PRIVACY POLICY

1. Introduction

This Privacy Policy explains how Creativium LLC ("we," "us," or "our"), operating the website Scordalus ("Website"), collects, uses, and shares information about you when you visit our Website or use its features. It applies under the EU General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG) and the California Consumer Privacy Act (CCPA/CPRA), among others.

2. Controller & Contact

We have not appointed a data protection officer, as we are not required to do so.

3. What Data We Collect

Every visit – hosting and server logs:

• Our Website is hosted by Hostinger International Ltd. (Cyprus, EU), including its content delivery network (CDN). When you open a page, your browser sends technical data that the server stores in log files: IP address, date and time, page or file requested, referring page, browser and operating system, and the amount of data transferred.
• We need this data to deliver the Website and to keep it secure (e.g. to detect attacks). Hostinger deletes these logs after a limited period under its own retention rules; we do not keep copies and do not evaluate them unless we investigate an attack.

Every visit – web fonts (Adobe Fonts):

• Our band typography is loaded from Adobe Fonts (Adobe Systems Software Ireland Ltd. / Adobe Inc., USA). To do this, your browser connects to Adobe's servers, which receive your IP address and browser data. Adobe states that it does not set cookies for font delivery and uses the data only to deliver the fonts and for licence accounting.

Only with your consent – Google Analytics 4:

• Online identifiers (cookie ID), shortened IP address, browser and device data, pages visited, time spent, clicks, approximate location (country/region), referral source.
• Provider: Google Ireland Ltd. (Ireland) / Google LLC (USA).

Only with your consent – embedded content and partner banners:

• YouTube players (we use the privacy-enhanced mode, youtube-nocookie.com), Spotify players and the Ko-fi widget load only after you allow “Marketing & Embeds”. Until then we only show a local preview image. Once loaded, these providers receive your IP address and browser data and may set cookies.
• The embedded merch shop on our Official Merch page loads only after you allow external content. Spreadshirt / Spreadshop then receives your IP address and browser data and may set cookies needed for the basket and checkout. The European shop is operated by sprd.net AG (Germany), the US shop by Spreadshirt, Inc. (USA). Orders, payment and shipping are handled entirely by Spreadshirt under its own privacy policy.
• The partner banners on our Dark Deals page are delivered by the affiliate network CJ (Commission Junction LLC, USA) and load only with your consent. Loading a banner and clicking it lets CJ and the advertiser record the impression or click (cookies, IP address, browser data) to attribute a later purchase to us.

When you click an affiliate link: Text links on Dark Deals lead via CJ or, for NordVPN, via NordVPN's own partner programme (Nord Security). After the click you are on their website; they may set tracking cookies there to attribute your purchase to us. We do not receive any personal data about you, only a report that a sale happened.

Data collected when you submit a fan vote (votes page):

• The option you selected, a timestamp (UTC) and a randomly generated browser identifier (client_id) stored in your browser's localStorage to prevent double votes. It is not linked to your name, email or IP address.
• Vote data is stored in a Google Sheet via Google Apps Script (Google LLC, USA).

Data you send us through the tribute upload form:

• What we receive: the photos you upload (up to 5), the title, the category, the name or handle you enter (or none, if you stay anonymous), your optional email address and your confirmations (consent to publication, age, permission of people shown).
• Photos: Your browser resizes the photos before sending them, and our server saves them again. This removes metadata such as location (GPS) and camera data.
• Storage: Submissions are stored in a protected area of our web server at Hostinger. They are not publicly accessible until we publish them.
• Spam protection: To limit abuse, we briefly store a one-way hash of your IP address to count submissions, and delete it after about one day. We do not store your IP address itself.

Data you send us through the reaction link form and the press article form:

• What we receive: the link you share (a YouTube video or a press article) and, only if you enter them, a song name or the name of the magazine, your name or channel and a short message. We do not ask for your email address.
• Storage and spam protection: The link is stored in a protected area of our web server at Hostinger until we have reviewed it and, if it fits, added it to our Reactions or Press page. As with the tribute form, a one-way hash of your IP address is kept for about one day to limit abuse.

Inner Circle launch notification: If you sign up with the “Notify me” form on the Inner Circle page, we store your email address, your name if you give one, and the time of sign-up in a protected area of our web server at Hostinger. Spam protection works as with the other forms (hidden field, minimum fill-in time, short-lived hashed device key).

Members area and Inner Circle account:

• Members password: If you log in to the members area (Soundcheck, Wallpapers) with the members password, we set a necessary cookie (scordalus_members) that keeps you logged in. It contains a random token, not your identity, and expires after 180 days.
• Account and membership (once available): If you take out an Inner Circle membership, we process your email address, a login code we email you, a session cookie, your membership status, purchases and downloads, and the customer ID of our payment provider.
• Payments: Payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA). You enter your payment details directly on Stripe's pages; we never see or store your card data. Stripe receives your name, email, billing address and payment data and processes them under its own privacy policy, partly as an independent controller (e.g. for fraud prevention).

Contact form: If you write to us through the contact form, we store your name, email address, the subject you choose and your message in a protected area of our web server at Hostinger, so we can reply by email. Spam protection works as with the other forms (hidden field, minimum fill-in time, short-lived hashed device key). We delete your message once your request is settled, unless we must keep it by law (e.g. a legal dispute).

