Privacy policy

As of November 2026. The German version is binding.

In short: without your consent, this website sets no cookies and loads nothing from third-party servers. Only if you choose “Accept” in the cookie notice do we use Google Analytics to count how the website is used. The Album 42 program works on your computer; your images are never uploaded.

1. Controller

André Lucas, Epic Art and Sound
Hopfenmarkt 3, 06449 Aschersleben, Germany
Email: info@album42.de

2. Visiting this website

The website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which runs it on our behalf (data processing agreement under Art. 28 GDPR). Each time a page or file is requested, the server automatically records: IP address, date and time, the requested address, the amount of data transferred, the status code, the previously visited page (referrer) and the browser and operating system.

Purpose: delivering the website, keeping it secure (e.g. detecting attacks) and finding errors. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The data is not combined with other data. Strato anonymises the IP addresses in the logs and keeps the logs available for six weeks; after that they are deleted.

3. Visitor statistics with Google Analytics – only with your consent

If you choose “Accept” in the cookie notice, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This shows us how the website is used – for example which page or search engine visitors come from, which sections they look at and whether they click “Download” or “Buy” – so that we can improve it.

For this, Google stores cookies in your browser (_ga and _ga_…, lifetime up to two years) and processes: pages viewed and clicks, time and duration of the visit, the previously visited page, device, browser, operating system, screen size and language, and the approximate location (country, region) that Google derives from your IP address. According to Google, Google Analytics does not store the IP address itself. Google signals and advertising features are turned off.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) of the German TDDDG). We have a data processing agreement with Google. Google may also process the data in the USA (Google LLC); Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission applies. The data is deleted after 2 months. More in Google’s privacy policy.

Without your consent, the website loads nothing from Google. Only your browser remembers your choice (in local storage) so that the notice does not appear on every visit. You can change or withdraw it at any time via “Cookie settings” at the bottom of every page .

4. Contact by email or contact form

If you write to us, we process your address and the content of your message to answer it. With the contact form, this is your email address, the message and – if you give it – your name; the form sends them to us as an email via our web space at Strato (see 2.) and does not store them there. The legal basis is Art. 6(1)(b) GDPR if it concerns a purchase or the use of Album 42, otherwise Art. 6(1)(f) GDPR. We delete messages once the request has been dealt with, unless statutory retention obligations (e.g. under commercial or tax law) apply.

5. Buying a license through Freemius

“Buy now” takes you to the Freemius checkout (checkout.freemius.com), operated by Freemius, Inc., 4023 Kennett Pike, Wilmington, DE 19807, USA. Freemius sells the license as authorised reseller (merchant of record) and processes the purchase data for this: name, email address, billing address, country, payment details and IP address. Payment is handled via Stripe or PayPal. For transfers outside the EU, Freemius refers to the standard contractual clauses of the European Commission. Details are in the Freemius privacy policy.

From Freemius we receive name, email address, country and order and license details. We use them to provide the license, help with questions and meet legal obligations (Art. 6(1)(b) and (c) GDPR), and keep them for as long as commercial and tax law require.

6. What the Album 42 program transmits

• Images, catalogue, image recognition: stay on your computer. The program has no usage statistics.
• Trial period: the program sends no license data.
• License: when activating, the program sends the license key, a device name and a device code to the Freemius license interface (api.freemius.com). The device name consists of the computer name and a short code; the short code and the device code are derived from the operating system’s device ID (the MachineGuid on Windows, the hardware UUID on the Mac) and do not reveal it. After that, the program checks the license at start-up and once a day using the license key, device code and activation ID. On Freemius and the transfer to the USA, see 5. Purpose: checking the license for one computer (Art. 6(1)(b) GDPR). Note: you can change the computer name in the settings of Windows or macOS if it contains your name.
• Error reports – only with your consent: if an error occurs, the program asks whether it may send us an error report; “Show details” shows exactly what would be sent. With the “Send automatically in future” tick box it no longer asks; you can change this in the settings at any time. A report contains the program version, the operating system and its version, the language, the error message with the location in the program and the last lines of the program log; file paths are made unrecognisable except for the file extension, as are user and computer names. Images, catalogue contents and license keys are never included. The recipient is the Sentry service (Functional Software, Inc., USA); reports are stored in Sentry’s data centre in Frankfurt am Main, Germany, without the IP address, and deleted after 90 days at the latest. For any access from the USA, Sentry is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission applies. The legal basis is your consent (Art. 6(1)(a) GDPR).
• Updates: the program asks album42.de for new versions and downloads them from there. This creates the server logs described in section 2.
• Image recognition: the program downloads the image recognition model once from Hugging Face (huggingface.co, Hugging Face, Inc., USA). Hugging Face receives your IP address (Art. 6(1)(b) GDPR).
• ffmpeg: only if you set it up in the settings, the program downloads ffmpeg, from gyan.dev on Windows and from ffmpeg.martin-riedl.de on the Mac. The respective provider receives your IP address.
• Detail map – only if you switch it on: in the “Places” view the program shows a built-in world map that needs no internet connection; it also determines places and place names without the internet. If you switch on “Detail map” there, it loads map images from OpenFreeMap (Hyperknot Software Kft., Hungary), delivered through the network of Cloudflare, Inc. (USA). They receive your IP address and the map area shown, never your photos. According to OpenFreeMap, requests are logged without the IP address and deleted after 7 days; Cloudflare is certified under the EU-US Data Privacy Framework. The legal basis is your consent by switching it on (Art. 6(1)(a) GDPR); you can switch the detail map off at any time with the same button.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object at any time to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). An email to info@album42.de is enough.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt), Otto-von-Guericke-Straße 34a, 39104 Magdeburg, Germany (Art. 77 GDPR).

There is no automated decision-making within the meaning of Art. 22 GDPR.