Privacy policy

1. Controller and contact

The controller for processing carried out for Pianolia is [IDENTITY OF THE DATA CONTROLLER], at [BUSINESS ADDRESS]. Details are gathered in the legal notice.

Contact for your data: [EMAIL ADDRESS FOR EXERCISING RIGHTS]. Data protection officer, if a DPO is appointed: [DPO CONTACT DETAILS OR NOT APPLICABLE].

2. Data used

Projects and preferences in the browser

The workshop stores pieces, notes, edits, practice settings, exercises and improvisation history in your browser storage. It may also remember the active project and information needed to resume an ongoing analysis. Local mode keeps this data on the device. In the connected workshop, a Google or verified email account lets you save pieces, exercises and settings in your private library and find them on your devices. Older local projects are transferred only at your request.

Account and private library

Sign-in uses Amazon Cognito and, if you choose, Google. Pianolia uses an account identifier and your verified email address to link the library, credits and any subscription access. Projects are kept in private Amazon S3 storage; their list, owner, versions and settings are kept in Amazon DynamoDB. Cognito sign-in passwords are not stored in the Pianolia library.

Imports and analysis

In the static publication without an active transcription server, compatible formats, including MIDI and MusicXML, are read in the browser. If an API is available, an import may be sent to it. Analysis of audio, PDFs, images or YouTube links uses the corresponding server engines when available.

Data transmitted in that case may include the selected file, its name, piece title, supplied link, analysis options and a task identifier. The result may include recognised notes, musical metadata and, depending on the feature, a representation of the score. Do not include unnecessary personal information in files or their names.

Microphone and MIDI keyboard

Playing detection uses the microphone or MIDI keyboard with your permission. For playing feedback, sound is analysed in the browser without recording or transmitting audio. Importing a recording is a separate use: when a recording is selected for transcription and a server is available, that audio may be transmitted for analysis. You can revoke permissions in your browser.

Analytics with your consent

When Google Analytics 4 tags are configured in Google Tag Manager and you accept analytics, Google receives events about page and screen views, clicks with the public label and control location, setting changes, file type choices, import and export steps, and technical information needed for these measurements. Events added by Pianolia exclude imported files, filenames, piece titles and URL parameters. The purpose is to understand site usage, based on your consent. You can withdraw it with the “Cookies” button. Google may process this data outside the European Economic Area under its privacy policy. Analytics is configured to retain event data for two months and user data for fourteen months, resetting the user retention period upon new activity. These settings concern individual data; aggregated reports may have different retention. See the analytics details and choices.

Automatic language selection

Without a manual choice, Pianolia uses French if the browser's primary language is French or the detected country is France; otherwise, it uses English. For a non-French browser, a request to Country (api.country.is) estimates the country from the IP address. This request includes no cookies, page URL, project files or content. Pianolia keeps only the country code, not the IP address, and does not request GPS location.

The country code is reused for one hour in the tab’s session storage. After a failed lookup, another attempt is deferred for five minutes. Your manual FR/EN choice is remembered separately and always takes priority.

Country detection service: Country

Browsing and contact

As with any website visit, requests needed to display it communicate technical information to the hosting infrastructure, including the IP address and request characteristics. Arrangements for any technical logs remain to be specified below.

The contact form is currently disabled and sends no messages. When a contact channel opens, the name, email address and information you choose to provide may be used to respond to your request.

3. Purposes and legal bases

• Providing the requested workshop: opening a piece, remembering a project and its settings, carrying out the requested analysis. For necessary personal data, the basis is performance of the requested service.
• Ensuring operation and security: handling technical requests and preventing misuse, on the basis of the publisher's legitimate interest in providing a secure and available service, while respecting your rights.
• Responding to a request: handling information useful for your exchange, on the basis of a legitimate interest in responding or pre-contractual measures you request, depending on context.
• Complying with a legal obligation: handling a rights request or retaining information where required by law.

Choosing a file or authorising the microphone is not general consent to other uses of your data. This version offers no newsletter sign-up. This policy does not provide for using your files to train a model.

Providing a file or device access is optional for visiting the site; it is necessary for the feature requesting it. Information required for a future form must be identified when collected.

4. Recipients and transfers

Locally stored projects are accessible from the browser and device concerned. For server processing or email exchanges, data may be accessible to the publisher and providers needed for the request or hosting.

Providers, roles and processing locations to confirm: [HOST, ANALYSIS SERVER AND EMAIL PROVIDERS, WITH THEIR ROLES AND COUNTRIES].

Possible transfers outside the European Economic Area: [COUNTRIES CONCERNED, APPLICABLE MECHANISM AND SAFEGUARDS, OR ABSENCE OF TRANSFERS TO CONFIRM]. The information available here does not establish exclusively European hosting.

When you follow a link to a third-party platform, that platform applies its own policy. Music and photographic resources served with the site have their own credits.

5. Retention and deletion

In your browser: projects and settings may persist between visits until deleted, site data is cleared or the browser evicts them. Export items you want to keep. Moving a project to the bin is not permanent deletion: then use permanent deletion if you want to remove it.

Clearing site data in browser settings also removes local storage associated with the origin, including preferences. It does not delete files exported to your device or any files on a server.

Account library: saved projects remain linked to the account after changing browsers. Moving them to the bin frees a credit while retaining the possibility of restoration. Purging a project removes its saved notes; a source file shared with a copy or kept in durable storage may remain. To request complete deletion of the account and its files, use the contact details under “Your rights”.

Server analysis: [ACTUAL RETENTION PERIODS FOR SOURCES, RESULTS, RETAINED TASKS AND BACKUPS; PURGE ARRANGEMENTS TO CONFIRM]. Local deletion does not trigger deletion of server files. For requests about those files, use the contact details under “Your rights”.

Contact messages: [TIME NEEDED TO HANDLE THE REQUEST AND ANY JUSTIFIED ARCHIVING]. Technical logs: [ACTUAL CATEGORIES AND RETENTION PERIODS AT THE HOST AND PUBLISHER]. Retention required by law or necessary for a dispute must be limited to that purpose.

6. Your rights

Depending on the data, legal basis and conditions provided by the GDPR, you may request access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interests. Where processing relies on your consent, you may withdraw it for the future.

Request address: [EMAIL ADDRESS FOR EXERCISING RIGHTS]. Describe your request without initially sending an identity document; further information may be requested if needed to verify your identity. A response is normally provided within the statutory period of one month, subject to extensions allowed by regulation.

For data remaining only on your device, you can act directly through the library, bin and browser settings. The publisher does not necessarily have a copy to locate or restore it.

You may also lodge a complaint with the French data protection authority (CNIL).