Polityka prywatności

1. Controller

The controller for data processing on this website (engineer-factory.studio) and in the Engineer Factory desktop software is:

Engineer Factory
Lessingstraße 8
76684 Östringen
Deutschland
Email: contact@engineer-factory.de
Phone: 017662803535

2. In short

• We process personal data only as far as your account, your purchase and the use of our products require.
• There are no social-media plugins and no external fonts: the website is served from our own server.
• Without your consent only strictly necessary cookies are set. The only third-party services are the TikTok Pixel and the Google tag (Google Ads) for measuring and delivering our ads; both are loaded only if you agree in the cookie banner, and you can withdraw that consent at any time under "Cookie settings" in the footer (section 13).
• Your audio files stay on your computer, and the AI functions run there. The software never uploads audio or project names to us; anonymised measurements and parameter decisions only if you expressly consent (section 9).

3. Legal bases

Depending on the purpose we process on the basis of Art. 6 (1) (b) GDPR (performance of a contract and pre-contractual steps), Art. 6 (1) (f) GDPR (legitimate interest in a secure, working service) and Art. 6 (1) (c) GDPR (statutory retention duties). We rely on consent (Art. 6 (1) (a) GDPR) only where we expressly ask for it.

4. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You may withdraw consent at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority.

An informal message to contact@engineer-factory.de is enough to exercise your rights. You can also delete your account yourself at any time in the account settings.

5. Hosting and server log files

The website and the licence server run on servers operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, server location Deutschland. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

When the website is opened and whenever the software contacts the licence server, the information your browser or the software transmits is stored in server log files: IP address, date and time, the address requested, the amount of data transferred, browser or software identifier and operating system. This data serves technical delivery, stability and the prevention of attacks and is not merged with other data. The legal basis is Art. 6 (1) (f) GDPR. Log files are deleted after a short period.

6. Cookies and local storage

Without your consent this website sets only strictly necessary cookies:

• __Host-mm_session (formerly mm_session) keeps you signed in. It is set only after login, is httpOnly, is transmitted only over an encrypted connection and expires after 30 days; for administrator accounts after 12 hours without activity and after 7 days at the latest. It contains nothing but a random session identifier; the session data is held on our server.
• __Host-mm_reauth is set only for administrator accounts, after the password was entered again for a security-relevant change, and expires after 10 minutes.
• mm_locale remembers your language choice, lifetime one year.
• ef_ref is set only when you arrive on an affiliate's referral link (an address with "?ref="). It holds nothing but the affiliate's code, nothing about you, and expires after 30 days. It serves to attribute a purchase to the referring affiliate (contract with the affiliate, Art. 6 (1) (b) and (f) GDPR). The arrival on the link is counted - under a daily rotating pseudonymous key derived from the IP address and the browser, from which no person can be recovered. ef_ref_new is a 10-minute helper cookie for that count. ef_code remembers a discount code you entered on the pricing page until the purchase (7 days). Affiliates see no names or addresses of customers, only figures.

In addition, your browser stores locally (localStorage, not a cookie, never leaves your browser) whether you chose light or dark mode, which choice you made in the cookie banner, whether you have already seen the demo's guide (section 8a) and - if you objected to our statistics - that objection (section 13).

The legal basis for storing information on your device is § 25 (2) no. 2 TDDDG (strictly necessary); for the subsequent processing, Art. 6 (1) (b) and (f) GDPR.

Only if you click "Accept" in the cookie banner do the TikTok Pixel (_ttp, _tt_enable_cookie, ttcsid and ttcsid_…, lifetime up to 13 months) and the Google tag (_gcl_au and, after a click on a Google ad, _gcl_aw or _gcl_gb, lifetime up to 90 days) also set cookies for ad measurement, and we keep a random identifier for our own statistics in your browser (ef_vid, localStorage, until withdrawn); details in section 13. The legal basis is then your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

7. Account

For an account we process your name, email address, a password you choose (stored only as a bcrypt hash, never in plain text), your language choice and the time at which you accepted the terms and acknowledged the withdrawal notice. After registration we send you an email to confirm your address; confirmation serves account recovery and is not a precondition for use. The legal basis is Art. 6 (1) (b) GDPR. The data is stored until you delete your account.

