matchmaking), community features (DMs, forums, comments), gamification (XP, rank progression).

3.2 Legitimate interest (Art. 6(1)(f))

Platform security and fraud prevention, content recommendation, analytics for platform improvement, enforcement of our Terms of Service, technical infrastructure maintenance.

3.3 Consent (Art. 6(1)(a))

Non-essential cookies and tracking (see Cookie Policy), marketing communications and newsletters, screen capture by the Ranked Overlay (§2.12), publication of Reels to other users, producer email-collection (consent of the email subscriber).

3.4 Legal obligation (Art. 6(1)(c))

Tax documentation and invoice retention (§ 147 AO, § 257 HGB), responses to lawful authority requests, copyright infringement notifications, DAC7 seller reporting.

§4 Purposes of processing

• Operating the CHOZEN marketplace and creative community
• Authenticating you and securing your account
• Facilitating beat licensing between Producers and Buyers
• Processing payments and managing payouts
• Personalizing content recommendations and discovery features
• Operating FL Ranked competitive features
• Managing gamification (XP, ranks, achievements)
• Facilitating community interactions (forums, comments, DMs)
• Sending transactional communications (order confirmations, payout notifications)
• Platform improvement, analytics, fraud detection
• Complying with legal and regulatory obligations; resolving disputes

§5 Data retention

§6 Recipients and processors

Data Processing Agreements (Art. 28 GDPR) are in place or being executed with all processors. We do not sell your personal data.

§7 International data transfers

Several processors are US-based. Transfers rely on:

• EU-US Data Privacy Framework (DPF): primary basis for transfers to DPF-certified recipients (Cloudflare, Stripe, Google).
• Standard Contractual Clauses (SCCs): fallback for non-DPF-certified recipients, with a Transfer Impact Assessment.
• Art. 49 derogations: only in exceptional cases, with explicit consent or contractual necessity.

§8 Cookies and similar technologies

We use first- and third-party cookies and localStorage to ensure functionality, remember preferences, and (in future) analyze usage. Details, categories, and your consent options are documented in our Cookie Policy. Consent for non-essential storage is collected via our consent banner in compliance with TTDSG § 25 and GDPR Art. 6(1)(a).

§9 Your rights under GDPR

• Access (Art. 15): confirmation of processing and a copy of your data
• Rectification (Art. 16): correct inaccurate or incomplete data
• Erasure (Art. 17): "right to be forgotten" — subject to legal retention obligations
• Restriction (Art. 18) and Portability (Art. 20)
• Object (Art. 21): in particular against profiling for personalized recommendations
• Withdraw consent (Art. 7(3)): at any time, without affecting prior lawful processing

To exercise these rights, contact privacy@chozen.io. We respond within one month of receipt (extendable by two months for complex requests, with notice).

Right to lodge a complaint (Art. 77): you may complain to a supervisory authority, in particular in the Member State of your habitual residence. The competent authority for the controller is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, datenschutz.hessen.de.

§10 Automated decision-making and profiling

10.1 Algorithmic recommendations. The Platform profiles your behavioural data to personalize feeds and the Discover feature. This is not "solely automated decision-making producing legal effects" under Art. 22(1) GDPR because the recommendations are suggestions only, do not restrict access to content, and you retain full manual control. Legal basis: Art. 6(1)(f) legitimate interest, or consent where separately obtained.

10.2 Ranked matchmaking. FL Ranked uses an Elo-style MMR system to match opponents and determine division placement. This is necessary for the performance of the competitive feature (Art. 22(2)(a)). You can contest match outcomes via the dispute mechanism.

10.3 Object to profiling. You may object to profiling under Art. 21 at any time. A non-profiling (chronological) feed alternative is available in your account settings.

§11 Protection of minors

The Platform is intended for users 16 and older (Art. 8(1) GDPR; § 7 TTDSG). We do not knowingly collect data from anyone under 16. If you become aware that a minor has provided us data, contact privacy@chozen.io and we will delete it promptly.

§12 Producer email-collection feature

When a Producer activates email-collection on a content page, they act as independent data controller for the addresses they receive. CHOZEN acts as their processor under Art. 28 GDPR. Before the feature can be enabled, the Producer must accept a Data Processing Agreement (Auftragsverarbeitungsvertrag); the acceptance is recorded (timestamp, account ID, IP, DPA version) and gates the feature — CHOZEN does not collect addresses on behalf of a Producer who has not accepted it. Subscribers may exercise their data-subject rights directly with the Producer or use the unsubscribe link in each email. CHOZEN provides the technical infrastructure (Mailchimp integration where activated) but does not determine the purposes of marketing processing.

§13 Data Protection Impact Assessments (DPIAs)

Pursuant to Art. 35 GDPR, DPIAs are in preparation for the following processing activities where the risk profile warrants formal assessment:

• Discover-feed profiling (large-scale algorithmic recommendation)
• Ranked matchmaking (systematic MMR-based evaluation of individuals)
• Behavioural tracking for content discovery
• Ranked Overlay screen-capture pipeline

Mitigating measures already implemented include data minimization, opt-out controls for profiling, short retention windows (intermediate frames ≤ 24 h; behavioural data anonymized after 24 months), and the consent gate for the screen-capture pipeline. Final DPIA documents will be available to the competent supervisory authority upon request.

§14 Data breach procedure

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours (Art. 33) and, where the risk is high, the affected data subjects without undue delay (Art. 34). All breaches are documented internally regardless of notification obligations.

§15 Changes to this Privacy Policy

Material changes are communicated via email and a prominent notice on the platform at least 30 days before they take effect. The "Last updated" date at the top of this page indicates the most recent revision.

§16 Contact and DPO

Privacy enquiries and data-subject requests: privacy@chozen.io.

Data Protection Officer (DPO): Under § 38 BDSG, a designated DPO is not yet mandatory for CHOZEN as a sole proprietorship with fewer than 20 persons engaged in automated processing. We will reassess as the platform scales.