Privacy Notice

Who is responsible

SixStringer is the data controller for the personal data described here.

What we collect and why

• Account data (email, password, display name) — to create and run your account. Legal basis: contract.
• Learning data (goal, completed lessons, XP) — to provide lessons and track progress. Legal basis: contract.
• Chat messages with Riffmaster — to answer your questions, keep your conversation and track your remaining question allowance. Legal basis: contract.
• Technical data (IP address, device and browser info, logs) — for security, fraud prevention, and fixing problems. Legal basis: legitimate interests.
• Support messages — to help you. Legal basis: contract / legitimate interests.
• Optional music community — your musician name, approximate city, instrument, interests and bio are shown to signed-in members only when you choose to make your music profile visible. Matching uses those shared interests, never your private Riffmaster chat. Legal basis: consent.
• Connections, musician messages, blocks and reports — to provide voluntary contact and protect members. Messages require an accepted connection. You can hide your profile, remove connections or block a member. Existing connections can still see your music profile when discovery is off. Legal basis: contract / legitimate interests.

Who we share it with

• Service providers that host the app, store data, and power the AI teacher;
• Stripe, our payment provider, for processing payments, fraud prevention, tax calculation, and receipts;
• Professional advisers (legal, accounting);
• Authorities, when the law requires it.

International transfers

Some providers may process data outside the EU/EEA. When they do, we rely on safeguards such as EU Standard Contractual Clauses or adequacy decisions.

How long we keep it

We keep your data while your account is active. When it's no longer needed, or you delete your account, we delete or anonymise it, unless the law requires us to keep it longer.

Your rights

Export your account data or delete your account from Profile. For other requests, use our contact page. Account deletion removes profile, learning data, chat and contact messages; purchase records are retained where required for accounting.

Under the GDPR you can request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time. We respond within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY).

Security

We use appropriate technical and organisational measures, including encryption in transit and access controls.

Cookies

We only use essential storage needed to keep you signed in. We do not use marketing cookies.