Privacy policy

Last updated: 1 November 2026

Draft: still to be reviewed by a lawyer before Refine is sold.

Who we are

Refine (refine-music.com and the app at refine-music.com/app) is run by [company name, registration number and address: to fill in once the business is registered (likely a Dutch company)]. We decide how your data is used: the "controller" under the EU's GDPR and Brazil's LGPD. For anything about your data, use Support & Help inside the app; that is also our channel for data requests under the LGPD (the "encarregado").

What we collect and why

• Your account. When you sign in with Google we get your name, email address and Google account ID, and your profile picture if you add one. We need these to give you an account (to perform our contract with you).
• Your practice. What you put into Refine: routines, sessions and their tempos, songs, setlists, challenges, files you import (like Guitar Pro scores) and your settings. We store them so they're there on every device you use (contract).
• Payments. Stripe takes your payment; we never see your full card number. We keep your Stripe customer ID, your plan, its status and your invoices (contract, and the tax law that makes us keep invoices).
• Support. What you write to us, in the app or by email, our replies, and the browser and system you wrote from when you report a problem (contract).
• Error reports. When something breaks, the app sends a report to Sentry: what went wrong, your browser and system, and your account ID, so we can fix it (our legitimate interest in a working app).
• Access logs. Our hosting and database keep the IP address and time of each visit. Brazil's Marco Civil da Internet requires us to keep these for 6 months; they also protect the service against abuse.
• The waitlists. If you join one (early access, or teacher tools), your email address and the language you used, to tell you once when Refine opens or when teacher tools launch (your consent, which you can withdraw at any time).
• Invites. Refine is invite-only for now. When someone invites you (our team, or your teacher), we keep your email address, who invited you, when, and a short note our team may add, so that signing in with Google can create your account (our legitimate interest in opening Refine gradually). We get your address from the person who invited you; ask us and we'll remove it. At their request we email you the invite link: once when they invite you, and again only if they send it again. That email is sent through Resend.
• Public teacher profiles. If you teach and choose to publish a profile in the Teachers directory, we show only what you wrote for it: the name you chose, a photo if you add one, a tagline, your instruments, styles, topics, levels and languages, whether you teach online or in person and in which city, your price if you give one, and a short bio. Never your email. For now only our team and a few accounts we allow can see it. You can take it out of the directory or change it at any time; it is deleted with your account (your consent). If our team verifies your profile, we keep who did it and when. If you ask a teacher for lessons, they see your name, your message, the instrument and level you pick and the reply address you choose to share by pressing Send. A teacher's profile can show how many days a week their students practise on average: we work it out from the practice of their students who practised in the last four weeks, only when there are at least five of them, and never show one student's figure (our legitimate interest in helping students choose a teacher).
• Students under 18 asking for lessons. If you say you're under 18, we ask for a parent's or guardian's email and email them a link. Your request reaches the teacher only after they confirm it; if they refuse, it's closed. We keep their email with the request until it's answered and as long as the request is kept, to show the consent was given (LGPD art. 14). That email is sent through Resend.
• How Refine is used, in aggregate. We look at counts across many users (never fewer than five at a time) to decide what to improve. We don't look at one person's practice.

We don't sell your data, there are no ads and we don't use your data to profile you.

Who else handles it

These companies process data for us, each only for the job named:

• Supabase: database and sign-in, on servers in Ireland (EU).
• Netlify: hosts the website and the app (it serves the pages; your practice isn't stored there).
• Stripe: payments and invoices.
• Sentry (Functional Software, Inc.): error reports, stored in the EU (Germany).
• Google: sign-in.
• Resend (Resend, Inc., United States): sends the invite email when someone invites you, at their request (your email address, the inviter's name and the link).

Only if you use them: Spotify, when you connect your Spotify account to play songs (your Spotify sign-in stays in your browser), and YouTube, when you play a lesson video (we use YouTube's privacy-enhanced mode). Their own privacy policies apply to what you do there.

Data outside your country

Some of these companies are in the United States or store data outside Brazil and the EU. Where they do, the transfer is covered by the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or its standard contractual clauses, and for Brazil by the mechanisms in articles 33 to 36 of the LGPD. [To confirm with the lawyer and each provider's data processing agreement.]

How long we keep it

• Your account and practice: until you delete your account, which removes them from our database straight away. Deleted data leaves our backups within [30] days.
• Support conversations: 12 months after the last message in the conversation (yours or ours), or sooner if you delete your account.
• Invoices and payment records: as long as tax law requires (7 years in the Netherlands). When you delete your account we cancel your subscription and delete your customer record at Stripe; the invoices stay with Stripe and us for that time.
• Access logs: 6 months.
• Error reports: up to 90 days. They carry only your account ID, which means nothing once the account is deleted.
• The waitlists: until we send the email you signed up for, until you ask us to remove you, or until you delete your account.
• Invites: until the person who invited you or our team removes the invite, or until you delete your account.

Your rights

In the app, Settings → Data & Backup lets you download a copy of everything your account holds (a JSON file) and delete your account with all its data. You can also ask to see your data, correct it, get a copy to take elsewhere, or have it deleted; you can object to how we use it and withdraw consent you gave. Send us a request from Support & Help inside the app and we'll answer within 15 days. You can also complain to a data protection authority: the Autoriteit Persoonsgegevens in the Netherlands, your own country's authority in the EU, or the ANPD in Brazil.

Cookies and browser storage

The website sets no cookies and uses no analytics or tracking. It remembers the language you pick in your browser's storage, and nothing else.

The app keeps your sign-in and a copy of your practice in your browser's storage so it opens quickly and doesn't lose a session when the connection drops. That's strictly needed to run the app, so it doesn't ask first. Stripe's checkout pages set their own cookies to prevent fraud, and a YouTube lesson video may store data in your browser once you play it.

Children and teenagers

If you're under 18, a parent or guardian has to agree to Refine's terms and this policy for you. [Minimum age and how consent is checked: to decide with the lawyer (ECA and ECA Digital in Brazil, 16 in the Netherlands under the GDPR).]

Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it applies. The date at the top shows the latest version.