Effective Date: October 20, 2026
- You can use features of Fiveloop without creating an account. Website delivery, security services and onboarding campaign measurement may still process data, as described in Section 9.
- If you create an account, we collect the following information:
The account and music data listed above is linked to your account and stored securely in our Firebase database and storage.
We use your account and music data to provide and improve Fiveloop’s functionality, including:
Your songs and profile are private and are not shared with other users.
We do not sell, trade, or rent your personal information. We may share your information only in the following cases:
We use appropriate technical and organizational measures to protect your data. Your email, uploaded music, separated tracks, and analysis data are securely stored in Firebase. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Fiveloop is not directed to children under 13 years old. We do not knowingly collect information from children under 13. If we become aware that a child has provided us with personal data, we will delete it immediately.
We may update this Privacy Policy from time to time. Any changes will be posted on this page with the updated effective date.
If you have any questions about this Privacy Policy, please contact us at:
mail@duechtel.com
Stephan Düchtel
Frutolfstr. 26a
96049 Bamberg
Germany
The following information supplements Sections 1–8 for the account setup pages at /onboarding/, creator campaigns and web checkout.
For onboarding, Firebase Authentication processes your email address, account identifier, verification status and sign-in information. Email registration requires confirmation before you can continue. If you choose Google or Apple sign-in, the provider supplies the identifiers and account information needed for sign-in; this may include profile information or an Apple relay email address.
When you open onboarding through a creator campaign link or code, we measure page opens and, if you register or purchase, the results of that campaign. This helps us understand which campaigns lead to registrations and subscriptions.
We keep daily campaign totals for visits and verified registrations, and summarize checkout and subscription records for the private owner dashboard and CSV export. The dashboard is restricted to the owner. The system does not automatically send individual account records to creators.
This campaign measurement does not set tracking cookies or store a persistent visitor identifier in local or session storage. A short-lived signed visit receipt is held in the page's memory so a subsequent registration can be attributed. Account-linked campaign records are personal data; the absence of tracking cookies does not make them anonymous.
Onboarding skips new campaign visit and registration measurement when your browser sends Global Privacy Control, sends Do Not Track with the value “1”, or the onboarding URL contains no_tracking=1. You can open onboarding without this measurement before creating an account. This URL option applies to the page opened with it; it does not save a lasting preference or erase earlier records. Retain the parameter on any campaign link you open, or use a browser signal for later visits.
These choices do not disable authentication, security checks or the account and transaction records needed to apply a discount, manage a subscription and provide Premium. You can also contact us to object to campaign measurement or request deletion of account-linked attribution data.
Lemon Squeezy handles the hosted web checkout as merchant of record. To create and reconcile a checkout, we send your email address and account reference, the chosen plan, test/live mode, checkout attempt reference, security binding and, when applicable, the campaign and discount information. Lemon Squeezy collects the billing and payment details entered at checkout under its Privacy Policy.
We receive order, invoice and subscription updates and retain account-linked references, status, plan, campaign, discount, amounts, currency, payment dates and refund information. We use these to activate and maintain Premium, handle support and payment issues, report campaign results and enforce offer eligibility. Our onboarding backend does not receive your full card number or card security code.
Cancelling a subscription, archiving a campaign or using the no-measurement option does not automatically erase these transaction and promotion records. The campaign measurement retention periods do not apply to this separate ledger.
Our hosting and infrastructure providers process technical request information, including network addresses, to deliver pages, authenticate requests and prevent abuse. This is separate from the fields saved in our campaign event records.
Onboarding uses Firebase Authentication and Firebase App Check with Google reCAPTCHA Enterprise. Authentication and security services can process browser, device and network information and use browser storage or cookies for their own functions. Onboarding sign-in uses session storage where supported, with an in-memory fallback. App Check may cache security tokens. See Firebase's privacy information and Google's Privacy Policy. If you choose Apple sign-in, see Apple's Privacy Policy.
The main FiveLoop website also uses Umami for website usage statistics, separately from the onboarding campaign system. The onboarding pages do not load that analytics script. See Umami's Privacy Policy.
We use technical and organizational measures to protect your data, including access controls for account records and the private dashboard. No method of transmission or storage can guarantee absolute security.
Under the GDPR, we process account, music and subscription data to provide the services you request (Article 6(1)(b)). We process information required to meet applicable legal obligations under Article 6(1)(c). Our legitimate interests under Article 6(1)(f) are understanding creator campaign effectiveness, protecting accounts and services against abuse, enforcing promotion limits and resolving support requests and disputes. You may object to processing based on legitimate interests as explained below.
Where consent is required for a particular processing operation or access to information on your device, consent is a separate requirement; a privacy notice does not replace it. Any consent you give can be withdrawn for the future without affecting earlier lawful processing.
Expired attribution records are no longer used for new registration attribution. Database expiry deletion runs asynchronously, so physical deletion may occur after the expiry time rather than immediately.
Account, music, checkout, subscription, invoice, promotion eligibility and audit records have separate retention. The onboarding transaction and promotion ledger currently has no automatic deletion schedule. A checkout's validity period is not a deletion deadline. Retention depends on subscription administration, offer eligibility and abuse prevention, support, refunds or disputes, and applicable legal obligations. Contact us for a review or erasure request; the 90-day and 400-day limits above do not erase this ledger.
Account and music data are retained to provide your account and its features, subject to deletion requests and any applicable exceptions. Infrastructure logs, provider records and backups follow separate provider schedules. Deleting an app account must not be assumed to remove every separate billing or campaign record; contact us so your request can cover those records too.
The onboarding campaign database is located in Frankfurt, Germany. Authentication, security and payment providers may process information in the United States or other countries. Google's privacy information describes its EU–US Data Privacy Framework participation and data processing terms; Lemon Squeezy describes its international processing in its privacy policy. The provider links above explain these arrangements. Contact us for information about safeguards relevant to your data.
Subject to applicable legal conditions, you can request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. You can withdraw consent where processing relies on it and complain to a data protection supervisory authority, including where you live, work or believe an infringement occurred. Contact mail@duechtel.com to exercise your rights. You do not need to delete your account to object to optional campaign measurement.