Privacy Policy
1. Controller
Luca Quasebarth (stxrm808)
Legienstraße 42
65929 Frankfurt am Main
Germany
Email: storm808@flamesbounce.com
Phone: +49 160 6531342
2. What data we process
When you visit the website
When you visit this site, our hosting provider automatically records server log data: IP address, date and time, the page requested, the amount of data transferred, browser type and operating system. This data is technically necessary to deliver the site and to detect faults. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
When you buy something
To process a purchase, we process your email address, your name, your billing address, the date of purchase, the item purchased and the time you consented to waive your right of withdrawal. We never receive or store payment details such as card numbers — these are processed exclusively by the payment provider. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR for our retention obligations under tax law.
For VAT purposes we have to prove which country you buy from (Art. 24b of Council Implementing Regulation (EU) No 282/2011). For this, we store with your order, in addition to the country of your billing address, the country your IP address was located in at the time of purchase and the country of your payment method (e.g. the country that issued your card). We do not store the IP address itself for this. Legal basis: Art. 6(1)(c) GDPR. When you download, we store the IP address of the most recent use of a download link to detect misuse of the links (Art. 6(1)(f) GDPR).
When you sign up for the newsletter
If you sign up for our newsletter, we store your email address and the time you signed up. Legal basis: your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link at the end of every email.
When you activate a plugin
Plugins such as AURA may run on two computers at the same time. So that we can count this, the plugin sends your license key, a device ID calculated from the hardware and the name of your computer to our server when you activate it. The device ID is a hash value; the hardware cannot be derived from it. The computer name is only included so that you can tell your own devices apart in the list. While the computer is online, the plugin regularly checks whether the license is still valid — AURA usually once a day, REDLINE every fourteen days, more often if there is a problem with the license. It sends the license and the device ID. Legal basis: Art. 6(1)(b) GDPR (performance of the purchase contract) and our legitimate interest in enforcing the license terms, Art. 6(1)(f) GDPR. You can free up a slot yourself at any time — in the plugin or at www.flamesbounce.com/lizenz.
When you withdraw via the website
If you withdraw from a purchase at www.flamesbounce.com/widerrufen, we store your name, your email address, your order details, your message and the date and time of receipt. We send the confirmation of receipt required by law to this email address. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB), and Art. 6(1)(b) GDPR (handling of the contract).
3. Who we share data with
We use the following service providers. We have data processing agreements under Art. 28 GDPR with all of them. Where data is transferred to the USA, the transfer is based on standard contractual clauses or the EU-US Data Privacy Framework.
| Service | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website hosting, server logs, visitor statistics | USA |
| Stripe Payments Europe Ltd. | Payment processing, invoices, tax calculation | Ireland / USA |
| PayPal (Europe) S.à r.l. | Payment processing, if chosen | Luxembourg |
| Supabase Inc. | Database for orders and download permissions | EU region |
| Cloudflare, Inc. | Delivery of purchased files | USA |
| Resend, Inc. | Sending purchase, license and withdrawal confirmations | USA |
| MailerLite Ltd. | Newsletter delivery | Lithuania |
4. Visitor statistics
We use Vercel Analytics and Vercel Speed Insights to see which pages are visited and how fast they load. These services do not set cookies and do not build cross-site profiles; visitor identifiers are derived from technical data and discarded daily. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working website).
5. Cookies and browser storage
This website does not set advertising or tracking cookies. Fonts are loaded from our own server, not from third parties. The site only stores in your browser what you trigger yourself: the sign-in key when you sign in to your account, and the language you chose on the drum kit page. This is technically necessary (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).
Spotify playlist on the home page
On the home page you can load a Spotify playlist. The player by Spotify AB (Regeringsgatan 19, 111 53 Stockholm, Sweden) only loads when you click “Load playlist”. Until then, nothing is sent to Spotify. After the click, Spotify receives your IP address and technical details of your device and may set cookies; whether Spotify transfers data to the USA is governed by Spotify itself. Legal basis: your consent by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It only applies to this page visit: on your next visit the player is off again. Details: Spotify privacy policy.
6. How long we keep data
We keep order and invoice data for ten years, as required by Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). Download links expire after fourteen days. We delete newsletter data as soon as you unsubscribe. Server logs are deleted after thirty days at the latest. We delete device IDs linked to a license when the license ends. We keep withdrawals for three years from the end of the year in which they were received (limitation period); if they lead to a refund, the ten years for accounting records apply.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent you have given at any time with effect for the future.
To do so, write to storm808@flamesbounce.com. You can also lodge a complaint with a supervisory authority; the competent authority is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany.
Last updated: 15 October 2026