Legal

Privacy Policy

On this page

Data controller
What personal data may be processed
How data is obtained
Purposes of processing and legal bases
User-uploaded content and public or private visibility
Technical conversion of MIDI files and operation of the service
Newsletter and commercial communications
Comments on the website
Advertising, cookies and similar technologies
Recipients, processors and providers that may be involved in the processing
International data transfers
Data retention
Rights of data subjects
Minors
Accuracy of data
Security measures
Changes to this policy
Contact

Last updated: 7 November 2026.

This privacy policy explains how personal data is collected, used, stored and protected at Clave de Mi, both on the main website and in the web version of the player and the mobile apps (Android and iOS).

This policy applies to the website clavedemi.com, the web version of the player and the Clave de Mi mobile apps (Android and iOS), together with their pages and associated features, unless a specific additional policy or clause is indicated in a particular form, service or process.

Please also read the Legal Notice, the Cookie Policy and the Terms and Conditions.

1. Data controller

Controller: Ismael Vallejo Ruiz
Tax ID (NIF): 52900192P
Address: C/ Playa de Zarauz, 26, Madrid, Spain
Email: info@clavedemi.com
Website: https://clavedemi.com/

2. What personal data may be processed

Depending on how Clave de Mi is used, different types of personal data may be processed, for example:

Identification and contact data, such as name, surname, email address or username.
Account, access and service usage data, such as credentials, login records, basic activity within the service and usage preferences.
Data relating to orders, subscriptions and payments, such as billing information, products or services purchased, payment status and renewals. Payments are processed through specialised third parties, so Clave de Mi does not need to store your full bank card details.
Data included in the contact and transcription request forms, or in communications sent by email.
Data from sign-ups for the free 1st edition of Trompeta o Corneta Solista: email address, confirmation of the sign-up through the link in the verification email, and data of the €0 order used to deliver the book.
Files and content uploaded to the service, such as scores, MIDI files, MusicXML or other materials related to the use of the platform.
Technical and browsing data, such as IP address, device or browser identifiers, server logs, cookies and similar technologies, in accordance with the Cookie Policy.
Analytics data, only with consent: pages viewed, button clicks, device and approximate country, cookie identifiers and, when an order is placed, the origin of the visit.
Data from signing in with Google or Apple, if the user chooses that option: only the name and email address are received.
Data from comments previously published on the website (comments are closed), such as the name or alias provided and the content of the comment.

3. How data is obtained

Personal data is obtained mainly when the user:

browses the website or uses the player and the mobile apps;
creates a user account or signs in (also with Google or Apple, if chosen);
makes a purchase or takes out a subscription;
fills in the contact form or writes by email;
requests a transcription service;
subscribes to the newsletter or signs up for the free 1st edition of Trompeta o Corneta Solista;
uploads files or content to the platform.

4. Purposes of processing and legal bases

Personal data is processed for the following purposes and on the following legal bases:

Purpose	Data processed	Legal basis	Retention criteria
Managing browsing, the technical operation of the site, security and incident prevention	IP, technical logs, identifiers, browser or device data, basic usage activity	Legitimate interest of the controller in ensuring the security, stability and improvement of the service	For as long as necessary for security, technical diagnosis, fraud prevention and handling possible incidents or liabilities
Measuring use of the website (analytics)	Pages viewed, button clicks, device and approximate country, cookie identifiers	Consent	Up to 14 months at most in Google Analytics
Knowing the origin of orders (WooCommerce)	How the visit arrived (search engine, email, social networks)	Consent	During the session; the data remains in the order
Protecting forms, login and payments against abuse (reCAPTCHA and hCaptcha)	IP and technical browser data	Legitimate interest in security	According to each provider (up to 6 months for the reCAPTCHA cookie)
Handling enquiries, requests and communications sent through forms or email	Name, email, telephone number if provided, content of the message and data associated with the enquiry	Consent of the data subject or application of pre-contractual measures at their request, as the case may be	For as long as necessary to handle the request and, afterwards, blocked while liabilities may arise
Creating and managing user accounts, access to the private area and use of the service	Registration data, credentials, username, basic activity, preferences and account status	Performance of the contractual or pre-contractual relationship with the user	While the account remains active and, afterwards, blocked for the limitation periods of liabilities
Signing in with Google or Apple (only if the user chooses it)	Name and email address	Performance of the contract, at the user’s request	While the account remains active
Managing purchases of digital content, orders, billing and premium subscriptions	Identification, contact, billing, order, renewal, incident and payment status data	Performance of the contract and compliance with applicable legal obligations	Order and billing data: 6 years (art. 30 of the Spanish Commercial Code)
Managing payments through Stripe and PayPal	Data needed to identify the transaction, amount, payment status and transaction references	Performance of the contract	For as long as necessary to manage collection, incidents, refunds, fraud prevention and associated legal obligations
Providing the transcription service requested by the user	Contact data, order information, files sent, remarks and data needed for billing and tracking of the service	Application of pre-contractual measures at the data subject’s request and, where applicable, performance of the contract	During the handling of the order and, afterwards, blocked while legal obligations or claims may arise
Managing files and content uploaded by users, including their playback, display, technical conversion and availability according to the service configuration	Uploaded files, metadata, associated technical data, public or private status of the content and link to the user’s account	Performance of the contract or of the terms of use of the service; legitimate interest in the technical administration and security of the platform	While the content remains linked to the service and, afterwards, for the technically necessary time for backups, continuity, security or handling of liabilities
Sending newsletters and news to subscribers, including the free 1st edition of Trompeta o Corneta Solista with its follow-up emails and coupon	Name (if provided), email address and, where applicable, tags or communication preferences	Consent, with confirmation by email (double opt-in)	Until consent is withdrawn or the subscriber unsubscribes
Sending customers communications about products or services similar to those already purchased	Name, email address and products purchased	Legitimate interest (art. 21.2 of the Spanish Information Society Services Act, LSSI)	Until the customer unsubscribes; an unsubscribe option is available in every email
Showing advertising to users without Premium in the player and in the mobile apps (Google AdSense and AdMob). The clavedemi.com website does not show Google ads	Technical data, advertising identifiers, IP, browsing and usage data, cookies or similar technologies, depending on the service and the consent settings	Consent (Google consent notice of the player itself)	According to the technical validity of the identifiers, the consent settings and the policies of the providers involved
Complying with legal obligations, responding to requests from authorities and defending against possible claims	The data necessary in each case	Compliance with legal obligations and legitimate interest in the legal defence of the controller	During the legally required periods or as long as necessary for the establishment, exercise or defence of claims

