Data controller and contact
The data controller is Merijn Dijkstra / M-Producties, Tulpstraat 8, 4101GL Culemborg, the Netherlands. Chamber of Commerce 30249432. For privacy requests, access, correction, or deletion, email admin@m-producties.nl.
Privacy policy
EnsembleHub is built with privacy as the default: no marketing pixels, no third-party analytics, and no tracking cookies on public pages. Below we explain which data we do process and why.
What we process
We only process the data needed to run a workspace, rehearsal page, invite, and access link: name, email address, workspace and rehearsal content, plus hash/metadata for invites, access, and sessions. For members we also record which materials they opened and whether they signed up for or cancelled a rehearsal, so the organiser can see who is prepared. We keep a log of actions in a workspace (for example creating a rehearsal or inviting a member), without email addresses.
Legal bases for processing
We process data on the basis of performance of the contract (your account and subscription), a legitimate interest (security and bot protection of the service, and the occasional message to organisers about the use of their account, for example asking why they have not started yet; you can always unsubscribe from these), and a legal obligation (the retention requirement for payment records). We do not ask for special categories of personal data, such as health or religious information. Please do not put them in notes or materials either.
Cookies and preferences
We use three functional cookies. The preference cookie `ensemblehub_locale` remembers your language choice and is valid for 1 year. The session cookie `ensemblehub_session` keeps you signed in during an active workspace session and expires after 30 days. The cookie `ensemblehub_campaign` remembers for 180 days which offer brought you here (for example the ZINGmagazine reader offer), so the promised longer trial still applies when you come back later; nothing else is recorded with it. No tracking cookies or marketing pixels are used. A full overview of cookies and local storage is in our cookie statement.
Bot protection via Cloudflare Turnstile
On forms (account setup and support) we use Cloudflare Turnstile to keep out bots and spam. Turnstile processes technical data such as your IP address and browser signals to detect automated traffic. This involves a transfer to Cloudflare (United States) under appropriate safeguards (the EU-US Data Privacy Framework and/or standard contractual clauses). Turnstile is not used for advertising or tracking.
Email forwarding via mijn.host
Messages to support@ensemblehub.nl are forwarded via mijn.host (the Netherlands) to our admin mailbox. This processes your email address and the content of your support request so we can answer your question.
Payments via Mollie
Subscriptions are processed through Mollie B.V. (Amsterdam, the Netherlands). When paying, Mollie handles payment details such as IBAN or card data solely to complete the transaction. Mollie retains transaction data in accordance with the legal retention requirement of 7 years. See mollie.com/privacy for Mollie's privacy policy.
Email via Brevo
Transactional emails (invitations, access links, invoices) are sent via Brevo SAS (Paris, France). Brevo processes email addresses and delivery metadata. Data is stored within the EU (France and Belgium). For security and customer support, Brevo may engage parties outside the EU, under the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. See brevo.com/legal/privacypolicy for Brevo's privacy policy.
Analytics via Matomo
We use Matomo for visitor statistics. Matomo runs on our own server (Hetzner, Germany) and does not share data with third parties. We have enabled cookieless tracking: no cookie is placed and IP addresses are anonymised. No personal data is shared with external parties.
Hosting and storage via Hetzner
The app, the database, uploaded files and backups are hosted by Hetzner Online GmbH in Germany. Our own error tracking (GlitchTip) and Matomo run on the same server; that data is not shared with other parties. An error report contains technical details about the request, such as the page, the time and your browser.
Retention periods
Invite links expire after 72 hours, sign-in and returning-access links after 30 days (a new link invalidates the previous one), and sessions after 30 days. The log of actions is deleted after 180 days, error reports after 90 days. Workspace data is retained for as long as the ensemble exists. Cancelling a paid subscription deletes nothing: your ensemble continues on the free plan. If you delete your ensemble via Settings, the data is permanently deleted 30 days later — including uploaded files and the accounts of members who no longer belong to any ensemble. Deleted data may remain in our encrypted backups for up to 90 days; we only use those to restore the service after an outage. Invoices and payment data are retained for 7 years in accordance with legal requirements.
Exercise your rights
You have the right to access, correct, and delete your data. Send a request to admin@m-producties.nl. Include the workspace name for workspace-related requests. We respond within 30 days.