Privacy Policy

This is an English translation for your convenience. The German version prevails.

1. Controller

SiJoFX – Stöckl & Sannmann GbR represented by its partners Simon Stöckl and Joshua Sannmann Schierblicken 17, 23843 Bad Oldesloe, Germany E-mail: simon@sijofx.io

No data protection officer has been appointed, as there is no legal obligation to do so. For privacy questions, contact the e-mail address above.

2. Overview: what we do not do

We use no tracking, no analytics tools, no advertising and no social media plug-ins. The LUMACUE app sends no telemetry and no usage data; it works locally on your computer and connects to our server only to activate, renew and deactivate your licence. There is no cloud requirement. We make no automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

3. Hosting and server logs

3.1 The website https://lumacue.sijofx.io, the account, the licence server and our mail server run on a virtual server (VPS) of Hostinger International Ltd. in the Frankfurt am Main data centre, Germany. Hostinger processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

3.2 On every request the web server automatically stores: IP address, date and time, requested URL, HTTP status, amount of data transferred and user agent (browser, operating system). Purpose: operation, stability and security of the website, error analysis, defence against attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Logs are deleted after no more than {{LOG_TAGE}} days unless needed longer to investigate a specific security incident.

3.3 DNS: the domain sijofx.io and thus https://lumacue.sijofx.io is managed via Cloudflare, Inc. (USA) exclusively as a DNS service ("DNS only"). No Cloudflare proxy is active; your requests go directly to our server, and Cloudflare does not process any content or visitor data of our website. [Editorial note: if the Cloudflare proxy is activated, add a paragraph here on Cloudflare as processor with third-country transfer.]

4. Account

4.1 To create an account we process your e-mail address and a password. We store the password exclusively as a hash (argon2id). To confirm your e-mail address we send a confirmation link with a token (double opt-in); we store the time of registration and confirmation.

4.2 In the account we also store: your licences (tier, term, status), your activated computers (device identifier as hash, time of activation, app version), cancellation records and – after a purchase – the order and subscription status from Lemon Squeezy (section 6).

4.3 Purpose: provision of the account, management and verification of your licences, support, performance of the licence agreement. Legal basis: Art. 6 (1) (b) GDPR (contract). Storage period: until deletion of your account; you can delete the account yourself at any time. Data we must retain for legal reasons is deleted only after the respective period has expired.

4.4 Data export: in the account you can export your stored account data as a JSON file (Art. 20 GDPR).

5. Licence activation and licence server

5.1 On activation, periodic renewal and deactivation of a licence, the app transmits to our licence server: licence key, device identifier (a hash of device characteristics that does not allow serial numbers to be inferred), app version and time. The server issues a signed licence file (Ed25519) which is stored locally on your computer. This allows LUMACUE to run offline.

5.2 On the server we keep a minimal audit log with time, account and action (e.g. "activated", "renewed", "deactivated"). The IP address of the request appears in the server logs under section 3.2.

5.3 Purpose: verification of licence entitlement, limitation to 2 computers, protection against misuse. Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (f) GDPR (legitimate interest in protection against licence misuse). Storage period: licence and device data until deactivation or account deletion; audit log .

5.4 Beyond this the app transmits nothing: no usage data, no crash reports, no content of your projects, no data from connected DJ or lighting equipment.

6. Purchase and payment via Lemon Squeezy

6.1 You purchase LUMACUE Pro from our distribution partner Lemon Squeezy, LLC, 1 Market Street, Suite 400, San Francisco, CA 94105, USA (part of Stripe, Inc.; "Lemon Squeezy"). Lemon Squeezy is the seller (merchant of record) and processes the data of the ordering process as an independent controller: name, e-mail address, billing address, country, payment details (card or account details are processed exclusively by Lemon Squeezy or Stripe and never reach us), order and subscription status, IP address. Lemon Squeezy privacy policy: https://www.lemonsqueezy.com/privacy.

