Privacy Policy

Last updated: 12 October 2026

This document is provided for transparency. It is not legal advice; have qualified counsel review it before relying on it in production.

1. Who we are

Controller: Foxy Laboratories OÜ
Address: Tartu mnt 67/1-13b, 10115 Tallinn, Harju maakond, Estonia
Website: https://www.foxylabs.eu
Email (privacy requests): info@foxylabs.eu
Data Protection Officer: Not applicable. Foxy Laboratories OÜ is a single-person controller and has not appointed a DPO under GDPR Art. 37.

2. What this policy covers

This policy describes how CrateFlow Live processes personal data when you use the public listener website (crateflow.live / related domains), including audio streaming, live mix feedback (votes and ratings), and optional analytics. It does not cover paid features on other channels: the listener site does not process card payments or donations.

3. Data we process

• Listener session — anonymous server-side session ID (cf_listener cookie), optional nickname, vote weight, rate-limit timestamps.
• Feedback — track/transition ratings, genre votes, optional chat text, linked to your session ID.
• Technical — IP address, user-agent, request timestamps (server and tunnel logs); audio stream connection metrics.
• Local preferences — last selected room and cookie consent choice in your browser (localStorage).
• Analytics (optional) — if you accept analytics cookies, Google Analytics 4 events (e.g. page views, listen minutes, room selection). See Cookie Policy.

4. Purposes and lawful bases (GDPR Art. 6)

• Provide the service (stream audio, display mix state, accept votes/ratings) — Art. 6(1)(b) contract / steps at your request and Art. 6(1)(f) legitimate interests (operate a live broadcast).
• Session integrity & abuse prevention (cookies, rate limits) — Art. 6(1)(f) legitimate interests.
• Aggregate statistics & product improvement (GA4 listen analytics) — Art. 6(1)(a) consent (ePrivacy / UK PECR aligned: no non-essential cookies until opt-in).
• Legal obligations — Art. 6(1)(c) where applicable.

5. Recipients & processors

• Google Ireland Ltd. (Google Analytics) — when you consent.
• Cloudflare — tunnel/CDN and security (see their DPA).
• Mixcloud — separate platform if you follow outbound links; not controlled by this site’s player analytics.

6. International transfers

Some processors may process data outside the European Economic Area (notably the United States). Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the processor’s published data-protection terms (e.g. Google Analytics and Cloudflare DPAs). Details are available from each provider.

7. Retention

We keep personal data only as long as necessary for the purposes above (GDPR Art. 5(1)(e)). We review retention categories at least once per year and erase or anonymise data when it is no longer needed.

• Listener sessions (in-memory): until the session expires or is cleared — currently up to 12 hours (cf_listener cookie TTL, configurable server-side).
• Ratings, votes, and related feedback in SQLite: retained for as long as needed to operate the broadcast, improve mix quality, and display aggregate trends. There is no fixed automatic deletion schedule at present; data is deleted when no longer required for those purposes, as part of normal operations, or on a confirmed data-subject erasure request (Art. 17).
• Server and Cloudflare logs: kept for security, troubleshooting, and abuse prevention for as long as needed, generally per provider defaults, then deleted or aggregated.
• Google Analytics 4: retention is set in your Google Analytics Admin (e.g. 2, 14, 26, 38, or 50 months, or “do not automatically expire”). Configure the shortest period that meets your reporting needs.

8. Your rights

Depending on your location, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact info@foxylabs.eu. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — https://www.aki.ee/en.

9. Children

The service is not directed at children under 16. We do not knowingly collect personal data from children under 16.

10. Changes

We will post updates on this page with a new “Last updated” date.