PianoLabs ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have over it. It is designed to comply with the South African Protection of Personal Information Act, 2013 (POPIA), the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR, and equivalent data-protection laws in jurisdictions where our users are located.

If anything in this policy is unclear or you want to exercise a privacy right, email us at support@pianolabs.io.

1. Who we are and who is responsible

PianoLabs is operated from Cape Town, South Africa by [INSERT REGISTERED TRADING ENTITY], registration number [INSERT NUMBER]. We are the "responsible party" under POPIA and the "data controller" under the GDPR for the personal information described in this policy.

Information Officer (POPIA): [INSERT NAME AND ROLE], reachable at support@pianolabs.io. Our Information Officer is registered with the South African Information Regulator as required by section 55 of POPIA.

EU Representative (GDPR Article 27): [INSERT NAME AND EU ADDRESS, OR "We have not appointed an EU representative because our processing of EU residents' data falls within the Article 27(2) occasional-processing exemption. We will appoint a representative if this changes."]

UK Representative (UK GDPR Article 27): [INSERT NAME AND UK ADDRESS, OR the same occasional-processing statement.]

2. Information we collect

Information you give us

Account information — email address, display name, hashed password, and an optional profile photo.
Onboarding data — self-reported skill level, instrument, practice frequency, musical genres, and goals.
Billing information — name, country, billing email, and Paddle transaction identifiers. Payments are handled by Paddle.com, our merchant of record; full payment card numbers are processed by Paddle and never stored on our servers.
User-generated content — scores, projects, MIDI captures, recordings, posts, comments, marketplace listings, and any other content you upload or publish.
Support correspondence — messages you send us by email or via in-app forms.

Information we collect automatically

Practice and product data — notes played, exercise results, XP earned, streaks, session duration, feature usage, error reports.
Device and log data — IP address, browser type and version, operating system, referring URLs, page-view timestamps, and approximate location derived from IP.
Cookies and similar technologies — see our Cookie Notice for the full list, purposes, and retention periods.

Information from third parties

If you sign in with Google, we receive your email address, name, and profile picture from Google. We do not receive your Google password or your Google contacts.

We do not collect special categories of personal data (race, health, religion, sexual orientation, biometric data, etc.) and ask that you do not include any in your profile, posts, or messages to us.

3. How we use your information and our legal bases

We use your personal information for the following purposes, on the legal bases indicated.

Provide and operate the Service (authentication, progress tracking, exercises, leaderboards, account management) — performance of our contract with you (GDPR Art. 6(1)(b); POPIA s.11(1)(b)).

Process subscriptions, prevent and investigate fraudulent transactions, and meet our tax and accounting obligations — contract performance, legitimate interests in fraud prevention, and compliance with legal obligations (GDPR Art. 6(1)(b), (c) and (f)).

Improve our exercises, AI suggestions, and recommendations, and analyse aggregated usage to fix bugs and prioritise features — legitimate interests in improving the Service (GDPR Art. 6(1)(f)). We do not use your individually identifying data to train third-party general-purpose AI models. See Section 6 for how we use AI.

Send transactional emails (receipts, security alerts, important Service updates) — contract performance and legitimate interests in keeping you informed.

Send optional marketing emails about new features, lessons, or promotions — your consent, which you can withdraw at any time via the unsubscribe link or by emailing us.

Comply with legal obligations, respond to lawful requests from authorities, and enforce our Terms of Service — compliance with legal obligations and legitimate interests (GDPR Art. 6(1)(c) and (f)).

4. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects on you solely by automated means. Our AI features (chord suggestions, practice recommendations, groove analysis) generate suggestions but do not, on their own, take any decision that materially affects your rights, your subscription, or your access to the Service. You can always contact us if you disagree with an AI output.

5. Who we share data with

We share personal information only with trusted service providers who help us operate the Service. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Supabase Inc. — authentication, database, and storage hosting (data processed in [INSERT REGION]).
Paddle.com Market Ltd — merchant of record, subscription and payment processing. Paddle is PCI-DSS compliant.
Google LLC — Google OAuth, only if you choose to sign in with Google.
Lovable AI Gateway — provides our AI-assisted features. We send prompts and the minimum context needed; we do not transmit your account credentials, billing information, or full content libraries by default.
[INSERT TRANSACTIONAL EMAIL PROVIDER, e.g. Resend / Postmark] — delivery of account, billing, and transactional emails.
[INSERT ANALYTICS PROVIDER, e.g. PostHog] — privacy-preserving product analytics, only after you accept the analytics cookie banner.

Our current sub-processor list is also published on our Security page and updated when it changes. Enterprise customers can request a formal Data Processing Addendum.

We may also disclose your information when required by law, valid subpoena, court order, or to protect the rights, property, or safety of PianoLabs, our users, or the public.