5. User-uploaded content and public or private visibility

Clave de Mi allows users to upload files and content related to the use of the service.

Depending on the type of account or service plan, certain content may be visible to the community or kept private. Currently:

in certain non-premium plans, uploaded content may be accessible to the community as part of the operation of the service;
in premium plans, the user may have additional options to decide whether certain content is public or private.

The public display of such content does not necessarily mean that personal identifying data of the person who uploaded it is shown. If optional features to show the author’s username are enabled in the future, this policy will be updated and users will be duly informed in the service interface.

If a user deletes their account or requests cancellation, content that has already been shared publicly may remain visible to the community where this forms part of the operation of the service, unless it must be removed for legal or technical reasons or because a specific request is considered justified.

Content set as private will not be publicly accessible. However, it may remain temporarily stored in internal systems, backups or technical processes necessary for the continuity of the service, security, the integrity of the information or compliance with legal obligations and claims.

When a user uploads content to Clave de Mi, the user is responsible for holding the necessary rights, permissions or authorisations and for ensuring that such content does not infringe the rights of third parties.

6. Technical conversion of MIDI files and operation of the service

In certain cases, MIDI files sent by the user may be technically processed by a dedicated MuseScore instance hosted on Google Cloud for the sole purpose of converting them to MusicXML and returning the result to the service. According to the current configuration indicated by the controller, this instance is used for technical processing and not as permanent storage of the converted file.

7. Newsletter and commercial communications

Anyone who subscribes to the newsletter or agrees to receive communications may receive news, content, commercial notices or information related to Clave de Mi. These communications are managed through Sender.net.

Subscription is confirmed by email (double opt-in): the confirmation email contains a link that must be clicked to complete the sign-up.

Anyone who signs up for the free 1st edition of Trompeta o Corneta Solista first receives that confirmation email. Once the sign-up is confirmed, a €0 order is created and the book is sent; follow-up emails are then sent on days 3 and 10, together with a discount coupon.

Every email contains a link to unsubscribe at any time. Unsubscribing can also be requested by writing to info@clavedemi.com.

Store order data (email, name and products purchased) is also synchronised with Sender to manage these communications, for example so that products already purchased are not offered again. Customers may be sent communications about products or services similar to those already purchased, on the basis of legitimate interest (art. 21.2 of the LSSI), with the option to unsubscribe in every email.

Sender.net is a European Union provider (UAB “Sender.lt”, Lithuania) and stores the data in the EU. Anyone who has neither subscribed nor become a customer does not receive newsletters.

When buying books, these new-edition notices are explained at checkout and the box “I don’t want these notices” can be ticked to opt out.

8. Comments on the website

Comments on the website are closed. Earlier comments remain published under the name or alias given at the time.

9. Advertising, cookies and similar technologies

The clavedemi.com website uses its own cookie notice, which allows cookies to be accepted, rejected or configured by category (necessary, analytics and marketing). More information is available in the Cookie Policy, and the choice can be reviewed at any time from Cookie Settings.

