Privacy Notice
Who is responsible
Claviano is operated by Lucas Rech, 1070 Vienna, Austria. Contact: claviano@reluem.dev
What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, display name, hashed password | Account creation and authentication | Contract (Art. 6(1)(b) GDPR) |
| Uploaded MIDI/MusicXML/PDF files | Notation rendering and playback | Contract (Art. 6(1)(b) GDPR) |
| IP address, browser type, request logs | Security, abuse prevention, error diagnostics | Legitimate interest (Art. 6(1)(f) GDPR) — security monitoring with 30-day retention |
Infrastructure and sub-processors
Claviano runs on Cloudflare (Workers, D1, R2, Pages). Cloudflare acts as a data processor under a signed DPA and is certified under the EU–US Data Privacy Framework.
Transactional emails (password reset) are sent via Brevo (formerly Sendinblue). Brevo processes only your email address for delivery purposes under a signed DPA. Brevo processes data within the EU. See Brevo's DPA.
Claviano uses Cloudflare Web Analytics — a privacy-friendly, cookieless analytics product. No tracking cookies are set; no personal data is shared with Cloudflare for analytics purposes.
On your first page view we record which website (domain only) or campaign referred you — not linked to your account.
International data transfers
Cloudflare may process data in the United States and other countries. The EU–US Data Privacy Framework (DPF) and Cloudflare's signed Standard Contractual Clauses (SCCs) serve as the legal safeguards for these transfers under Art. 46 GDPR. Brevo processes data within the EU.
How long we keep your data
Account data and uploaded files are retained as long as your account is active. When you request deletion (via account settings or email), your account and all uploaded files are permanently removed within 30 days. Request logs are retained for up to 30 days.
Your rights (GDPR)
As an EU/EEA resident you have the right to:
- Access — request a copy of data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of your account and all uploaded files
- Restriction — request restriction of processing under certain conditions
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interest
- Complaint — lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at)
To exercise any right, email claviano@reluem.dev. We respond within 30 days.
Cookies
Claviano uses one session cookie (session) strictly necessary for login. No advertising, tracking, or analytics cookies are set. No cookie consent banner is required.
Claviano stores functional preferences in your browser's local storage (e.g., sidebar state, tempo setting, MIDI output mode). This data never leaves your device and contains no personal information.
Cloudflare Turnstile, used for bot protection on login and registration, may set temporary cookies (e.g. cf_clearance) required for the security challenge. These expire after the challenge is completed and do not track you. See Cloudflare Turnstile privacy.
Children
Claviano is intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, please contact us and we will promptly delete it.