Privacy Policy
Last updated: September 2026
This policy explains what we collect about you, why, and what you can ask us to do about it. It covers pianodemy.com and app.pianodemy.com.
The person responsible for your data (the data controller) is Evgenii Sudakov EI, 7 rue Sergent Bobillot, 38000 Grenoble, France. Contact: [email protected]. Full details are on our legal notice page.
1. What we collect
Account data - your name, email address and password, so you can sign in and we can reach you.
Subscription data - what plan you are on, when it renews, and your payment history. Card numbers go straight to Stripe. We never see them and never store them.
What you create - your practice history, progress, notes and annotations.
Lesson room data - if you use a live room, we handle the video and audio stream while the session is running. We do not record it unless you switch recording on.
Technical data - IP address, browser, device type and error reports, so we can keep the app working and stop abuse.
Usage data - which pages and features you use, and recordings of how the pages behaved during your visit, so we can see where the product gets in the way.
2. Why we are allowed to use it
- To give you the service you paid for - account, lessons, progress, billing. This is needed to perform our contract with you.
- To keep the service safe and working - error reports, abuse prevention, spam filtering. This is our legitimate interest in running a service that works.
- To understand which features help people - analytics. This is our legitimate interest in building a product that works. You can ask us to stop at any time, and we will.
- To meet legal obligations - we keep invoices and accounting records because French tax law requires it.
3. Who we share it with
We do not sell your data and we do not share it for advertising.
We use these companies to run Pianodemy. Each one only gets what it needs, and each is bound by a data processing agreement:
| Company | What it does | Where |
|---|---|---|
| Supabase | Accounts, sign-in, database | European Union |
| Render | Hosting for the app and the API | European Union |
| Cloudflare | Content delivery, DNS, bot protection | Global network |
| LiveKit | Live video and audio in lesson rooms | European Union |
| Stripe | Payments and subscriptions | Ireland and United States |
| Resend | Transactional email, such as sign-in and receipts | European Union |
| PostHog | Product analytics and session recordings | European Union |
| Website analytics and advertising measurement | United States | |
| Sentry | Error reports so we can fix crashes | European Union |
| Anthropic | Powers assistant features inside the app | United States |
Where a company is outside the EU, the transfer relies on the European Commission’s standard contractual clauses.
4. How long we keep it
- Your account and what you created - while your account exists, and 30 days after you delete it, so an accidental deletion can be undone.
- Invoices and accounting records - 10 years, because French law requires it.
- Error and technical logs - 90 days.
- Analytics - 12 months.
- Lesson recordings - only if you turned recording on, and you can delete them at any time.
5. Children
Pianodemy is used by children learning the piano.
You must be at least 16 to create your own account. In France the limit is 15. Below that age, a parent or guardian creates and supervises the account and gives consent on the child’s behalf.
We do not knowingly collect data from a younger child with no parent involved. If you believe we have, write to [email protected] and we will delete it.
We never show advertising to children and we never sell their data.
6. Your rights
You can ask us to:
- Show you the data we hold about you.
- Correct anything wrong.
- Delete your account and your data.
- Send you a copy of your data in a portable file.
- Stop using your data for a particular purpose.
- Object to analytics, at any time, without giving a reason.
Write to [email protected]. We answer within one month.
If you are not happy with our answer, you can complain to the CNIL, the French data protection authority, at cnil.fr, or to the authority in the EU country where you live.
7. Cookies
We use two kinds:
- Essential - keeps you signed in and keeps the site secure. These cannot be switched off, because the site would not work.
- Analytics - PostHog and Google, so we can see which features help people. These load on every visit.
We do not show a cookie banner. If you would rather not be measured, turn on your browser’s tracking protection, or write to us and we will exclude you.
8. Security
Data is encrypted in transit and at rest. Access to production systems is limited and protected by two-factor authentication. If a breach ever puts your rights at risk, we will tell you and the CNIL within 72 hours, as the law requires.
9. Changes
If we change this policy in a way that affects you, we will email you before it takes effect.