Privacy policy

Controller

The controller for data processing on this website is Trustview, owned by Alpay Düzen, Starstraße 2, 22305 Hamburg, Germany. Tontable is a brand of Trustview and not a separate legal entity.

For any privacy question, write to support@tontable.com.

Principle: as little as possible

This website uses no analytics or tracking services. No scripts from Google, Meta or comparable providers are embedded. We do not build behavioural profiles and we do not pass data to third parties for advertising.

In particular, we store no IP addresses and no browser fingerprints in our database. Server logs are created for technical reasons when you visit; they remain with the hosting provider and are not analysed by us.

Data we process

When you create an account: your email address and password. The password is stored only as a cryptographic hash and cannot be read by us. Optionally a display name, country and preferred language.

When you buy: order number, package purchased, amount, time, and the wording, language and time of your consent to immediate performance. Payment details such as card numbers are processed solely by our payment provider; we never see them.

When you use the service: which tracks you downloaded and when, so that your quota is counted correctly and you can evidence your licences.

When you search: the search term, the filters set and the number of results. These entries help us align the catalogue with demand. For signed-in users the entry is linked to the account; for visitors who are not signed in, a fresh random identifier is generated for each search that cannot be traced back to a person.

Purposes and legal bases

Account, purchase, licence and download are processed to perform our contract with you (Art. 6(1)(b) GDPR). Without this data we cannot provide an account or a licence.

Records relating to orders that we must retain are processed to comply with legal obligations under commercial and tax law (Art. 6(1)(c) GDPR).

Search queries and the operation of the website rest on our legitimate interest in a functioning catalogue that reflects demand (Art. 6(1)(f) GDPR).

We send marketing email only where you have expressly consented (Art. 6(1)(a) GDPR). You can withdraw that consent at any time with effect for the future.

Retention

Account data is stored for as long as your account exists. If you delete your account we remove the account data, except for records we are required to retain.

Orders, invoices and licence records are subject to commercial and tax retention periods of up to ten years. We therefore cannot delete them early on request, only restrict their processing.

Search queries are retained in aggregated form; for visitors who are not signed in there is no link to a person.

Recipients and processors

Supabase — database and account management. Data is held in the EU region (Frankfurt am Main).

Cloudflare R2 — storage of the audio files. The buckets are explicitly restricted to the “European Union” jurisdiction.

Hostinger — operation of the server that runs the website.

Stripe — payment processing. For customers in the European Economic Area the responsible entity is Stripe Payments Europe Ltd., based in Ireland. Stripe receives the data required for payment directly from you; we receive only whether and how much was paid, plus a reference number.

Checkdomain — domain management and email forwarding. If you email us, the message passes through this service.

The data protection agreements required by law are in place with these providers. Transfers to third countries occur where a provider involves group companies there; such transfers are based on the European Commission's standard contractual clauses or an adequacy decision.

Your rights

You have the right to access the data stored about you, to have inaccurate data corrected, to erasure, to restriction of processing, to data portability, and to object to processing based on a legitimate interest.

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out beforehand.

An informal message to support@tontable.com is enough for any of these requests.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.