Privacy policy

Protecting your data matters to us. PianoLix is built to be data-minimal by design: we use no tracking cookies, we build no cross-device profiles, and we never sell data. Below we inform you pursuant to Art. 13 GDPR about the data we process.

1. Controller

Full provider details are in the legal notice.

2. Your rights

You are entitled at any time to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future.

An informal email to hello@pianolix.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

3. Hosting and server log files

PianoLix runs on a server within the European Union. When you access it, the server automatically records technical access data in log files (the page/file requested and the time, browser type/version, operating system, referrer URL, and briefly your IP address for delivery and abuse prevention).

The legal basis is our legitimate interest in secure, stable operation (Art. 6 (1) (f) GDPR). This data is not merged with other sources and is deleted after a short time.

4. User account and sign-in

To use the studio you create an account and sign in. We process your email address, optionally a name, and sign-in / session data.

• Legal basis: performance of the usage contract (Art. 6 (1) (b) GDPR).
• Account and authentication data are stored by our processor Supabase (Supabase, Inc.). A data processing agreement is in place; where data is transferred to third countries, the EU Standard Contractual Clauses apply.
• For sign-in and your session, technically necessary tokens are stored in your browser (see section 8).
• You can have your account deleted at any time; we then delete the associated data unless statutory retention obligations apply.

5. Payments (subscriptions)

For paid plans (Pro/Studio) we process payments through the payment provider Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.).

• At checkout you enter your payment details directly with Stripe; we neither receive nor store full card details. We only process subscription status, customer/subscription IDs and invoice data required to perform the contract.
• Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) and tax/commercial obligations (Art. 6 (1) (c) GDPR).
• Stripe may transfer data to the USA, safeguarded by the EU Standard Contractual Clauses. Details: stripe.com/privacy.
• Invoices and cancellation are handled via the Stripe customer portal.

6. Audio recording, upload and transcription

The core of PianoLix is turning audio into notes. You can record audio with your microphone or upload a file.

• The audio is transmitted only to our own server in the EU and converted into notes (MIDI) automatically by open-source models that run on that server ("Basic Pitch" and, on paid plans, a high-resolution piano transcription model). There is no disclosure to third parties for this purpose.
• Processing is transient, for the sole purpose of creating your result. On paid plans a copy of the decoded audio waits in a queue on our server until the high-accuracy model has processed it (usually a few minutes) and is deleted right after; the resulting notes (MIDI) are kept for up to 7 days so you can load them, then deleted automatically. The raw data is not retained or used for other purposes.
• Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). You are responsible for only processing audio you have the necessary rights to.

7. Feedback form

If you contact us via the feedback form, we process your message and - if you are signed in - the email address linked to your account, in order to handle your feedback.

• Legal basis: legitimate interest in handling it, or performance of the contract (Art. 6 (1) (f) or (b) GDPR).
• For delivery we use the email provider Resend (Resend, Inc.) as a processor.
• The form optionally offers dictation. If you use it, your browser's speech recognition is used; depending on the browser, the recording may be transmitted to the browser vendor. Use is voluntary.

8. Cookies and local storage (consent)

PianoLix uses no advertising or tracking cookies. For technical necessity we store information locally in your browser (local storage), including:

• sign-in / session tokens (so you stay signed in),
• your settings (e.g. theme, default difficulty, instrument choice),
• tutorials/notes you save locally to your library,
• a random, anonymous visitor identifier for the cookieless analytics (see section 9).

This storage serves solely to operate the service and to save your settings (Art. 6 (1) (f) GDPR and § 25 (2) TDDDG) and cannot be switched off. On your first visit we inform you via a banner; optional functions that require consent (anonymous usage statistics) are only activated after you agree, and can be changed at any time via "Cookie settings" in the footer.

9. Web analytics (cookieless)

To improve our offering we analyse usage anonymously - using our own self-hosted analytics as well as a server-side first-party statistic. Both are designed to be privacy-friendly:

• No tracking cookies. Your IP address is not stored; it is only briefly evaluated for a rough country assignment and then discarded.
• To roughly assign page views to a visit, an anonymous, non-identifiable key is used. No cross-device recognition takes place.
• We record e.g. pages viewed, referrer/source, rough region/country, device type, browser, and anonymous events (e.g. "transcription started", "video created").

The legal basis is your consent via the banner (Art. 6 (1) (a) GDPR) or our legitimate interest in needs-based design (Art. 6 (1) (f) GDPR).

10. External content (piano sound)

For a realistic piano sound in the studio, we load the sound library (soundfont) and the matching playback library from a content delivery network (jsDelivr) after you sign in. For technical reasons your IP address is transmitted to the CDN operator in order to deliver the files. This is required for the sound to work (Art. 6 (1) (b)/(f) GDPR).

11. Admin features

Certain features (e.g. publishing to our own social/YouTube channels, AI text suggestions) are available exclusively to the operator account and do not process the data of ordinary users.

12. Fonts

The fonts used (Geist) are served from our own server (self-hosted). There is no connection to third-party servers; in particular, no data is transmitted to Google.

13. SSL/TLS encryption

For security reasons this site uses TLS encryption, recognisable by the "https://" in your browser's address bar.

14. Updates

We adapt this privacy policy whenever the legal situation or our processing changes. The version published here applies in each case.