6.2 From Lemon Squeezy we receive via webhook: order and subscription status (e.g. paid, renewed, cancelled, refunded), your e-mail address and your account identifier (custom user_id), which we pass on when the checkout starts. Purpose: activation and management of your licence, allocation of payments to the account, processing of cancellations and withdrawals. Legal basis: Art. 6 (1) (b) GDPR (contract); for the prevention of fraud and misuse Art. 6 (1) (f) GDPR.

6.3 When the checkout starts we transmit to Lemon Squeezy your account identifier and, if stored in the account, your e-mail address to pre-fill the form. Legal basis: Art. 6 (1) (b) GDPR.

6.4 Third-country transfer: Lemon Squeezy and Stripe process data in the USA. Stripe, LLC (parent company) states (Stripe Data Privacy Framework Policy, as of 28 April 2026) that it is certified under the EU-US Data Privacy Framework; for certified companies an adequacy decision of the EU Commission applies (Art. 45 GDPR). Under its data processing agreement, Lemon Squeezy bases transfers on the EU Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

6.5 Storage period with us: order and subscription status until account deletion; we retain the allocation order number–account beyond that insofar as commercial and tax retention obligations (Section 147 AO, Section 257 HGB: up to 10 years) or the defence of claims require. Invoices are issued by Lemon Squeezy and retained under its own rules.

7. E-mail dispatch

7.1 We send transactional e-mails via our own mail server on the VPS (section 3.1): confirmation link on registration, password reset, contract confirmation after purchase, notices on licence and trial, cancellation confirmation, replies to support requests. No third-party provider is involved in sending.

7.2 Legal basis: Art. 6 (1) (b) GDPR (contract) and legal obligations to confirm in text form (Sections 312f, 312k BGB, Art. 6 (1) (c) GDPR). We do not send marketing e-mails.

7.3 Mail logs (sender, recipient, time, delivery status) are deleted, like the server logs, after no more than {{LOG_TAGE}} days.

8. Contact and support

If you write to us by e-mail, we process your details (e-mail address, content of the message, account data if applicable) to handle your request. Legal basis: Art. 6 (1) (b) GDPR if the request concerns a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding). Storage period: until the request has been dealt with and thereafter, insofar as required for documentation, up to (limitation).

9. Cancellation page

The cancellation page https://lumacue.sijofx.io/kuendigen can be used without login. We process the details entered there (e-mail address, name of contract, type and date of cancellation, order number and reason if given) exclusively to process and confirm the cancellation and to forward it to Lemon Squeezy. Legal basis: Art. 6 (1) (b) and (c) GDPR (Section 312k BGB). We store the cancellation records in the account until account deletion and, as evidence, until the limitation period expires.

10. Cookies and local storage

We use only technically necessary cookies and entries in your browser's local storage: a session cookie for logging in to your account and an entry for your language choice. They are required to provide the service you have expressly requested (Section 25 (2) no. 2 TDDDG); no consent is required, which is why we show no cookie banner. We use no analytics, marketing or tracking cookies and no third-party cookies. You can delete cookies and local storage in your browser at any time; the login may then no longer work. Payment takes place on Lemon Squeezy's pages; their cookie notices apply there.

11. Recipients

The only recipients of your data are: Hostinger International Ltd. (processor, hosting in Frankfurt am Main), Lemon Squeezy/Stripe (independent controllers for the purchase contract, USA, section 6), and bodies to which we must transfer data under a legal obligation. No data is passed on for advertising purposes.

12. Your rights

You have the right vis-à-vis us to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7 (3) GDPR). An e-mail to simon@sijofx.io is sufficient. You can also access and export your account data and delete the account directly in the account.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany. You may also contact the supervisory authority of your place of residence.

13. Obligation to provide data

An e-mail address and password are required for an account; without them we cannot provide the account and the licence. All other details are voluntary. For purchases, the mandatory fields at the Lemon Squeezy checkout apply.

14. Changes

We amend this privacy policy when our processing or the legal situation changes. The current version is always available at https://lumacue.sijofx.io/datenschutz.

Stand: 10.11.2026, Version 1.0 Changelog: 1.0 (10.11.2026) – initial version. The German version prevails.