8. The Engineer Factory desktop software

The analysis of your audio files and the AI functions run entirely on your computer. For the analysis, audio data and file, project, track or plugin names are not transmitted to us; measurements only with your consent and only in the form described in section 9. Projects you save to your cloud are transmitted as described in section 8a.

Apart from that, the software talks to our server only to verify your account and licence and to provide updates. In doing so we process:

• Sign-in: your email address and password when you log in inside the software; afterwards a random access token issued per device, stored with us only as a hash and revocable at any time.
• Devices: a non-reversible device identifier derived on your computer from stable machine properties (the properties themselves never leave the computer), a device name, the operating system and the times of activation and of the last licence check. This is how the limit of 3 simultaneously active devices is enforced.
• Licence check: the status, plan and term of your licence. The software requests them at start and periodically afterwards and receives a signed confirmation that lets it keep working for a limited time without an internet connection.
• Licence events: activation, deactivation, the start and end of a subscription and other licence events are logged with a timestamp so that questions about payments and access can be answered later.
• Sign-ins: every sign-in to your account and every failed attempt - on the website or in the software - is logged with the time, the kind of device and browser and the IP address shortened to its network (e.g. 192.0.2.x), so that someone else accessing your account can be noticed. These entries are deleted after 90 days; the legal basis is Art. 6(1)(f) GDPR (protecting your account and our systems).
• Updates: on start the software asks our server whether a newer version exists, which produces the log data described in section 5. We hand out the installer only to accounts with a valid licence; for this the software sends its access token.

The legal basis for sign-in, devices, licence checks and updates - including the device identifier and the periodic validation - is Art. 6 (1) (b) GDPR (provision of the licensed software), supplemented by Art. 6 (1) (f) GDPR (protection against licence abuse). You can remove devices at any time in your account or inside the software.

8a. Engineer Factory in the browser and cloud storage

In the browser. The browser version runs on this website. Analysis and AI functions run inside your browser on your computer. Your projects and the audio files you import are kept by the browser in its own storage, accessible to this website only (Origin Private File System), on your computer; they stay there until you delete them or clear your browser's site data. You are signed in with your account (section 7); the legal basis is Art. 6 (1) (b) GDPR.

Cloud storage. Your access includes online storage for your projects. When you save a project to the cloud - in the browser version this happens automatically when you save, as long as the setting "Also save to the cloud" is switched on -, we transmit the project (the project file with track, plugin and project names and settings) and the audio files it uses and store them assigned to your account. For this we also process the project's name and size, a checksum of each file, a small preview (track colours and clip positions) and the times of saving, opening and deleting. Only your account has access - through the website or the software you are signed in to. The legal basis is Art. 6 (1) (b) GDPR (provision of the cloud storage).

The files are kept in Cloudflare R2, a storage service of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA), which we use as a processor. The storage is set up in Cloudflare's EU jurisdiction; the data is stored in the EU. Access from the USA cannot be ruled out; it is safeguarded by the European Commission's adequacy decision on the EU-US Data Privacy Framework or by standard contractual clauses.

You can delete projects yourself at any time; with a project, the files no other project of yours uses are removed. If you delete your account, all projects and files in your cloud are deleted.

After your access ends. When your access ends, we keep your cloud projects for twelve more months (terms, section 2.1a). Six months after the end we remind you by email, and once more 14 days before the deletion. Twelve months after the end, and no earlier than 14 days after the last reminder, we delete all projects and files in your cloud, on our side and at Cloudflare; your account stays. If you renew your access before then, everything is kept, and the period only starts again when the access ends again. As long as a subscription for additional storage runs, we delete nothing. If your access ended before 25 November 2026, the periods start on 25 November 2026. For these periods we store with your account when your access ended, when we reminded you and when we deleted; the emails and the deletion are also noted in our mail and administration log. The legal basis is Art. 6 (1) (b) GDPR.