Data you send us by email: If you email us (e.g. tributes, questions, rights requests), we receive your email address, your name as you give it and the content of your message. Emails are received and stored in our email account at Google (Gmail, Google LLC).

Stored in your browser only (localStorage): your chosen merch shop region, your filter choice in the members area, open sections in our backend and, on the votes page, your vote marker. This data never leaves your device; you can delete it in your browser settings.

4. How We Use Your Data

• Operating the Website: delivering pages, security, error analysis (server logs, fonts).
• Website analytics: understanding how visitors use our Website to improve it (Google Analytics, only with consent).
• Embedded content: showing music, videos, the Ko-fi widget and our merch shop (only with consent).
• Affiliate marketing: earning commissions on purchases made through our partner links and banners, at no extra cost to you.
• Fan submissions: reviewing tributes, reactions and press links and – for tributes only with your consent – publishing them, credited with the name you give us or anonymously.
• Inner Circle launch notification: sending you one email when the Inner Circle opens. Nothing else, no newsletter.
• Members area and membership: giving you access, running your membership, processing payments, sending login codes and receipts, and meeting our tax and accounting duties.
• Answering your emails and requests.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

5. Third-Party Services

This Website uses the following services. Where they act as our processors, we have data processing agreements with them; otherwise they are independently responsible for their processing.

Links to streaming platforms (Spotify, Apple Music, YouTube Music, Amazon Music, Deezer) and social networks (YouTube, Facebook, Instagram, Threads) are plain links: no data is sent to them until you click. When you click an external link, you leave our Website and the privacy policy of that site applies.

6. Cookies and Similar Technologies

Under the GDPR and the German TDDDG, we only store or read information on your device without your consent where this is strictly necessary for a service you requested. Everything else requires your consent.

• Necessary (no consent needed): scordalus_consent (stores your cookie choice, 12 months), scordalus_members (members login, up to 180 days), scordalus_member (Inner Circle account login) and the backend login (operators only).
• Analytics (consent): Google Analytics cookies (_ga, _ga_*, up to 14 months).
• Marketing & Embeds (consent): cookies and similar technologies set by YouTube, Spotify, Ko-fi, Spreadshop and CJ when their content or banners are loaded.

On your first visit we show a cookie banner. Nothing from the categories “Analytics” or “Marketing & Embeds” loads before you agree. If your browser sends a Global Privacy Control (GPC) signal, we treat it as “Reject all” and do not show the banner; you can still opt in yourself in the cookie settings.

Withdraw or change your consent at any time with effect for the future – when you withdraw, we delete the Google Analytics cookies and reload the page:

Open Cookie Settings

7. Advertising & Affiliate Disclosure

Our Dark Deals page is advertising. It contains affiliate links and banners (via CJ and the NordVPN partner programme). If you buy something through them, we may earn a commission at no additional cost to you. Affiliate partners have no influence on our other content.

8. Legal Bases (GDPR)

9. International Data Transfers

We are based in the United States, so data you send us is processed in the USA. Some of our service providers (Google, Adobe, CJ, Spreadshirt, Inc., Stripe, Inc.) also process data in the USA. For transfers from the EU/EEA we rely on the EU-U.S. Data Privacy Framework where the recipient is certified (e.g. Google, Adobe, Stripe), and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). sprd.net AG processes data in the EU. Hostinger is based in the EU; depending on the server location, data may be processed in the EU or, under Hostinger's data processing agreement with Standard Contractual Clauses, elsewhere.

10. Data Retention

11. Your Rights Under GDPR (EU/EEA and UK)

• Right of Access (Art. 15 GDPR)
• Right to Rectification (Art. 16 GDPR)
• Right to Erasure (Art. 17 GDPR)
• Right to Restriction of Processing (Art. 18 GDPR)
• Right to Data Portability (Art. 20 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live (Art. 77 GDPR)

Right to Object (Art. 21 GDPR): Where we process your data based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds.

To exercise your rights, contact us at: Show email

12. Your Rights Under CCPA / CPRA (California Residents)

• Right to Know the categories and specific pieces of personal information we have collected, the sources, purposes and recipients.
• Right to Delete your personal information, subject to certain exceptions.
• Right to Correct inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information for money. Google Analytics and affiliate tracking may count as “sharing” for cross-context behavioral advertising; this only happens with your consent, and you can opt out at any time in the cookie settings or with a Global Privacy Control (GPC) signal, which we honor automatically.
• Right to Limit the use of sensitive personal information: we do not collect sensitive personal information.
• Right to Non-Discrimination for exercising your rights.

Categories collected in the last 12 months: identifiers (email, IP address, cookie IDs), internet activity (pages visited, clicks), approximate geolocation, content you submit (photos, links, messages) and, for members, commercial information (membership, purchases). Sources: you, your device, and the services listed above.

To exercise your rights, contact us at: Show email. We will verify your request using the email address concerned and respond within 45 days. You may use an authorized agent.

13. Children

This Website is not directed at children under 13. Tribute uploads and the launch notification require you to be at least 16 years old; the paid membership requires you to be an adult (18+) or to have your parent's consent. We do not knowingly collect personal information from children. If you believe a child has provided personal information, please contact us at Show email and we will promptly delete it.

14. Changes to This Privacy Policy

We update this Privacy Policy when our Website or the law changes. The current version is always available on this page with its “Last updated” date. Where a change requires your consent, we will ask for it again.

15. Contact

For any privacy-related questions, requests, or complaints: