Privacy policy

Last updated: 24 October 2026

1. Controller

Sven Uwe Buhmeier, YourMusic.Studio, Warenburgstraße 42, 78050 Villingen-Schwenningen, Germany. Email: hello@familymiles.pro

2. Visiting this website

When you visit the site, our hosting provider Cloudflare processes technically necessary data (e.g. IP address, time, page requested, browser type) to deliver the site securely and protect it against attacks. The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR). We do not keep or analyse access logs ourselves. Cloudflare stores this data only as long as needed for delivery, security and troubleshooting and then deletes it automatically.

We use no cookies and no analytics or advertising tools, and we do not embed content from third parties such as Google Fonts, YouTube or social networks. Fonts, images and videos are served from our own domain via Cloudflare.

Saved language: When you choose a language, your browser remembers it (localStorage) so the site can show it again on your next visit. This information never leaves your device and you can delete it at any time in your browser settings. The legal basis is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because storing it is strictly necessary to show the language you asked for. If you have not chosen a language yet, the page checks only within your browser which language is set there and may suggest the matching language version. Nothing is stored in the process.

Links to Instagram, TikTok and YouTube: At the bottom of the page we link to our profiles. These are plain links. As long as you do not click them, no data is sent to these networks. Only when you open a link do you reach the provider’s site (Meta, TikTok, Google), where its own privacy policy applies. The “Share this page” button opens your device’s share feature or a menu with WhatsApp, Message, Email and “Copy link”. WhatsApp opens the app or Meta’s wa.me page with a prepared text and the link to our site; as with any page visit, Meta receives your IP address and browser data. “Message” and “Email” open the matching app on your device, and “Copy link” only puts our address on your clipboard. Nothing is sent until you tap send yourself.

Our profiles on Instagram, TikTok and YouTube: If you view our posts there, comment or write to us, we process the information you show or send us there in order to communicate with you (Art. 6(1)(f) GDPR). The networks collect their own data under their privacy policies and provide us with aggregated statistics on the use of our profiles. Where we are jointly responsible with the network for this (Art. 26 GDPR), the provider’s arrangement applies: Meta Platforms Ireland Ltd. (Instagram), TikTok Technology Ltd. (TikTok) and Google Ireland Ltd. (YouTube), all Dublin, Ireland. You can exercise your rights with us or with the provider.

3. Launch notification

If you sign up for the launch notification, we store your email address, the language you chose, the time you signed up, the time you confirmed and the version of the consent text you agreed to. So that your confirmation and unsubscribe links work, we also store a hash of each link, not the links themselves. We use this data only to inform you about the launch of FamilyMiles and FamilyMiles news.

Providing your email address is voluntary and not required by law or contract. Without it, we simply cannot notify you.

Double opt-in: After you sign up, we send you an email with a confirmation link. You are only on the list once you have confirmed. Without confirmation, we delete your address automatically after 7 days.

The legal basis for the notification is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, using the unsubscribe link in every email or by sending us a message. When you unsubscribe, we delete your address immediately. It then remains in Brevo’s sending log (section 5) for no more than one month.

Proof of consent: We store the times of sign-up and confirmation and the version of the consent text so that we can prove that you gave your consent (Art. 7(1) GDPR). The legal basis is our legitimate interest in this proof (Art. 6(1)(f) GDPR).

Protection against misuse: To prevent mass sign-ups, we store a pseudonymised hash of your IP address (for IPv6, of your network range and additionally of the wider network range) with every sign-up, created with a secret key and the current day, not the address itself. In the same way, we use a pseudonymised hash of your email address to count how often a confirmation email was requested for it (no more than 3 per day), so that nobody can flood your inbox with sign-ups. The legal basis is our legitimate interest in protecting the sign-up and your inbox against misuse (Art. 6(1)(f) GDPR). We delete all of these hashes automatically after one day at the latest.

4. Contact form and email

If you write to us via the contact form or by email, we process your email address, your message, the time and, if provided, your name in order to answer your request. The legal basis is our legitimate interest in answering requests (Art. 6(1)(f) GDPR) or, for questions about a contract, Art. 6(1)(b) GDPR. Providing this information is voluntary, but without an email address we cannot reply.

The form does not store your message in our database. Our server forwards it as an email via Brevo to our mailbox. Brevo keeps only the sending log (section 5), not the content. Our mailbox is hosted by Apple iCloud (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). To prevent mass messages, we store only pseudonymised hashes of your IP address or network range for at most one day, as described in section 3. We delete messages once your request has been dealt with, unless statutory retention obligations apply.

5. Recipients and service providers

Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) runs the website, server function and database for us. The database with the email addresses is bound to the EU jurisdiction at Cloudflare and stored there. We have a data processing agreement with Cloudflare. For possible transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses also apply.

Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, a subsidiary of Brevo SAS, Paris, France) sends the confirmation and information emails on our behalf and forwards messages from the contact form to our mailbox. We have a data processing agreement with Brevo. Brevo may have data processed by subcontractors outside the EU; for transfers to the USA Brevo relies on the EU-US Data Privacy Framework (Art. 45 GDPR), for other transfers on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Brevo technically logs whether an email was delivered and may record opens and clicks per email. For this, links in the email may be routed through a Brevo server. Where Brevo records such information, this is based on our legitimate interest in reliable delivery free from misuse (Art. 6(1)(f) GDPR). We have configured Brevo so that opens and clicks are not linked to an email address. We do not analyse this information or use it for advertising. Brevo keeps sending logs (recipient address, subject, time, delivery status and, where applicable, opens and clicks) for one month and then deletes them automatically. Brevo does not store the content of the emails.

Apple iCloud (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland) provides our mailbox. All emails to hello@familymiles.pro and the messages from the contact form arrive there. Data may also be transferred to Apple Inc. in the USA. According to Apple, transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Apple processes the data as the provider of our mailbox; the legal basis is our legitimate interest in a reliable and secure mailbox (Art. 6(1)(f) GDPR).

Images in the confirmation email: When you open our emails, your mail app loads the images (Famy animation, logo) from our own domain. This creates the technical data described in section 2. We do not analyse who opened an email. If you prefer not to, set your mail app not to load images automatically.

We do not sell your data or pass it on for advertising purposes.

6. Storage period

We keep confirmed addresses until you unsubscribe, but no longer than 6 months after FamilyMiles launches and in any case no longer than 2 years after you signed up. After that we delete them automatically.

Backups: To protect against data loss, there are automatic backups of the database, kept for 30 days at Cloudflare and for 7 days on our own computer. They may also contain the hashes described in section 3. Older backups are deleted automatically, so deleted and unsubscribed addresses disappear from the backups after 30 days at the latest.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw your consent (Art. 7(3)). Just send us an email.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR, see sections 2 to 5), you can object to this processing at any time on grounds relating to your particular situation. An informal email to hello@familymiles.pro is enough.

You can also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, or with the authority responsible for us: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

There is no automated decision-making, including profiling.

8. Children

The launch notification is aimed at adults, i.e. parents and grandparents. Children should not sign up themselves. By signing up, you confirm that you are at least 16 years old.