This notice explains how personal data is processed when you use HypeCloud, including HypeLink, HypeKit and HypeBio. Last updated: 29 October 2026.
You can also use these contact details to exercise your data protection rights.
When you visit the website, we process connection data required for its operation, including your IP address, requested URL, time of access, browser and device information, and technical error and security information. This enables us to deliver the website, resolve errors and prevent abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating a secure, functioning service.
The website is hosted and delivered by Vercel Inc., USA. Vercel and its infrastructure partners process page content, generated image previews, technical logs and connection data. Image previews are cached on the server to speed up delivery; current publication status or access permission is checked before they are delivered. Further information: Vercel privacy notice and data processing addendum.
To provide an account, we process your display name, email address, credentials in the protected form used by the authentication provider, confirmation status, registration and sign-in times, and session information. Administrators cannot view your password. Confirmation and password-reset links verify access to your email address. The legal basis is Article 6(1)(b) GDPR for providing the account you request. Measures to prevent abuse also rely on Article 6(1)(f) GDPR.
Registration details are required to provide an account. Without them, you can view public pages but cannot use your own account.
We process the profile and contact details, biographies, handles and links you enter, uploaded images, logos, documents and audio files, and release, promo and feedback data when you use the respective features. The legal basis is Article 6(1)(b) GDPR, to perform our agreement with you.
HypeKit and HypeBio are made public according to their publication settings. Public content and contact details can be viewed or copied by anyone and may be indexed by search engines. Changing content later cannot remove copies already made outside HypeCloud. Private audio promos are separate from public profile pages and accessible only within the scope of the respective sharing permissions.
If you enter another person’s contact details, such as those of your agency, make sure you are authorised to enter and, where applicable, publish them. A booking button first displays contact information and can then open your email application at your request. HypeCloud does not itself send a booking enquiry through this feature.
Database, authentication and file storage services are provided by Supabase Pte. Ltd., Singapore. This project uses a data region in Ireland. This does not rule out cross-border processing by the provider or its subprocessors. Further information: Supabase privacy policy, data processing addendum and data residency and transfers.
We process your email address, message content and delivery information to register, confirm and recover your account. Emails are sent through Resend (Plus Five Five, Inc., USA), with Ireland selected as the sending region. The legal bases are Article 6(1)(b) GDPR and, for security and troubleshooting, Article 6(1)(f) GDPR. Further information: Resend privacy policy and data processing addendum.
On public HypeBio pages, we count clicks on published links and social icons. Statistics store aggregate counters per link and account. These counters do not include IP addresses or individual visitor profiles. Clicks in the editor are excluded. We do not use analytics or advertising cookies for these statistics. Technical requests separately generate the connection data described in section 2.
Where personal data is processed for this purpose, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is simple reach measurement for link pages without individual visitor tracking.
For public HypeLinks, we also store aggregate page-view and store-click counters per link. Editor previews are excluded. These counts do not identify unique visitors and contain no IP addresses, cookies or visitor profiles. The counters become visible to the account holder and authorised administrators.
HypeAnalytics records daily aggregate public-page views for HypeBio, HypeKit and HypeLink, link and store clicks, and authorised HypeKit file download requests. Counters are grouped by account, date (Europe/Berlin), page or item, and activity type. They contain no visitor identifiers, IP addresses or cookies. Editor previews are excluded. Only the account holder and authorised administrators can view the reports. These are activity counts, not unique visitors or confirmed file transfers. The legal basis is our legitimate interest in privacy-preserving reach measurement under Article 6(1)(f) GDPR. Aggregates remain until the account or the relevant analytics data is deleted.
While a signed-in workspace is visibly open, we update its last-activity timestamp approximately once a minute. Authorised administrators can view this timestamp and the last sign-in time for account support. “Online” means activity was reported within the last two minutes; it does not mean continuous real-time monitoring.
Authorised administrators can inspect account status, display names, profiles, links, stored profile media and release metadata. For account support, they can edit display names and profiles and upload or remove profile media. They can manage administrator permissions and request password-reset emails to the registered address, but cannot view your password. Administrative changes are logged. The legal bases are Article 6(1)(b) GDPR for support in using the service and Article 6(1)(f) GDPR for security and accountable account administration.
When you enter a SoundCloud link in the editor, the URL is sent to SoundCloud from our server to request available metadata and artwork. Suggested artwork is copied into your media storage only when you choose it. No SoundCloud player is automatically embedded. This optional feature is provided under Article 6(1)(b) GDPR. The provider’s privacy information is available at soundcloud.com/pages/privacy. When you open an external link, you leave HypeCloud; processing on the destination website is governed by that website’s privacy notice.
HypeLink pages can include an optional SoundCloud preview. The external SoundCloud playback engine is loaded only after a visitor clicks the cover’s play button; SoundCloud then receives connection data and may use cookies or similar technologies. Uploaded preview clips are served by our storage provider and become public only through a published HypeLink. Private DJ-promo audio is not used for this feature. A HypeLink can also display the account holder’s enabled HypeBio social links after this option is selected.
We use technically necessary cookies for sign-in and session management. A language preference you select may also be stored. Working data, such as release and feedback information, may be kept in browser local storage within the signed-in workspace. This supports the functionality you request and is not cross-account advertising analysis. Storage that is strictly necessary falls under section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG); the legal bases described above apply to the associated personal data processing.
You can delete cookies and local storage in your browser. Doing so may remove your session and local settings. The current application does not integrate additional advertising pixels or external web analytics services.
Recipients include the technical providers named above and their subprocessors involved in delivering the service, authorised administrators and, for content you publish, the respective visitors. Authorities or other authorised recipients receive data only where required or permitted by law.
Vercel, Supabase and Resend are based outside the European Economic Area. Transfers to third countries must meet the requirements of Articles 44 et seq. GDPR. Information about the safeguards provided by each vendor, including standard contractual clauses and applicable adequacy decisions, is available in the data processing agreements linked above. You can request information and copies of relevant safeguards using our data protection contact details.
Account data and associated content are generally needed for the lifetime of the account or until the relevant content is deleted. When we receive a deletion request, we assess which data can be deleted and which remains necessary to meet legal retention obligations or establish, exercise or defend legal claims. During such retention, use is restricted to the respective purpose.
Technical logs and support data are needed only as long as necessary for troubleshooting, security checks or handling the relevant request. Provider retention and backup cycles also apply. Activity status retains the most recently reported timestamp rather than a continuous activity history. Link statistics consist of aggregate counters. Please contact us to request account deletion or information about specific retention periods.
Subject to the applicable legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing relies on your consent, you may withdraw that consent at any time with effect for the future.
Right to object: Under Article 21 GDPR, you may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation.
You may lodge a complaint with a data protection supervisory authority. In North Rhine-Westphalia, you can contact the State Commissioner for Data Protection and Freedom of Information at www.ldi.nrw.de, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany; email: poststelle@ldi.nrw.de.
The HypeCloud features described here do not involve solely automated decision-making, including profiling, that produces legal or similarly significant effects.