Privacy Policy
Last updated 14 October 2026
1. Controller
Express it Vendelsö AB, Sweden, is the data controller for Duly Noted. Contact: [email protected].
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Your e-mail address | To sign you in, identify your library and contact you about your subscription | Contract |
| Sheet music you upload and everything we derive from it (page images, recognised notes, audio, your corrections) | To provide the service | Contract |
| Pieces you choose to send to support with “Help us read better”: a copy of the uploaded file, the page images, what the app read from them, your corrections and your comment | To find out why a reading went wrong and improve how the app reads sheet music | Consent – you can withdraw it at any time |
| Sign-in data: when your account was created and last signed in, your active sign-in sessions and, for 10 minutes, a scrambled copy of the code we e-mailed you | To sign you in and keep you signed in | Contract |
| Subscription status (active, cancelled, period end), whether you have used your free piece, and your piece packs (pieces left, which pieces you bought, the Creem order) | To know which features to give you | Contract |
| Technical logs: IP address, browser, time, requested page, your e-mail address | Security, troubleshooting and abuse prevention; kept for 30 days | Legitimate interest |
| Usage events: which features you use and when (upload, analysis, playback, corrections) and errors that occur | To fix problems and improve the service; kept for 30 days | Legitimate interest |
We do not use analytics or advertising trackers and we do not sell or share personal data for marketing.
3. Who else processes your data
- Cloudflare (USA/EU) routes all traffic to our server and checks the sign-in form for robots (Turnstile). Cloudflare sees your IP address and the pages you request. Cloudflare participates in the EU-US Data Privacy Framework.
- Resend (USA, sending from Ireland) sends the sign-in codes. It receives your e-mail address and the e-mail with the code. Resend participates in the EU-US Data Privacy Framework.
- Creem (merchant of record) handles payment. Creem receives your e-mail address and your payment details; we never see your card number. Creem's privacy policy applies to the payment.
- Anthropic (USA) – only for pieces you have sent to support: we may use the AI assistant Claude to help analyse why they were read badly.
- one.com hosts the server that stores your library, in the EU (the Netherlands). A nightly backup is kept on our own equipment in Sweden.
4. How long we keep data
- Your library: as long as your subscription is active, plus 90 days after it ends, then deleted. Without a subscription, your free piece and the pieces you bought with a pack stay until you delete them. You can delete any piece, or your whole account, yourself at any time (the Account page in the app).
- Pieces you send to support: until you withdraw your consent, at most 12 months, and never longer than your library. They are kept apart from your library, so deleting the piece does not delete the copy – withdraw on the piece's page (the “Help us read better” button) or write to us.
- Your e-mail address, subscription status, piece packs and whether you have used your free piece: as long as you have an account, plus what bookkeeping law requires for payment records (held by Creem).
- Backups: what you delete disappears from our backups within 14 days.
- Technical logs and usage events: 30 days.
5. Cookies
We use only strictly necessary cookies: the sign-in session, which ends when you log out or after 90 days without use; a short-lived cookie that remembers your address while you sign in; and one that remembers the language you chose. The app also uses your browser's local storage to remember display settings such as tempo. No third-party cookies.
6. Your rights
Under the GDPR you may ask for access to, correction of, deletion of or a copy of your data, and object to processing based on legitimate interest. You can delete your account and all its data yourself on the Account page in the app. For anything else, write to [email protected]; we answer within 30 days. You may also complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the supervisory authority in your own country.
7. Children
The service is not directed at children under 16. If you believe a child has created an account, contact us and we will delete it.
8. Changes
We will announce material changes to this policy by e-mail or in the app before they take effect.