RIFFLAB - PRIVACY POLICY
Last updated 11 September 2026

1. Who this policy is for
This policy explains how RiffLab handles personal data for adult account holders and learners using the service. An account must be created and managed by an adult aged 18 or over. A learner may be the account holder or a child using the account with that adult's permission and supervision.



2. Who controls the data
RiffLab is the controller of personal data described here. Privacy enquiries and rights requests can be sent to hello@rifflab.co.uk.



3. Data we collect

- Account details, including the adult holder's name, email address and password hash.

- An optional learner name or nickname.

- Learning data, such as completed tasks, tuning activity, chord passes, song scores, favourites and preferences.

- Membership information, including access status and Stripe customer or subscription identifiers. RiffLab does not store full payment-card details.

- Support messages, account actions, security logs and a privacy-preserving hash of the connection address used for abuse prevention.




4. Microphone and audio
The tuner and interactive exercises need microphone access. Pitch and chord analysis takes place in the browser on the learner's device. RiffLab does not record, upload or store microphone audio in this release. The browser or operating system controls microphone permission.



5. Why we use data
We use account and learning data to provide the service, save progress, secure accounts, answer support requests and administer membership. We use data needed to perform the contract with the account holder, meet legal obligations and pursue legitimate interests such as preventing abuse and improving reliability. Optional improvement data is used only when the account holder enables that choice.



6. Payments and service providers
When paid membership is enabled, Stripe will process checkout, billing and payment information under its own privacy terms. RiffLab receives identifiers and subscription status needed to provide access. Hosting and email providers may process limited data to operate the service.



7. Retention
Account and learning data is kept while the account is active. Security and audit records may be retained for a reasonable period to protect the service and meet legal obligations. Support information is retained while needed to resolve and document a request. A deletion request removes the account and personal learning data after necessary checks, except information that law requires RiffLab to retain.



8. Your choices and rights
The account area lets an adult holder update account details, control optional sharing and notifications, download account data, reset learning progress and request deletion. Depending on applicable law, the account holder may also request access, correction, restriction, portability or object to certain processing, and may complain to the relevant data protection authority.



9. Children and safeguarding
RiffLab does not invite children to create their own accounts or enter contact details. The adult holder is responsible for the learner's use. RiffLab asks for a learner name only, and a nickname may be used. Safety concerns should be sent through the safeguarding category in Support or emailed to RiffLab.



10. Security and changes
RiffLab uses password hashing, secure sessions, access controls and server-side request protection. No online system can promise absolute security. Material policy changes will be shown in the service or sent to account holders where appropriate.

Contact: hello@rifflab.co.uk