Demo. Without an access, even without an account, you can try the browser version with a finished example project. The project is transferred encrypted and unpacked only in your browser's working memory; your browser keeps the encrypted package in its cache for up to one day so that it does not have to be loaded again the next time. What you change in the demo is not saved. As in the browser version, the DAW keeps its settings in your browser's storage, and your browser remembers whether you have already seen the demo's guide. We count when the demo was opened and when "Get access now" was clicked in it. If you are signed in or opened the demo through the link in our email (section 12), we assign this to your account; for this the link contains an encrypted identifier of your account, and nothing is stored on your device for it. Otherwise we assign it only to your visit in our own statistics (section 13). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to learn whether the demo helps people get to know our offer.

9. AI functions and model improvement

The AI functions of Engineer Factory ("AI Mixing", "AI Mastering", "Mixing + Mastering") measure your material and compute their proposals on your computer. No audio is uploaded for this; there is no data flow for audio.

Voluntary contribution to model improvement. Only if you expressly consent - inside the software or in your account under "AI data & privacy" - does the software send a small record to our server after an AI proposal that you apply, partly apply, undo or dismiss, so that we can improve the AI Engineer. It contains only:

• anonymised technical audio measurements of the tracks concerned (loudness, true peak, crest factor, loudness range, side-to-mid level, correlation, energy in six fixed frequency bands) - numbers only, rounded to one decimal;
• anonymised parameter decisions of the AI Engineer (kind of processor, EQ shape, frequency, gain, Q, ratio and further values from a fixed list) and whether the proposal was applied, partly applied, undone or dismissed;
• counts from a validation run (how many targeted values improved, stayed the same or got worse);
• terms from fixed lists that give the numbers meaning: track role, track kind, workflow mode, kind of request, application version and interface language.

Never transmitted - not even with consent - are passwords, payment data, information about your identity (email address, name, account ID, IP address, device identifier), audio content, names of any kind (files, folders, projects, tracks, plugins) and text you type. The software and the server accept only records with exactly this structure; anything else is discarded.

Pseudonymisation and separation from the account. A contribution is stored without account ID, email address, IP address, software or browser identifier and device identifier, separately from the account data. It carries only a pseudonym that our server derives from a random key held solely in your account and a server secret. The server log files described in section 5 are also produced by this transmission; they are not combined with the contributions.

Legal basis, withdrawal and erasure. The legal basis is your consent (Art. 6 (1) (a) GDPR). It is voluntary, not given by default, and use of the software does not depend on it. You can withdraw it at any time with effect for the future - inside the software or in your account. On withdrawal we delete all contributions stored under your pseudonym and replace the key, so later contributions cannot be linked to earlier ones. The same happens when you delete your account. If we change what is collected, we ask for your consent again; until then nothing is transmitted.

Retention. Contributions are deleted after 24 months at the latest, and immediately on withdrawal or deletion of the account.

10. Course and learning progress

While you use the course we store which lessons you have opened and completed and, for video lessons, the last playback position reached. This lets us show your progress and resume the last lesson. The legal basis is Art. 6 (1) (b) GDPR. The data is stored until you delete your account.

11. Payment processing via Stripe

Payments - one-off purchases and subscriptions alike - are handled by the payment service provider Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). The payment takes place on a page hosted by Stripe; you enter card or account details directly with Stripe, and we neither receive nor store them. Data transmitted to or processed by Stripe includes name, email address, amount, currency and payment method. From Stripe we receive a customer identifier, transaction and subscription identifiers and the payment status, which we store to match purchases and licences to your account. The legal basis is Art. 6 (1) (b) GDPR. A transfer to the USA may take place; it is safeguarded by the European Commission's adequacy decision on the EU-US Data Privacy Framework or by standard contractual clauses. Details: stripe.com/privacy.

