Privacy Policy

1. Who controls your data

U.X. DESIGN STUDIOS LIMITED is the controller of personal data processed through Music Arcademy. Contact: support@musicarcademy.com.

No separate Data Protection Officer is currently designated. Privacy requests may be sent to the contact above.

2. Scope

This Privacy Policy applies to Music Arcademy websites, accounts, games, subscriptions, support, waitlists, rankings and related services. It explains what data we process, why, the legal bases, who receives it, international transfers, retention, your rights, children’s privacy, cookies and local storage, and account deletion.

3. Information we process

Account and identity

• email address;
• authentication provider and provider identifier;
• unique Music Arcademy user ID;
• Player Name;
• selected country;
• account creation and update dates;
• authentication and security events;
• consent and Terms version records.

Gameplay and progress

• game sessions; selected content and settings;
• correct and incorrect attempts; response times;
• scores, streaks and results;
• Roadmap and learning progress; Level Scan results;
• Smart Practice and Chord Boost evidence;
• Ranked and Hall of Fame participation, including the note-input event log of official ranked runs (kept to verify fair play);
• challenges where enabled;
• usage counters and entitlement decisions.

Official Player Name, country and qualifying scores may be publicly visible in rankings.

Device and technical information

• IP address (processed transiently for security and delivery; our own analytics store country only, not IP);
• browser and device type; operating system; language and time zone;
• session identifiers; security logs; error and diagnostic data;
• necessary local storage; consent preferences.

MIDI input is processed only as needed to recognize gameplay input. We do not access the musical content of unrelated activity on your device.

Billing and transaction information

When payments are enabled, we may process Stripe customer and subscription identifiers; plan and price; subscription and entitlement status; billing period dates; payment success or failure state; grace-period state; invoices and transaction references; refunds, partial refunds, disputes and chargebacks; and Founding 100 qualification and exclusion evidence.

Payment-card details are handled by the payment provider. We do not store full card numbers or card security codes.

Communications

Support requests; refund and withdrawal requests; privacy requests; feedback; waitlist entries; marketing consent and unsubscribe status; transactional email delivery state.

4. Why we process data and legal bases

Contract

We process data necessary to create and authenticate an account; provide gameplay and saved progress; operate rankings and user-selected public features; provide subscriptions and entitlements; process cancellation, refund and support requests; synchronize account data across devices; and provide the digital service requested by the user.

Legal obligation

We process data where required for tax and accounting; consumer rights; refunds and withdrawal; fraud and payment records; lawful requests; and data-protection compliance.

Legitimate interests

Where appropriate and balanced against user rights, we process data to secure accounts and infrastructure; prevent fraud, cheating and abuse; diagnose errors; protect official rankings; improve reliability and usability; keep limited audit evidence; and establish, exercise or defend legal claims.

Consent

We rely on consent for non-essential cookies or similar storage (none are currently used — see section 13); optional marketing communications; processing that specifically requires consent; and child consent situations where applicable. Consent can be withdrawn without affecting processing already lawfully completed.

5. Public features

Hall of Fame and other official competitive features may display your Player Name, selected country, score, rank and relevant game result. Do not use a Player Name that reveals information you do not want public. Guest activity is not official ranking participation.

6. Service providers

The providers that currently process personal data for Music Arcademy are:

• Supabase — authentication, database and related backend services;
• Vercel — hosting and deployment;
• Brevo — waitlists, transactional and consented marketing email;
• Google — when a user chooses Google sign-in;
• Stripe — payment processing and subscription management, active only when payments are enabled.

No third-party analytics, advertising, error-monitoring or tag-management services are used. Processors act only under appropriate contractual and data-protection obligations.

7. International transfers

Some providers may process data outside Cyprus or the European Economic Area. Where required, transfers use a lawful safeguard such as an adequacy decision, Standard Contractual Clauses, or another permitted transfer mechanism.

8. Retention

We retain personal data only for as long as reasonably necessary for the stated purpose. Typical rules:

• account and gameplay data: while the account exists, unless earlier deletion is requested;
• transaction, tax and accounting data: for the period required by applicable law;
• security and audit records: for a limited period appropriate to security, fraud prevention and legal claims;
• support records: as needed to resolve the request and maintain reasonable evidence;
• marketing data: until consent is withdrawn or the user unsubscribes;
• anonymized or aggregated analytics: may be retained longer where they no longer identify a person.

Deleted data may remain temporarily in protected rolling backups until those backups are overwritten.

9. Account deletion

You can request deletion through the in-app account-deletion flow. The flow requires clear confirmation, explains the effect on an active subscription, cancels or initiates cancellation of billing as required, removes gameplay and profile data, removes you from email systems where applicable, and deletes the authentication account.

Only records required by law, or a non-identifying audit record necessary to prove deletion and protect the service, are retained. Deleting an account does not require deletion of transaction records that must be retained for legal, tax, refund, dispute or fraud purposes.

10. Your rights

Subject to applicable conditions, you may request access to your personal data; correction of inaccurate data; deletion; restriction; objection to certain processing; data portability; withdrawal of consent; information about recipients; and review of a privacy concern.

Send requests to support@musicarcademy.com. We may need to verify identity before acting.

You may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority.

11. Automated rules

Music Arcademy uses automated rules to calculate learning progress; select practice content; identify Chord Boost candidates; calculate rankings; apply plan and usage entitlements; and prevent invalid or duplicate usage. These rules are not intended to make decisions producing legal or similarly significant effects about a person.

12. Children and minors

A user under 18 may use Music Arcademy only with parental or legal-guardian permission and supervision. A paid subscription for a minor must be purchased and managed by the parent or guardian.

Where consent is the legal basis, a child under 14 must have the required parental or guardian authorization. If we learn that a child’s data was processed without required authorization, we will take reasonable steps to restrict or delete it. Parents and guardians may contact support@musicarcademy.com.

13. Cookies and local storage

Strictly necessary

We use browser local storage necessary for authentication; security; session continuity; fraud prevention; feature flags; plan and entitlement delivery; saving settings; guest-session progress; and user-requested gameplay functionality. Strictly necessary storage does not require optional marketing consent where the law permits the exemption.

Optional analytics or marketing

Music Arcademy currently uses no optional, analytics, advertising or marketing cookies or storage, and no third-party trackers. If optional storage is ever introduced, it will not run before valid consent, with a real Accept and Reject choice, no preselected consent, withdrawal as easy as consent, and no cookie wall — and this Policy will be updated first.

14. Security

We use reasonable technical and organizational measures appropriate to the service and risk. No online service can guarantee absolute security. Protect your email and authentication account, and contact support if unauthorized access is suspected.

15. Changes to this Privacy Policy

We may update this Policy when processing, providers, law or the service changes. We will publish the effective date and provide notice of material changes where required.