{"id":3843,"date":"2026-09-21T09:27:09","date_gmt":"2026-09-21T07:27:09","guid":{"rendered":"https:\/\/swulabs.com\/privacy-policy\/privacy-policy-for-composed-live\/"},"modified":"2026-10-01T08:12:49","modified_gmt":"2026-10-01T06:12:49","slug":"privacy-policy-for-composed-live","status":"publish","type":"page","link":"https:\/\/swulabs.com\/en\/privacy-policy\/privacy-policy-for-composed-live\/","title":{"rendered":"Privacy Policy for Composed Live"},"content":{"rendered":"<div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-padding-top:200px;--awb-background-color:rgba(255,255,255,0.9);--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:calc( 1024px + 0px );margin-left: calc(-0px \/ 2 );margin-right: calc(-0px \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:0px;--awb-margin-bottom-large:0px;--awb-spacing-left-large:0px;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:0px;--awb-spacing-left-medium:0px;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:0px;--awb-spacing-left-small:0px;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-1 fusion-sep-none fusion-title-text fusion-title-size-one\"><h1 class=\"fusion-title-heading title-heading-left fusion-responsive-typography-calculated\" style=\"--fontSize:64;line-height:var(--awb-typography1-line-height);\">Privacy Policy for Composed Live<\/h1><\/div><div class=\"fusion-text fusion-text-1\" style=\"--awb-text-color:var(--awb-color8);\"><h2 aria-level=\"5\">1. Controller<\/h2>\n<p>The controller responsible for data processing in the Composed Live app (composedlive.com) is:<\/p>\n<p>Steffen Wutzke (SWu Labs) Scheppe Gewissegasse 7 35039 Marburg Email: <a href=\"mailto:mail@steffenwutzke.de\" target=\"_blank\" rel=\"noopener noreferrer\">mail@steffenwutzke.de<\/a> Phone: +49 (0)179 78 73 274<\/p>\n<p>This is a translation for your convenience. If the two versions differ, the German version applies.<\/p>\n<h2 aria-level=\"5\">2. The essentials<\/h2>\n<ul>\n<li>Composed Live uses no cookies, no analytics or tracking tools, no advertising, and embeds no third-party content.<\/li>\n<li>Without an account, all content stays on your device. Only with an account is it stored on our server and synced between your devices and with the people you share it with.<\/li>\n<li>Other members only see your username, never your email address.<\/li>\n<li>All data is stored on servers in Germany. We do not pass it on to third parties or transfer it to countries outside the EU.<\/li>\n<\/ul>\n<h2 aria-level=\"5\">3. Hosting and server log files<\/h2>\n<p>The app and its server are hosted by ALL-INKL.COM \u2013 Neue Medien M\u00fcnnich, owner Ren\u00e9 M\u00fcnnich, Hauptstra\u00dfe 68, 02742 Friedersdorf, Germany. A data processing agreement under Art. 28 GDPR is in place with ALL-INKL.<\/p>\n<p>Each time the app is accessed, technical access data is recorded in server log files: IP address, date and time, requested address, amount of data transferred, browser and operating system details and, where applicable, the referring page. This serves the secure and stable operation of the app and the investigation of faults or attacks (Art. 6(1)(f) GDPR). Log files are deleted after 30 days.<\/p>\n<h2 aria-level=\"5\">4. Using the app without an account<\/h2>\n<p>You can use Composed Live without registering. All content (bands, venues and companies, setlists, songs, events, notes and fields) is then stored only in your browser&#8217;s storage on your device and is not sent to us.<\/p>\n<h2 aria-level=\"5\">5. User account<\/h2>\n<p>You create an account to sync, share with others and use a license. For this we process:<\/p>\n<ul>\n<li>your email address (for signing in, confirming your address and resetting your password),<\/li>\n<li>a username of your choice,<\/li>\n<li>your password, only as a cryptographic hash (bcrypt), never in plain text,<\/li>\n<li>the time you registered, confirmed your email address and accepted the terms of use.<\/li>\n<\/ul>\n<p>The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).<\/p>\n<p>Who sees your username: the members of the bands, venues and companies you belong to. It appears in member lists, in groups, and on content you created or last edited. The app shows your email address only to you.<\/p>\n<p>As the operator, I can see registered accounts with their email address and license status in the admin area, as far as this is necessary for operation, support and preventing abuse (Art. 6(1)(f) GDPR).<\/p>\n<h2 aria-level=\"5\">6. Emails from the app<\/h2>\n<p>The app only sends emails your account requires: confirming your email address after registration and, on request, a link to reset your password. There is no newsletter and no marketing email. The sender is <a href=\"mailto:no-reply@composedlive.com\" target=\"_blank\" rel=\"noopener noreferrer\">no-reply@composedlive.com<\/a>; emails are sent through ALL-INKL&#8217;s mail server.<\/p>\n<p>The links contain a one-time random code, which we store only as a hash. A confirmation link is valid for 7 days, a password reset link for 30 minutes. Until your email address is confirmed, no content is transferred to the server.<\/p>\n<h2 aria-level=\"5\">7. Sync and your content<\/h2>\n<p>With a confirmed account, we store your content on the server so it is available on all your devices and to the people you share it with. For each item we store when it was created and last changed, and by which account. The legal basis is Art. 6(1)(b) GDPR.<\/p>\n<p>Your content may include information about other people, such as the names of band members or crew in notes. Please only enter what you need for your work.<\/p>\n<h2 aria-level=\"5\">8. Sharing, groups, invitations and public links<\/h2>\n<ul>\n<li><strong>Groups: Whatever you share with a group is visible to all its members. Private content is visible only to your account.