Privacy policy
Last updated: 10 November 2026
Draft: this text has not been reviewed yet and will change before launch.
This policy explains how we handle your personal data when you visit onlineharmonicalessons.com, use the app at app.onlineharmonicalessons.com, book a private lesson or get in touch with us. It follows the EU General Data Protection Regulation (GDPR), Spain’s data protection law (LOPDGDD) and, for students in the United Kingdom, the UK GDPR.
Who is responsible for your data
The data controller is Vincenzo Fratelli (Online Harmonica Lessons).
- Email: onlineharmonicalessons@gmail.com
- WhatsApp: +34 694 474 553
- Postal address: [postal address]
- Representative in the UK: [UK representative under Article 27 UK GDPR, if required]
What data we collect
When you visit the website or the app
The servers that host the website and the app automatically record some technical data, such as your IP address, the date and time of the request, the page requested and your browser. This is needed to deliver the pages and keep the services secure.
We also use cookies and similar technologies, some of them only with your consent. See the cookie policy.
When you get in touch
If you write to us by email or WhatsApp, we process what you send us: usually your name, your contact details and the content of your message.
When you book a private lesson
Lessons are booked and paid for through Cal.com, which is embedded on our booking pages. We receive your name, email address, the time you choose and anything you add to the booking. Card details are entered in Cal.com’s payment form and are not stored on our website. Lessons take place by video call on Zoom, Microsoft Teams or Google Meet.
When you use the app
- Account details: your name, email address and instrument (diatonic, chromatic or both).
- Sign-in: we email you a one-time sign-in link (a “magic link”), so there is no password to store.
- Practice progress: the progress you save in the app.
- Billing country: only if you choose to add it.
- Browser storage: the app uses your browser’s local storage to keep you signed in and remember your appearance setting.
When paid plans are available
Paid plans are not on sale yet. When they are, subscriptions will be paid through Stripe. Stripe will handle your card details; we will receive information such as your name, email address, billing country, plan and payment status, but not your full card number.
Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your messages and arranging the lessons you ask about | Steps taken at your request before entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR) |
| Booking, giving and charging for private lessons | Performance of the contract (Art. 6(1)(b)) |
| Creating and running your app account, sending sign-in links and saving your progress | Performance of the contract, under our terms and conditions (Art. 6(1)(b)) |
| Managing subscriptions and payments, once paid plans are available | Performance of the contract (Art. 6(1)(b)) |
| Keeping the payment and accounting records the law requires | Legal obligation (Art. 6(1)(c)) |
| Keeping the website and the app running and secure | Legitimate interest (Art. 6(1)(f)) |
| Understanding, in aggregate, how the website is used (Google Analytics) | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Measuring the results of our Google Ads | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Showing the YouTube videos embedded on the website | Legitimate interest in presenting our lessons and content (Art. 6(1)(f)) |
You need to give us your contact details to get a reply, and your name and email address to book a lesson or create an account. Statistics and marketing cookies are optional: saying no doesn’t limit your use of the website or the app.
Who we share it with
We don’t sell your data. We share it only with the providers that help us run the service, and with the authorities when the law requires it.
| Provider | What for | Role |
|---|---|---|
| Hostinger | Hosting the website (servers in Lithuania, EU) | Acts on our behalf |
| Cloudflare | Hosting the app | Acts on our behalf |
| Supabase | Storing app accounts, progress and exercise files | Acts on our behalf |
| Resend (using Amazon SES) | Sending app emails, such as sign-in links | Acts on our behalf |
| Google Ireland Ltd. | Our email (Gmail); Google Tag Manager and Google Analytics, only with your consent | Acts on our behalf |
| Google Ireland Ltd. | Google Ads conversion measurement, only with your consent | Independent controller |
| Google Ireland Ltd. | YouTube, when an embedded video is loaded or played | Independent controller |
| Cal.com | Booking and payment of private lessons | Acts on our behalf |
| Stripe | Subscription payments, once paid plans are available | Independent controller |
| WhatsApp Ireland Ltd. (Meta) | Messages, if you write to us on WhatsApp | Independent controller |
The video call platform used for your lesson (Zoom, Microsoft Teams or Google Meet) also processes your data under its own privacy policy. Independent controllers decide for themselves how they use the data and are responsible for it under their own privacy policies.
International transfers
The website is hosted in the EU. Some of the other providers above are based in the United States or may process data outside the European Economic Area and the UK. When that happens, the transfer is protected by the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or by the European Commission’s standard contractual clauses (with the UK addendum where it applies). You can ask us for more information.
How long we keep it
- Messages and enquiries: as long as we need to deal with your request, and then for the legal periods during which a claim could arise.
- Lesson bookings and payment records: while you are taking lessons, and then as long as tax and accounting law requires.
- App account and progress: for as long as your account exists. If you ask us to delete it, we do so without undue delay and within one month at the latest, except for records we must keep by law.
- Server logs: kept by the hosting providers for a limited period, for security only, and then deleted.
- Google Analytics data: [Analytics data retention period, as set in Google Analytics].
- Cookies: for the periods listed in the cookie policy.
Children
If you are under 14, a parent or guardian must get in touch, book lessons or create an app account on your behalf.
Security
We take reasonable technical and organisational measures to protect your data and choose providers that do the same. Signing in to the app with an emailed link means there is no password that could be stolen from us.
Your rights
You can ask at any time to access, correct or delete your data, to restrict how we use it or to receive it in a portable format, and you can object to processing based on legitimate interest. Just write to onlineharmonicalessons@gmail.com.
You can withdraw your consent to cookies at any time with the “Cookie settings” link at the bottom of every page. Withdrawing consent doesn’t affect processing carried out before. We don’t make decisions about you based solely on automated processing.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es). If you live elsewhere in the EU or in the UK, you can also contact your local data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk).
Changes to this policy
We will update this page when something changes, for example when paid plans become available. The date at the top shows the latest version.