Stavo Privacy Policy

Who controls your data

Stavo is operated by Stefan Blazhevski from Ibe Palikukja 24, Skopje, Republic of North Macedonia. Stefan Blazhevski is the controller for the processing described in this policy. For privacy questions or data-rights requests, email privacy@stavo.online or call +389 72 265 762.

Data we collect

We collect only the information needed to provide and protect the service, remember your work, and understand aggregate product usage when you choose to allow analytics.

Trial and billing

Your selected billing option, Lemon Squeezy customer, order, subscription, product and variant identifiers, entitlement status, renewal or expiry dates, and payment-event records needed to keep access accurate. Lemon Squeezy processes payment details; Stavo does not store your full card number.

Account and security

Your display name, email address, password hash, account timestamps, product-tour status, role, and session identifiers and expiry information. We do not store your plaintext password.

Private workspace

Your scores and notation settings, instrument choice, collections, favorites, archive and trash state, course enrollments, completed lessons, XP, and achievement progress.

Privacy preferences

Your cookie and storage choices are saved in your browser so Stavo can respect them.

Optional analytics

If you consent, Stavo increments an aggregate daily count for the page category and whether the viewer is anonymous or signed in. The analytics record does not include the full URL, score content, user ID, or a cross-site advertising identifier.

Messages

Information you include when you contact us for support or to exercise a privacy right.

Why we use it

Provide Stavo

Create and secure your account, save your private workspace, play scores, and track course progress. The legal basis is performance of the service you request or steps taken at your request before entering that arrangement.

Protect the service

Prevent abuse, enforce access controls, investigate faults, and maintain reliability. The legal basis is our legitimate interest in operating a safe and dependable service.

Optional product analytics

Understand aggregate feature and page usage. The legal basis is your consent, which you can withdraw at any time through Privacy choices.

Respond and comply

Answer support and privacy requests, keep required records, and comply with lawful obligations. The legal basis is the relevant request, legitimate interest, or legal obligation.

Cookies and browser storage

You can accept, reject, or customize optional storage from the consent banner and reopen the same controls through Privacy choices in the site footer. Browser Global Privacy Control signals keep advertising storage disabled.

Account session

A first-party, HttpOnly refresh cookie keeps you signed in for up to 30 days. It is strictly necessary for the account service.

Consent preference

First-party browser storage remembers your privacy choices for up to 12 months.

Requested app state

First-party browser storage supports features such as editor clipboard state and the plan selected before account creation.

Optional categories

Analytics and advertising storage remain off before consent. Stavo currently uses no third-party advertising cookies and does not connect an external analytics provider.

Who receives data

Lemon Squeezy acts as merchant of record for Stavo purchases and processes checkout, payment, tax, subscription, refund, and billing-support information under its own buyer terms and privacy notice. Stavo receives only the customer, order, subscription, and entitlement information needed to provide and manage access.

We may also use infrastructure, hosting, database, security, and operational providers that process data only to deliver Stavo under appropriate contractual safeguards. We may disclose information when required by law, to protect users or the service, or as part of a genuine business reorganization subject to applicable protections.

We do not sell personal information, share it for cross-context behavioral advertising, or make your score library public.

International transfers

Stavo is designed to use European infrastructure. If a provider processes personal data outside the European Economic Area, we will use an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep data

We use the shortest retention period reasonably necessary for each purpose. Some records may be kept longer when law requires it or when needed to establish, exercise, or defend legal claims.

Account and workspace

Kept while your account is active and then deleted or anonymized when no longer needed, subject to legal, security, and dispute-resolution requirements.

Billing records

Subscription, transaction, refund, and entitlement records are kept for the period required to provide access, resolve disputes, prevent fraud, and meet accounting or legal obligations.

Sessions

Session credentials expire after no more than 30 days and can be revoked when you sign out.

Backups and logs

Deleted information may remain in protected backups or security records until the relevant retention cycle expires, after which it is overwritten or removed.

How we protect data

Stavo uses safeguards appropriate to the current service, including HTTPS in transit, one-way password hashing, HttpOnly session cookies, authorization checks, and restricted database access. No online service can guarantee absolute security, so please use a strong, unique password and contact us if you suspect unauthorized access.

Your privacy rights

We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects.

Your choices

Depending on where you live, you may request access, correction, deletion, restriction, or portability; object to certain processing; and withdraw consent without affecting earlier lawful processing.

How to ask

Email privacy@stavo.online. We may need to verify that the request relates to you before acting on it.

Complaints

You may complain to the data-protection authority in the EU or EEA country where you live, work, or believe an infringement occurred, or to another regulator that applies where you live.

Music content and future audio features

Your score content remains private to your account, but you are responsible for ensuring that you have the right to enter or upload the material you use. Audio-to-score transcription is not currently available in production. We will update this policy before accepting production audio uploads if that feature launches.

Children

Stavo is not directed at children who cannot lawfully consent to an online service in their country. A parent or guardian should provide any consent required by local law. Contact us if you believe a child provided personal data without the required permission.

Policy changes

We may update this policy as Stavo changes. We will publish the revised date here and provide a more prominent notice when a change materially affects how we use personal data.