Google Analytics 4, which is loaded through Google Tag Manager, is activated only after the analytics category is accepted and works with Google’s consent mode: without consent, it only receives signals without identifiers.

The WooCommerce “order origin” also waits for analytics consent, and Sender (marketing) waits for marketing consent.

Google AdSense ads (web version) and Google AdMob ads (mobile apps) are shown only to users without Premium within MIDI & MusicXML Player (clavedemi.com/player/ and its Android and iOS apps), which has its own Google consent notice, independent of the one on the website. The clavedemi.com website does not show Google ads.

10. Recipients, processors and providers that may be involved in the processing

Data may be disclosed or made accessible, to the extent necessary to provide the service or comply with legal obligations, to the following types of providers or recipients:

Hostinger, as the hosting and web infrastructure provider.
Google, in connection with Google Analytics and Google Tag Manager (only with analytics consent), Google reCAPTCHA and Google Cloud (technical conversion of MIDI files), as well as the consent notice and the ads of the player.
hCaptcha (Intuition Machines, Inc.), as the provider of payment protection against abuse.
Apple, only if sign-in with Apple is used.
Stripe, as a payment processing provider.
PayPal, as a payment processing provider.
Sender.net, as an email marketing and newsletter management provider.
Public authorities, courts, tribunals, administrations or other third parties where there is a legal obligation or it is necessary for the establishment, exercise or defence of claims.

In addition, certain embedded or linked third-party content may involve additional processing carried out by those third parties in accordance with their own policies.

11. International data transfers

Some of the providers used by Clave de Mi are located outside the European Economic Area or may carry out access, processing or international transfers of data from there as part of their services.

Transfers to providers in the United States (Google, Stripe, PayPal, hCaptcha and Apple) rely, depending on the provider, on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Sender.net is a European Union provider and stores the data in the EU.

To find out more about the data processing and international transfers of these providers, please consult their privacy policies:

12. Data retention

Personal data is not kept for longer than necessary for each purpose. Specific periods may vary depending on the type of relationship maintained with Clave de Mi, the service used, the existence of legal retention obligations and the need to address possible liabilities.

In general:

contact and support data is kept for as long as necessary to handle the enquiry;
account and usage data is kept while the account remains active;
order and billing data is kept for 6 years (art. 30 of the Spanish Commercial Code);
payment and subscription data is kept during the contractual relationship and for the legally required periods;
data processed on the basis of consent, such as newsletter data, is kept until that consent is withdrawn or unsubscription is requested;
analytics data is kept for 14 months at most in Google Analytics;
public content shared by users may remain visible in line with the operation of the service;
technical logs, backups and activity traces may be kept for the time strictly necessary for security, maintenance, fraud prevention, continuity and integrity of the service.

Once the purpose has ended, data from enquiries, accounts and other processing is kept blocked for the limitation periods of any liabilities that may arise from the processing (art. 32 of the Spanish Organic Law on Data Protection and Guarantee of Digital Rights, LOPDGDD) and is then deleted.

13. Rights of data subjects

The following rights may be exercised, where applicable:

access to personal data;
rectification of inaccurate or incomplete data;
erasure of data where appropriate;
objection to processing in certain cases;
restriction of processing;
data portability where legally applicable;
withdrawal of consent at any time, where processing is based on it.

Exercising these rights is free of charge. It is enough to write to info@clavedemi.com, and a reply is given within one month (art. 12 of the General Data Protection Regulation, GDPR). Where necessary, reasonable additional information may be requested to verify identity.

Anyone who considers that the processing of their data does not comply with the applicable rules may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, https://www.aepd.es).

No automated decisions are taken and no profiles are built that produce legal effects for data subjects.

No data protection officer has been appointed.

14. Minors

The services of Clave de Mi are not aimed at children under 14 without the authorisation of those holding parental authority or guardianship. For data of children under 14 whose processing is based on consent, the consent of those persons is required (art. 7 of the LOPDGDD).

Anyone who believes that data of a child under 14 has been collected without that authorisation may write to info@clavedemi.com to request its deletion.

15. Accuracy of data

Users undertake to provide truthful, accurate and up-to-date data, and not to impersonate third parties or use other people’s information without sufficient legitimacy.

16. Security measures

Clave de Mi adopts reasonable technical and organisational measures to protect personal data against loss, alteration, unauthorised access, improper disclosure or abusive use, taking into account the nature of the data and the risks of the processing.

However, no system connected to the Internet offers an absolute security guarantee. In case of any incident related to data or the account, please write to info@clavedemi.com.

17. Changes to this policy

This privacy policy may be updated to reflect legal, technical or operational changes to the service. When such changes are significant, the updated version will be published on this same page.

18. Contact

For any question about this privacy policy or the processing of data, please write to info@clavedemi.com or use the contact page: https://clavedemi.com/en/contact/.