§ 1 Scope

These Terms of Service govern all contracts between Joviro (hereinafter “Provider”) and the user (hereinafter “Customer”) for use of the software-as-a-service platform Cuelist at cuelist.pro.

Deviating terms of the Customer shall not be recognised unless the Provider expressly agrees to them in writing.

§ 2 Service Description

Cuelist is a web-based tool that enables DJs to manage song requests from their guests in real time. Guests can submit requests via QR code or link; the DJ views, accepts or rejects them live.

The Provider makes the platform available under the selected subscription plans (Free, Starter, Pro). Current features per plan are listed at cuelist.pro/en#pricing.

No guarantee of uninterrupted availability is given. The Provider aims for 99% annual availability, excluding scheduled maintenance.

§ 3 Plans, Upgrades and Downgrades

Free plan: Free of charge, no minimum term, cancellable at any time.

Starter / Pro: Monthly subscription, cancellable at the end of the current billing period. Without cancellation the subscription renews automatically for a further month.

A downgrade to a lower plan takes effect from the next billing period. An upgrade is effective immediately; amounts already paid are prorated (via Stripe).

Upon a downgrade, plan-exclusive data and features of the previous plan are automatically disabled or deleted. In particular, scheduled sessions created under the Pro plan are permanently deleted when switching to Starter or Free. The Customer is responsible for exporting or backing up such data before downgrading.

§ 4 Prices and Payment

All prices are gross prices in euros including applicable VAT. Billing is monthly in advance via Stripe. Available payment methods include credit card, SEPA direct debit and other methods offered by Stripe.

In the event of default, the Provider is entitled to suspend access to the platform until all outstanding amounts are settled.

§ 5 Right of Withdrawal — Waiver for Immediately Usable Digital Services

§ 6 Cancellation

The Customer may cancel their subscription at any time in account settings via the Stripe Customer Portal. Cancellation takes effect at the end of the current billing period; access is retained until then.

The Provider is entitled to terminate the contract for cause without notice, in particular in the event of violations of these Terms or abusive use.

Following cancellation or expiry of the subscription, all Customer data (sessions, requests) will be permanently deleted after a 30-day grace period.

§ 7 Customer Obligations

The Customer agrees to:

• Keep login credentials confidential and not make them accessible to third parties.
• Not use the platform abusively (spam, automated mass queries, etc.).
• Not transmit unlawful content via the platform.
• Ensure that embedded content (song titles, artist names) does not infringe third-party rights — responsibility lies with the Customer.

§ 8 Liability

The Provider is fully liable for intent and gross negligence, and for damages arising from injury to life, body or health.

For slight negligence, the Provider is only liable for breach of a material contractual obligation and only for foreseeable, typical damages, capped at the amount the Customer paid in the 3 months preceding the damaging event.

Liability for indirect damages, lost profits or consequential losses is excluded in cases of slight negligence.

§ 9 Governing Law

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). Place of jurisdiction for merchants and legal entities under public law is Kiel, Germany.

Should individual provisions of these Terms be or become invalid, the validity of the remaining provisions is unaffected.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Joviro, Holzkoppelweg 20, 24118 Kiel, Germany
Email: [email protected]

2. Data Collected and Purposes

Cuelist collects and processes the following personal data:

• DJ accounts: Name, email address, password (hashed), chosen username (slug) – for providing the service and authentication.
• Guests: Name entered by the guest and submitted song requests (song title, artist) – for conducting the session. No account required.
• Payment data: Processed exclusively by Stripe. Cuelist does not store credit card data.
• Technical data: Server logs (IP address, timestamp, requested URL) for ensuring operation.
• Scheduled sessions (Pro plan): Activation date, time and timezone set by the DJ – for automatically opening the session at the chosen moment. This data is automatically deleted upon downgrading to a lower plan.

3. Legal Bases

Processing is based on the following legal grounds:

• Art. 6(1)(b) GDPR (performance of a contract): processing of account data and payment handling for registered DJs.
• Art. 6(1)(f) GDPR (legitimate interests): processing of guest data (name, song requests; guests are not contractual partners of Cuelist) – our legitimate interest is conducting the session for the DJ and guests and protecting against abuse. Likewise for technical server logs – legitimate interest in operational security and error analysis.
• Art. 6(1)(a) GDPR (consent): Google Analytics and Facebook Pixel (sections 7 and 8).
• Art. 6(1)(c) GDPR (legal obligation): retention of documents relevant under tax and commercial law (§ 147 AO, § 257 HGB).