12. Email

Transactional emails (address confirmation, password reset, purchase confirmation, notices about payments and cancellations, reminders before your cloud projects are deleted after your access ended) are sent via [jeszcze nie podano]. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Your email address and the content of the respective message are processed. The legal basis is Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR (account security).

Offers by email. If you have not bought anything after registering, we send you one email about an hour later with a link to the demo in the browser (section 8a) and a discount that is valid for your account for seven days. We may also send you individual further offers for our products by email. These emails are also sent via [jeszcze nie podano]. For this we process your account's name, email address and language, the time of registration, whether you have bought, when we sent the offer and until when it is valid, and whether you opened the link to the demo. The discount is taken off by our payment provider Stripe when you buy with your account (section 11); there is no discount code. The legal basis is your consent (Art. 6 (1) (a) GDPR) if you ticked the box at registration to receive offers and news by email, otherwise Art. 6 (1) (f) GDPR; our legitimate interest is to present our offer to you. You can object or withdraw your consent at any time: via the unsubscribe link in every offer email, via your email program's unsubscribe function or informally by email to us. After that we send you no more offers; emails about your account, such as invoices, still reach you. We store when you consented or unsubscribed as evidence.

Link by email. On the home page you can send yourself the link to our website by email from your phone ("Email me the link") to open it later on your computer. We use the address you enter only to send this one message with fixed content; it is not stored in our database, not assigned to a visit or an account and not used for advertising. To prevent abuse, our server keeps in memory for at most 24 hours how often mail was sent to a shortened hash of the address and from your IP address. Our statistics (section 13) only record that the email was sent; the link in the email carries campaign parameters ("utm_source=email") so that we can count a later visit through it. The legal basis is Art. 6 (1) (b) GDPR (your request), and Art. 6 (1) (f) GDPR for the abuse protection.

13. Reach measurement, TikTok Pixel and Google Ads

Our own statistics (no cookies). To understand how the website is used and which advertising brings visitors, we measure its use ourselves, in our own database on our server in Germany, without cookies and without third-party services. Recorded per visit: the pages viewed, how long a page was visible in the foreground, how far it was scrolled, which sections of the home page came into view, clicks on links and buttons (their label and target), whether the video on the home page played, how far it played and whether the sound was switched on, the origin (the previous website without its path, campaign parameters such as "utm_campaign" and whether the visit came from an ad click - we do not store the click identifier itself), device type, operating system, browser or the app in whose browser the page was opened, and the language set in the browser. A registration, opening the payment page and a purchase are assigned to the visit, a purchase together with your account identifier.

We do not store your IP address for this. To assign requests of the same day to one visit we form a hash value from IP address and browser identifier with a random key that is deleted when the day is over; after that the hash can no longer be linked to anyone, and visits on different days cannot be connected. Only if you choose "Accept" in the cookie banner do we also keep a random identifier in your browser (ef_vid) that lets us recognise that you come back on a later day; it is deleted when you withdraw your consent. The data is not passed on to third parties and is deleted after 14 months.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to improve the website and our advertising and to measure their success. For the identifier ef_vid the legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You may object to the measurement at any time: with the switch "Turn off statistics for this browser" at the bottom of this page (your browser remembers the objection) or informally by email (section 4).

TikTok Pixel. We advertise our products on TikTok. To measure whether these ads work and to show them to suitable users, we use - only with your consent - the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"). Without your consent in the cookie banner the pixel is not loaded and no data is sent to TikTok.

Once you consent, your browser loads a script from TikTok and sends TikTok in particular: IP address, browser and device information (user agent, screen resolution, language), the page visited and the previous page (referrer), the time, page views, and an identifier stored in the _ttp and ttcsid cookies. We also report the following events, with the licence plan chosen and its price: viewing the pricing page, choosing a plan and moving on to Stripe, submitting the registration, search terms in the FAQ, and a completed purchase.

