Privacy policy
Last updated: September 2026
In short: this website sets no cookies and uses no analytics, no tracking and no third-party content. To deliver the pages, our host has to process your IP address and some technical data. If you email us, use our contact form or write to us, we process your message; the contact form is a separate page that Tally runs for us (see section 3). You can object to this processing at any time – see section 6, “Your right to object”.
1. Who is responsible
The controller responsible for the processing of personal data on this website under the EU General Data Protection Regulation (GDPR) is:
Julius Gerheuser
c/o Manage and More, Kunstlabor 2
Dachauer Straße 90
80335 München, Germany
Email: julius@tapebox.music
In this policy, “we” and “us” mean Julius Gerheuser.
2. Visiting this website
This website is hosted on Firebase Hosting, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). When you open a page, Google processes the following data on our behalf: your IP address, the date and time of the request, the page or file requested, the amount of data transferred, the page you came from (referrer) and your browser’s identification (user agent).
Purpose and legal basis. We use this data to deliver the website to your device and to protect it against misuse and overload, for example attacks that flood it with requests. The legal basis is our legitimate interest in delivering the website quickly, reliably and securely (Art. 6(1)(f) GDPR).
Service providers. Google processes the data as our processor under the Firebase Data Processing and Security Terms. According to Google, it also uses certain data it collects while providing Firebase, such as IP addresses (“Firebase Service Data”), for its own purposes, for example to maintain and improve Firebase and to protect its users and Google; it does so in accordance with its own privacy policy. Firebase Hosting is a global service: Google stores the website on servers around the world and delivers it through the content delivery network of its subprocessor Fastly, Inc. (USA). Your request can therefore be processed on servers in other countries, including the USA (see section 4).
Storage period. According to Google, Firebase Hosting uses the IP addresses of incoming requests to detect abuse and to provide usage analyses to site operators, and keeps this IP data for “a few months”; Google does not publish an exact period. We have not switched on request logging: we see neither individual requests nor IP addresses, only totals such as the amount of data transferred.
Do you have to provide the data? No law or contract obliges you to. Without this data, however, the website cannot be delivered to you.
3. Contacting us
If you email us, we process your email address, your name if you give it, the content of your message, any attachments and the usual technical data of an email, such as date and time.
Purpose and legal basis. We use this data to answer your message and to handle any follow-up. The legal basis is our legitimate interest in replying to messages sent to us (Art. 6(1)(f) GDPR); if your message concerns a contract with us or steps before one, it is Art. 6(1)(b) GDPR. If you exercise your data protection rights, we process your request to meet our legal obligations (Art. 6(1)(c) GDPR).
Service provider. Our mailboxes are provided by Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA (service “Spacemail”), as our processor under its Data Processing Addendum. Emails are stored on servers in the USA that Spaceship uses to provide the service. Spaceship automatically scans emails to and from our mailboxes for spam, malware and illegal content, and at its discretion also has parts of email content checked by the moderation service of OpenAI. The legal basis for these checks is our legitimate interest in a mailbox that is secure and free of spam and malware (Art. 6(1)(f) GDPR).
Storage period. We delete emails no later than 12 months after our last exchange, unless the law requires us to keep them longer (for example tax law). Spaceship keeps daily backups for up to four weeks, so a deleted email can remain in these backups for up to four weeks. According to Spaceship, OpenAI keeps no content after a check, except abuse-monitoring logs, which it keeps for up to 30 days.
Contact form. Our contact form, linked in our imprint, is a page on the website of Tally BV, Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium (“Tally”), which provides the form to us as our processor under its data processing agreement. If you use the form, we process what you enter: your email address, your message and, if you give it, your name. Tally stores your submission on servers in the EU (Google Cloud, Belgium) and notifies us of it by email; the notification contains your entries and is sent through SendGrid, a service of Twilio Inc. (USA). We use your entries for the same purposes and on the same legal bases as emails. The notification and our reply are emails, so everything above about emails applies to them. We delete your submission in Tally no later than 12 months after our last exchange.