Storing information on, or accessing information from, your device (cookies, localStorage) is additionally governed by § 25 TDDDG (German Telecommunications Digital Services Data Protection Act; see section 6).

4. Data Sharing

Data is only shared with:

• Stripe Inc. – Payment processing (Privacy Policy: stripe.com/privacy)
• Spotify AB – Song search (Pro plan only, Privacy Policy: spotify.com)
• Google Ireland Limited – Web analytics via Google Analytics (consent-based only, see section 7)
• Cloudflare, Inc. – DNS, CDN and attack protection (proxy; this involves processing of IP addresses, among other data; data processing agreement under Art. 28 GDPR, third-country transfer based on Standard Contractual Clauses or the EU-US Data Privacy Framework, Privacy Policy: cloudflare.com)
• Hosting providers within the scope of data processing agreements (Art. 28 GDPR)

Where data is transferred to countries outside the EU/EEA (in particular the USA), this is based on an adequacy decision of the European Commission (Art. 45 GDPR, EU-US Data Privacy Framework, where the recipient is certified) or on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

No data is shared for other purposes or with other third parties.

5. Retention Periods

Account data is retained until the account is deleted. Session and request data can be deleted by the DJ at any time. Server logs are automatically deleted after 30 days. Unverified accounts (without email confirmation) are automatically deleted after 1 hour. Scheduled session data is automatically removed upon a plan downgrade. Statutory retention obligations under § 147 AO and § 257 HGB (Art. 6(1)(c) GDPR) remain unaffected: 6 years for commercial and business letters, 8 years for accounting vouchers (e.g. invoices), 10 years for books and annual financial statements.

6. Cookies and Local Storage

Cuelist uses technically necessary session cookies for authentication. Guest tokens are stored in the browser's localStorage to avoid requiring guests to re-enter their name. Your consent to optional analytics services is also stored in localStorage (ga_consent). You can withdraw this consent at any time with effect for the future (Art. 7(3) GDPR) by clearing your browser data or contacting us.

Legal basis (§ 25 TDDDG): Session cookies, guest tokens and the stored consent decision are strictly necessary to provide the service you explicitly requested (§ 25(2) no. 2 TDDDG); no consent is required for these. All other access to your device (Google Analytics, Facebook Pixel) only takes place with your consent under § 25(1) TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR.

7. Google Analytics

With your consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyse website usage. Google Analytics uses cookies and similar technologies to collect and evaluate information about how this website is used.

• Data collected: pages visited, time on site, approximate location (country/region), device type, traffic source
• IP addresses are anonymised (anonymize_ip: true)
• Data transfer to the USA based on the EU-US Data Privacy Framework (EU Commission adequacy decision)
• Retention period: 14 months (Google Analytics 4 default)

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). Consent is voluntary and can be withdrawn at any time with effect for the future (Art. 7(3) GDPR; clear browser data or contact [email protected]).

Further information: Google Privacy Policy · Google Analytics Opt-out

8. Facebook Pixel (Meta)

With your consent, we use the Facebook Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Pixel allows us to measure the effectiveness of Facebook ads and to reach visitors with targeted advertising (remarketing).

• Data collected: pages visited, actions on the website, IP address, browser information
• Conversion events tracked: PageView (every page visit), CompleteRegistration (after email confirmation), InitiateCheckout (upgrade click), Purchase (after successful payment)
• The Pixel sets a cookie (_fbp) with a lifetime of up to 90 days
• Data may be transferred to Meta servers in the USA (basis: EU-US Data Privacy Framework)
• Pixel ID: 2148277052411843

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). Consent is voluntary and can be withdrawn at any time with effect for the future (Art. 7(3) GDPR; clear browser data or contact [email protected]).

Further information: Meta Privacy Policy · Meta Ad Preferences

9. Your Rights (GDPR)

Under the GDPR, you have the following rights against us as the controller:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact us at: [email protected]

Providing account and payment data is necessary to conclude the contract and use Cuelist; without this data no account can be created. Guests can only use Cuelist by providing a name. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

10. Data Security

All data is transmitted encrypted via HTTPS/TLS. Passwords are stored exclusively as hashes (scrypt, with an individual salt). Processing takes place on secured servers. Where service providers process data outside the EU/EEA, the safeguards described in section 4 apply.

11. Changes to This Policy

We reserve the right to update this privacy policy as needed. The current version is always available at cuelist.pro/en/legal.