For a completed purchase we also transmit your email address and your account identifier, but only as SHA-256 hash values (a one-way string that TikTok can match against its own data). So that a purchase counts even if you do not return to our site after paying, our server also reports it directly to TikTok (TikTok Events API), with the same details (plan, amount, currency, hash values, the identifier from the _ttp cookie). This happens only if your consent was in place at the moment of purchase. TikTok may link this data to an existing TikTok account and also use it for its own purposes, such as improving its advertising services. We and TikTok are joint controllers for collecting and transmitting the data (Art. 26 GDPR); TikTok alone is responsible for any further processing. TikTok may transfer data to countries outside the EU, including countries without an adequacy decision; TikTok bases such transfers on the European Commission's standard contractual clauses. Details: tiktok.com/legal/privacy-policy-eea.

The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). It is voluntary; the website works fully without it. You can withdraw it at any time with effect for the future by clicking "Cookie settings" in the footer and choosing "Necessary only"; we then remove the TikTok cookies from your browser. The cookies expire after 13 months at the latest.

Google Ads (Google tag). We also advertise our products in Google Search and on YouTube through Google Ads. To measure whether these ads work - for example whether someone registers after clicking an ad; neither name nor e-mail address is sent to Google - and to show them to visitors of our website (remarketing), we use - only with your consent - the Google tag (gtag.js) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Without your consent in the cookie banner the tag is not loaded and no data is sent to Google. We use Google Consent Mode: before it loads, the tag is told that no storage is permitted, and only with your consent is it given permission for ad cookies, ad data and personalisation; we never grant analytics storage, because we do not use Google Analytics.

Once you consent, your browser loads a script from Google and sends Google in particular: IP address, browser and device information, the page visited and the previous page (referrer), the time and page views, and an identifier stored in the _gcl_au cookie; if you arrive through a Google ad, the tag stores that ad's click identifier in _gcl_aw or _gcl_gb. Google may link this data to your Google account if you have allowed personalised advertising there, and may use it for its own purposes. We and Google are joint controllers for collecting and transmitting the data (Art. 26 GDPR); Google alone is responsible for any further processing. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. Details: policies.google.com/privacy and business.safety.google/adsprocessorterms.

The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future by clicking "Cookie settings" in the footer and choosing "Necessary only"; we then remove the Google cookies from your browser and tell the tag about the withdrawal. You can also switch off personalised advertising from Google at adssettings.google.com. The cookies expire after 90 days at the latest.

14. Contacting us

If you contact us by email we process your details to handle the enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns a contract, otherwise Art. 6 (1) (f) GDPR. We delete enquiries once they are settled and no retention obligations apply.

15. Retention

We store account data, learning progress, devices and licence data for as long as your account exists, as well as the information about offer emails (offers sent, consent, unsubscribing) and the use of the demo assigned to your account (sections 8a and 12). We store your cloud projects for as long as your account exists and your access runs; when your access ends, we delete them after twelve months and two email reminders (section 8a). If you delete your account, sessions, access tokens, activated devices, learning progress, course access, cloud projects with their files and contributions to model improvement are removed immediately, the demo's counts are separated from your account and the account is anonymised. Contributions to model improvement are also deleted when you withdraw your consent and after 24 months at the latest (section 9). Information about orders and invoices is retained for up to ten years due to commercial and tax obligations (§ 257 HGB, § 147 AO) - without any link to a person once the account has been deleted.

16. Data security

Transmission is encrypted via TLS. Passwords are stored only as a bcrypt hash, session and access tokens only as hashes. Access to course content, licences and administration functions is checked on the server; security-relevant endpoints are rate-limited against automated attacks.

17. Changes

We adjust this privacy policy whenever changes to processing require it. The version published here applies.

Last updated: 14 października 2026