Opening the form. When you open the form, Tally processes your IP address and technical data about your browser and device in order to deliver the form and protect it against abuse; its pages are delivered through Cloudflare, Inc. (USA). To detect errors on its pages, Tally uses Sentry, a service of Functional Software, Inc. (USA): when the form loads, your browser sends technical data, including your IP address, to Sentry. The form sets no cookies, but Tally stores two random identifiers in your browser’s local storage: one for your session with the form and one that it keeps for later visits. You can delete them at any time by clearing the site data for tally.so in your browser. The legal basis is our legitimate interest in offering a contact form that works reliably and is protected against abuse (Art. 6(1)(f) GDPR).
Letters. If you write to us at the address in section 1, we handle your letter for the same purposes and on the same legal bases as emails.
Do you have to contact us? No. Contacting us is voluntary and not required by law or contract; without your contact details, however, we cannot reply.
4. Recipients and transfers to the USA
Your data is received by the service providers named above — Google and Fastly (hosting and delivery); Spaceship and, for spam and abuse checks, OpenAI (email); Tally with Google Cloud, Cloudflare, Twilio (SendGrid) and Sentry (contact form) — and, where they use them, by their other subprocessors (Google publishes its list at firebase.google.com/terms/subprocessors, Tally at tally.so/help/gdpr; Spaceship does not publish one). We do not sell your data and do not pass it on to anyone else unless we are legally obliged to, for example to authorities.
Google, Fastly and Spaceship are based in the USA, as are Twilio, Sentry and Cloudflare, which Tally uses; your data is therefore transferred to the USA:
- Google and Fastly have certified under the EU-U.S. Data Privacy Framework. While a company’s certification is active, transfers to it are based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR); the current status is listed at www.dataprivacyframework.gov. Otherwise, the European Commission’s Standard Contractual Clauses in Google’s data processing terms apply (Art. 46(2)(c) GDPR; firebase.google.com/terms/firebase-sccs), and Google must bind its subprocessors, such as Fastly, accordingly.
- Spaceship: transfers are based on the European Commission’s Standard Contractual Clauses (controller-to-processor module, Art. 46(2)(c) GDPR), which are part of Spaceship’s Data Processing Addendum. They oblige Spaceship to impose the same data protection obligations on its subprocessors, such as OpenAI.
- Tally is based in the EU. Transfers to its service providers in the USA are based on the adequacy decision where the recipient is certified under the EU-U.S. Data Privacy Framework (see above) and otherwise, as Tally’s data processing agreement requires, on the European Commission’s Standard Contractual Clauses or another safeguard provided for in the GDPR (Art. 46 GDPR).
You can also ask us for a free copy of these safeguards.
5. Cookies, browser cache and HTTPS
This website sets no cookies and uses no local storage, analytics, tracking pixels or third-party content; fonts and images are loaded from this website itself. The contact form is not part of this website; for the local storage it uses, see section 3. We do not use your data for profiling or for automated decisions (Art. 22 GDPR).
Like any website, it does cause your browser to store some information on your device: copies of the pages, images and fonts in the browser cache (we ask browsers to keep images and fonts for up to 24 hours) and an instruction, valid for one year, to open this website over HTTPS only. These files are the same for every visitor. Storing this information and using it again when you return is strictly necessary to provide the website you have asked for, so it does not require your consent (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). You can clear your browser cache at any time.
Pages are delivered only over encrypted connections (HTTPS). If you open an address starting with http://, that first request is sent unencrypted and is answered only with a redirect to HTTPS.
6. Your right to object (Art. 21 GDPR)
We process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR) to deliver and protect this website and our contact form, to answer your messages and letters, and to keep our mailbox free of spam and malware. You have the right to object to this processing at any time, on grounds relating to your particular situation.
If you object, we will stop processing your data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal email to julius@tapebox.music or a letter to the address in section 1 is enough. Please note that neither the website nor the contact form can be delivered to your device without processing your IP address.
7. Your other rights
You have the right to access your data (Art. 15 GDPR), to have inaccurate data corrected (Art. 16), to have your data erased (Art. 17), to restrict its processing (Art. 18) and to data portability (Art. 20). An informal email or letter to us is enough. On request, we will also explain how we weighed our legitimate interests against yours.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where you believe the infringement took place (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
8. Changes to this policy
We will update this policy before we change how we process personal data, for example before we add a waitlist, an analytics tool or file uploads to the contact form.