Privacy

Who I am

Axel Drioli, trading as Axel Wild (United Kingdom), hello@soundingwild.com. I decide what happens to the personal data described here (the “controller”). Write to me about anything on this page.

Just visiting

No advertising and no tracking cookies. I count visits with Vercel Web Analytics. It uses no cookies and collects no personal data: I see how many times each page is viewed, which site sent the visit, and the country, browser and type of device, never who you are.

The fonts and the music player come from this site itself. Vercel, which hosts the site, keeps short technical logs (your address and the page asked for) for a short time to run and protect it.

The list of shows comes from a published Google Sheet and the posters from Google Drive, so your browser fetches them from Google, which sees your address. No cookies are set for this.

Videos and players from YouTube, Spotify, Bandcamp and Instagram load only when you press play. Until then nothing is fetched from them. Once you press play, that company’s player loads under its own privacy policy and may set cookies.

What: your first name, surname and email, the date and time you signed up, and the exact words you agreed to next to the button (with their version and language).
Why: to email you about new shows, releases and residencies. Lawful basis: your consent, which you can withdraw any time: reply “unsubscribe” to any email, or write to hello@soundingwild.com.
Where: a private Google Sheet only I can open, written through Google Apps Script; the form passes through Vercel on the way.
How long: until you unsubscribe. Then I delete your details.

Groovebox Exporter licences

What: your email, your password (only as a one-way scrambled code nobody can read back), your licence or receipt key, a one-way code made from your computer’s hardware id (not the id itself), your computer’s name and kind, the app version, and when you signed in and last used it. When you buy, Gumroad is the seller: I see your name, email and order, never your card details.
Why: to run the licence you bought (one computer at a time) and switch it off after a refund. Lawful basis: contract.
Licence check: the licence server asks Gumroad’s licence check (in the US) whether your receipt key is genuine and not refunded, when you first sign in and about once a day after that while the app is online.
How long: as long as your licence is used, plus 6 years for tax and contract records.

Preview requests

What: the name, email, computer, software and note you send with the Groovebox Exporter preview form.
Why: to choose testers and write to you about the preview. Lawful basis: steps you asked for before a licence (contract).
How long: 3 months after the preview ends, or sooner when you ask.

Feedback from the apps

What: when you press Feedback in Groovebox Exporter: your message and its kind, your email, your computer’s name and kind, the app version and which screen you were on.
Why: to reply and fix the app. Lawful basis: legitimate interests (making the app work well for the people who use it).
How long: until it’s dealt with, at most 2 years.

Emails to me

When you write to hello@soundingwild.com, I keep the conversation as long as it’s useful to answer you and follow up, at most 2 years after we last wrote, unless it becomes a booking or a sale (then 6 years, for the records the law asks for). Lawful basis: legitimate interests in answering you, or contract when it’s about a booking or a purchase.

Keeping the forms and sign-ins safe

The sign-up forms have a hidden field that only bots fill in and check how long the form was open (timed by the server, not your browser). When switched on, Cloudflare Turnstile (the “Verify you are human” box) also checks you’re a person, on the forms only, never elsewhere on the site, and without Cloudflare’s clearance cookie. Sign-in attempts are counted per internet address and kept for up to an hour, and attempts at my admin page for 15 minutes, so nobody can guess passwords. Lawful basis: legitimate interests in keeping the site and its users safe.

Who helps me run it

Vercel (US): hosts the site and its small servers, and counts visits (Vercel Web Analytics, no cookies, no personal data).
Upstash (a US-based company; region not stated): the database holding licence, preview and feedback records and the sign-in counters.
Gumroad (US): sells Groovebox Exporter and runs its licence check.
Google (US): the newsletter Sheet and Apps Script, and the events list and posters.
Cloudflare (US): Turnstile on the forms, when switched on.
GitHub (US): the Groovebox Exporter installers download from GitHub Releases, which sees your address when you download.
YouTube, Spotify, Bandcamp, Instagram: only after you press play, under their own privacy policies.

Nobody else sees your details, and I never sell them.

Data sent outside the UK

Vercel, Google, Cloudflare and GitHub receive data in the US under the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) and the EU–US Data Privacy Framework. Gumroad and Upstash receive it under standard contractual clauses.

Your rights

You can ask to see what I hold about you, to correct it, to delete it, to limit or object to how I use it, and to get a copy to take elsewhere. Where I rely on your consent (the newsletter), you can withdraw it any time. Write to hello@soundingwild.com; I answer within a month.

Complaints

If you’re unhappy with how your data is handled, write to hello@soundingwild.com; I’ll acknowledge within 30 days and reply as soon as I can. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator: ico.org.uk. If you live in the EU, you can also complain to the data protection authority where you live.