6. AI features and your content

Our AI features use a third-party AI gateway (currently Lovable AI Gateway) to generate suggestions and analyses. When you use an AI feature:

What we send — the minimum prompt and context needed to produce the output (for example, a short chord progression or a snippet of your project), plus generic system instructions. We do not transmit your email, name, billing data, or full account history.

Retention by the AI provider — the AI provider may temporarily retain prompts for abuse-detection and reliability purposes in line with its own terms, which we vet before using a provider.

Training — we do not use, sell, or licence your User Content to train third-party general-purpose AI models. We may use de-identified, aggregated patterns derived from usage data to improve our own product heuristics and pedagogy. If we ever change this, we will give you advance notice and the ability to opt out.

You can decline to use AI features at any time. AI suggestions are pedagogical aids and are not guaranteed to be musically or pedagogically correct; always apply your own judgement.

7. International transfers

We are based in South Africa. Some of our service providers operate outside South Africa, the EU, or the UK. Where personal data is transferred internationally:

To the EU/UK, we rely on the destination country's adequacy status where available.
To the United States and other third countries, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and POPIA section 72 protections, including binding contractual commitments from our sub-processors.
You can request a copy of the relevant transfer mechanism by emailing support@pianolabs.io.

8. Data retention

We retain personal information only as long as needed for the purposes set out in this policy. Specifically:

Account profile and progress data — for as long as your account is active, plus 12 months after closure (so you can reactivate). After that, data is anonymised or deleted.
Billing records and tax invoices — 5 years after the transaction, to meet SA SARS and accounting requirements.
Support correspondence — 3 years after closure of the ticket.
Server and security logs — 90 days unless retained longer for an active security investigation.
User-generated content published to public areas — until you delete it, or your account is closed.
Marketing-consent records — until you withdraw consent, then deleted within 30 days.

If a longer period is required by law (for example, a litigation hold), we retain the relevant records for that period only.

9. Your rights

Subject to applicable law, you have the right to:

Access the personal information we hold about you and obtain a copy.
Request correction of inaccurate or incomplete data.
Request deletion of your account and associated personal data ("right to erasure" / "right to be forgotten"), subject to legal retention requirements.
Export your data in a structured, commonly used, machine-readable format ("data portability").
Object to or restrict certain processing activities, including any processing based on our legitimate interests.
Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Object to direct marketing at any time.
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
Lodge a complaint with a supervisory authority — in South Africa the Information Regulator (https://inforegulator.org.za, complaints.IR@inforegulator.org.za, +27 10 023 5200); in the EU, your local data-protection authority; in the UK, the Information Commissioner's Office (https://ico.org.uk).

To exercise these rights, email support@pianolabs.io from the email address on your account or use the in-app data tools in Profile → Privacy. We respond within 30 calendar days (GDPR/UK GDPR) or one month (POPIA, extendable by a further two months for complex requests, with notice). There is no charge for a reasonable request; we may charge a reasonable fee for manifestly unfounded or excessive repeat requests, or refuse them.

10. Security

We use industry-standard safeguards including TLS 1.2+ encryption in transit, AES-256 encryption at rest, bcrypt password hashing, Row-Level Security policies on our database, least-privilege access controls, and multi-factor authentication for all production-system administrators. See our Security page for more detail. No system is 100% secure; in the event of a personal-information breach likely to result in a risk to your rights, we will notify the South African Information Regulator and affected users as soon as reasonably possible (POPIA s.22), and the relevant EU supervisory authority within 72 hours (GDPR Art. 33), in line with our breach-response plan.

11. Children's privacy

PianoLabs is not directed at children under 13. We do not knowingly collect personal information from anyone under 13.

Users between 13 and 17 may use the Service only with the involvement of a parent or legal guardian who agrees to these terms on their behalf. In jurisdictions where the digital age of consent under data-protection law is higher than 13 (for example, 14 in Austria, 15 in France, 16 in Germany, the Netherlands, Ireland, and several other EU states), parental consent is required up to that age.

Under POPIA, anyone under 18 in South Africa is a "child" and we process their personal information only with the consent of a competent person (a parent or legal guardian) or where another lawful basis under section 35 of POPIA applies.

If you believe a child under 13 has provided us with personal information, please contact support@pianolabs.io and we will delete it promptly.

12. Cookies and similar technologies

For details of the specific cookies we use, their purposes, and their retention periods, see our Cookie Notice.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be communicated by email and by in-app notice at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact

For any privacy-related question, request, or complaint, email support@pianolabs.io with the subject line "Privacy" or write to:

[INSERT REGISTERED TRADING ENTITY]
Attention: Information Officer
[INSERT POSTAL OR PHYSICAL ADDRESS]
Cape Town, South Africa

You can also contact our EU/UK Representatives (where applicable) at the addresses in Section 1.