Who is responsible
The data controller is Chris Guitar Tuto · Live Session Tech, Christopher Jean Meyepa, Rue Centrale 107, 2503 Biel/Bienne, Switzerland, chrisguitartuto@gmail.com. This policy covers the website, the app, the kids app and the live lessons. It follows the GDPR (European Union), the new Swiss Federal Act on Data Protection (nFADP) and the Mauritius Data Protection Act 2017.
What we collect
Your account: e-mail address, password (hashed, we never see it), first or display name, language, chosen country or currency, plan and subscription dates, invoices.
Your profiles: the first names and instrument of the household’s profiles (your children, for example). No date of birth, no postal address.
Your progress: lessons seen, exercises passed, days practised, stars, homework, the method’s exam results, your teacher’s feedback.
Your recordings: the TrueTake audio takes you decide to record, and the “Film yourself” videos. They are analysed on your device (or deleted from our server within half an hour when the analysis runs there) and kept only if you press “keep”.
Microphone and camera: the app asks for the microphone to listen to you play, and for the camera for “Film yourself” and live lessons. Sound and picture are processed on your device; nothing is sent without an action from you (keeping a take, entering a lesson room).
Live lessons: sound and picture pass through our room provider (LiveKit) for the duration of the lesson. They are not recorded, apart from the short clip the teacher may keep for the evening recap (deleted within seven days).
Your messages: messages with your teacher, answers to the website forms (contact, trial, discovery call, waiting list), testimonials you publish.
Technical data: our hosting providers’ connection logs (IP address, browser, time), kept briefly for security. No third-party analytics, no advertising.
Why (and on what basis)
To provide the service you asked for: the account, the lessons, the progress, the lesson room, the payments (performance of the contract).
To write to you about your account and your progress: address confirmation, receipt, practice reminder, weekly summary to parents, message at the end of the free month (performance of the contract and legitimate interest). You can turn reminders off in the app’s settings or by writing to us. We send no advertising for third parties.
For security and abuse prevention (legitimate interest), and to keep our accounts (legal obligation).
For children: on the basis of the parent’s consent (see below).
For how long
Account, profiles, progress: as long as the account exists, then deleted within 30 days of the account’s deletion.
Audio takes (TrueTake): until you delete them, or with the account.
“Film yourself” videos: at most 30 days, then deleted automatically, unless you delete them first. The teacher’s lesson clips: seven days.
Messages and forms: as long as the account exists; website messages without an account, 12 months.
Invoices and payments: 10 years (Swiss accounting obligation).
Backups: a copy of the database is made every week; deleted data leaves the backups in the following weeks.
Where the data is
The database and the files (takes, videos) are at Supabase, on Amazon Web Services servers in the ap-south-1 region (Mumbai, India). [To be confirmed by the lawyer: transfer safeguards outside Switzerland/EU; moving the project to a European region is being considered.]
The website and the app are served by Netlify (global network, United States). E-mails are sent by a delivery provider (Resend). Live lessons go through LiveKit. International payments through Stripe (Stripe sees your payment details; we only receive a confirmation).
These providers act under a data-processing agreement (DPA) and may only use your data to provide the service to us. We never sell your data and never share it with anyone else, unless the law requires it.
Who sees what
You: everything about your account, in the app.
Your teacher (Chris, or your school’s teacher): your progress, takes, videos and messages, to help you progress.
Parents: the progress of the child profiles in their household (parents’ corner, weekly summary).
Chris, as administrator: everything, for support, billing and security. Nobody else.
In a group class, the other students see your first name and hear you; in testimonials, only what you publish yourself.
Your rights
You can: access your data, correct it, receive it in a common format (export of your takes, videos, tablature and progress), delete it, withdraw consent, and object to processing based on legitimate interest (reminders, for example).
How: write to chrisguitartuto@gmail.com from the account’s address, saying what you want (a copy of your data, its deletion, a correction). We answer within 30 days. It is free. You can delete your own takes, videos and profiles in the app yourself.
You can also complain to your country’s authority: in Mauritius the Data Protection Office, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the European Union your national authority.
Children
Ti Zilois / Corda Kids and the child profiles are made for children. The parent or guardian creates the account, gives consent at sign-up, and can see and delete everything. A child under 16 (13 in some countries) does not create an account alone.
We collect the bare minimum about a child: a first name, the instrument, their progress and the takes they choose to keep. No advertising, no profiling, no sharing with third parties, no messaging between children. Teachers see the children of their own classes only.
The details and the consent wording are on the Parental consent page.
Security
Encrypted connections (HTTPS), hashed passwords, database access limited by per-account rules (RLS), weekly backups, secrets kept out of the code. No measure is perfect: if an incident affected your data, we would tell you and inform the authority where the law requires it.
Changes and contact
The date at the top shows the latest version. For an important change, we tell you by e-mail. Questions: chrisguitartuto@gmail.com.