<\/strong><\/li>\n<li>Invitations: An invitation is a link with a random code. Whoever opens it and signs in becomes a member of that group.<\/li>\n<li>Public links: Content you share with the &#8220;Public&#8221; group can be seen by anyone who has the link, even without an account. Public links contain no information about accounts or usernames. You can revoke them at any time; after that they stop working.<\/li>\n<\/ul>\n<h2 aria-level=\"5\">9. Preventing abuse<\/h2>\n<p>To prevent password guessing, mass registrations and flooding mailboxes, we count sign-in attempts, registrations, email requests and feedback messages per IP address, email address or account. We do not store the IP or email address itself, only an irreversible hash with a counter. These entries are deleted after two hours at the latest. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).<\/p>\n<h2 aria-level=\"5\">10. Error reports<\/h2>\n<p>So that I notice and fix errors, the app reports crashes and unexpected errors to our server, and the server reports its own. An error report contains the error message and its location in the program code, the app page without link codes, the app version, and browser and operating system details. It contains no content, no account and no IP address; email addresses and identifiers in error messages are masked before storage. Identical errors are grouped and deleted 30 days after they last occurred. The legal basis is our legitimate interest in an error-free app (Art. 6(1)(f) GDPR).<\/p>\n<h2 aria-level=\"5\">11. Feedback<\/h2>\n<p>You can send me a message via &#8220;Feedback&#8221; in the app. We store your message, any contact details you choose to give, the app version, the app page without link codes, and browser and operating system details. If you are signed in, the message is linked to your account so I can reply to you. I also receive it by email (sent through ALL-INKL). The message is deleted once it has been dealt with. The legal basis is our legitimate interest in improving the app and answering your request (Art. 6(1)(f) GDPR).<\/p>\n<h2 aria-level=\"5\">12. License check<\/h2>\n<p>If you enter a license key, our server regularly checks it with our own license server hub.swulabs.com. Only the license key and a random, pseudonymous identifier of your account are transmitted, not your email address. The legal basis is Art. 6(1)(b) GDPR. Purchases of a license in the shop on swulabs.com are covered by the privacy policy there.<\/p>\n<h2 aria-level=\"5\">13. Storage on your device<\/h2>\n<p>So that the app also works offline, it stores data in your browser&#8217;s storage (IndexedDB, Local Storage and the app&#8217;s offline cache):<\/p>\n<ul>\n<li>your content and the app&#8217;s own files,<\/li>\n<li>your session&#8217;s sign-in data, your email address and username for display, and the usernames of the people you work with,<\/li>\n<li>for unlocking without an internet connection, a hash of your password (PBKDF2) that never leaves your device,<\/li>\n<li>settings such as language, filters, sorting and expanded sections, and your license status.<\/li>\n<\/ul>\n<p>This storage is strictly necessary for the function you requested and therefore does not require consent (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). You can remove it at any time via &#8220;Sign Out&#8221; with the option &#8220;Delete all data from this device&#8221;, or in your browser settings.<\/p>\n<h2 aria-level=\"5\">14. Retention and deletion<\/h2>\n<p>We store your account data and content for as long as your account exists. You can delete your account in the app at any time (&#8220;Delete Account&#8221;). Then:<\/p>\n<ul>\n<li>Your account and all content only you could see are deleted.<\/li>\n<li>Content you shared with a group remains available to the band, venue or company, but is no longer linked to any account.<\/li>\n<li>Your memberships are removed; public links you created remain, no longer linked to your account.<\/li>\n<li>Deleted data is removed from the host&#8217;s backups after 30 days.<\/li>\n<\/ul>\n<h2 aria-level=\"5\">15. Data security<\/h2>\n<p>The connection to the app is always encrypted (HTTPS with HSTS). We store passwords and the codes in links only as hashes. After a password change, or with &#8220;Sign Out Other Devices&#8221;, all other sessions end immediately.<\/p>\n<h2 aria-level=\"5\">16. Your rights<\/h2>\n<p>You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). You can exercise many of these directly in the app: change your username, export your content and download it as a backup, delete your account. For anything else, an email to <a href=\"mailto:mail@steffenwutzke.de\" target=\"_blank\" rel=\"noopener noreferrer\">mail@steffenwutzke.de<\/a> is enough.<\/p>\n<p>You also have the right to lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte f\u00fcr Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany.<\/p>\n<h2 aria-level=\"5\">17. No automated decision-making<\/h2>\n<p>We do not make automated decisions or create profiles within the meaning of Art. 22 GDPR.<br \/>\nLast updated: 1 October 2026<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":0,"parent":3504,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"100-width.php","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-3843","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/pages\/3843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/comments?post=3843"}],"version-history":[{"count":2,"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/pages\/3843\/revisions"}],"predecessor-version":[{"id":3845,"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/pages\/3843\/revisions\/3845"}],"up":[{"embeddable":true,"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/pages\/3504"}],"wp:attachment":[{"href":"https:\/\/swulabs.com\/en\/wp-json\/wp\/v2\/media?parent=3843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}