Instruzic

FREN

Open the app

Privacy

Your privacy, and what we do with it.

What information we process, what happens to the sound from your microphone, where it is hosted, how long we keep it and how to exercise your rights. The full text below is what applies.

This privacy policy is also available in French; both versions have the same meaning.

Effective date of this version: October 10, 2026. Previous version: October 6, 2026.

Text to be validated by a lawyer: it has not yet been reviewed by legal counsel.

1. Who is responsible for your information

Instruzic is one of the products of KTMA SOLUTIONS, a business corporation established in Quebec, Canada (full contact details in the legal notice). KTMA SOLUTIONS is responsible for the personal information processed in connection with the site, the web app, the mobile app and the Instruzic services.

Person in charge of the protection of personal information at KTMA SOLUTIONS: contact@ktmasolutions.com. Requests about your information and the exercise of your rights may be sent to this address.

2. Information we process

We limit collection to what is needed for the purposes described in section 4. Depending on the features you use:

  • Account: email address (verified with a code), password stored only as a hash (never in plain text), language; optionally a display name (by default taken from your email address), a short bio, a location and a profile photo.
  • Musical profile and learning: instruments, level, goals, styles, progress in lessons, results of exercises and assessments, skills, reviews, favourites, library, certificates and recommendations.
  • Microphone practice: the results computed on your device (expected note, estimated played note, accuracy, timing offset, confidence score) and how long the microphone was used. The sound itself is not sent (section 3).
  • Audio files you choose to import, when this feature is offered, and their analysis (section 3).
  • Subscription and payments, once sales open: plan, status, dates, country of purchase, amounts, currencies and references sent by the payment provider or app store, including the technical response they send back to us. Instruzic does not receive or store your full card details.
  • Family plan, when you take part: membership of the household, role, invitations (email address optional) and the sharing you grant.
  • Support: the content of your requests and our answers.
  • Technical and security data: for each sign-in session, the device name and type, the IP address and the identification of the browser or app; a technical identifier of your devices; a log of the actions carried out on your account; a record of your consents; web app crash reports intended for technical troubleshooting: the reports currently generated contain no account identifier and no IP address; if they contained other information that could identify a person, they would remain subject to the applicable protection obligations.

This information comes from you, from your use of the service, from the payment provider or store that confirms a purchase and, for the Family plan, from the person who invited you.

Instruzic does not ask for your date of birth and does not collect health information, beliefs or other specially protected categories. Free text you type (bio, support requests) may nevertheless contain such information if you write it there.

3. Microphone and audio files

Microphone practice. Instruzic asks for access to the microphone only when you start a calibration, an exercise or a short practice recording. The sound is analysed on your device (in your browser or in the app) and is not sent to our servers; only the results described in section 2 are. The short clips the mobile app lets you listen back to and your calibration settings stay on your device. You can withdraw microphone permission in your device or browser settings; the features that depend on it are then no longer available.

Imported files. When the import feature is offered, an audio file you choose to import is sent to our servers to be analysed, only after your consent, which is recorded with the text version, language and date. The file and its analysis are kept until you delete the project or your account. You can withdraw this consent in Settings: withdrawal prevents new uploads, without automatically deleting files already imported. You can delete the project concerned or ask us to review the retention of the existing files, in particular where it relies on the withdrawn consent. The analysis runs on our own servers; no file is sent to a third-party artificial intelligence provider.

4. Purposes and legal bases

  • Create and secure your account, sign you in on your devices and sync your learning: performance of the contract.
  • Provide lessons, practice, analysis of your playing, your certificates, levels and exercise recommendations: performance of the contract (these are the service’s learning features); your consent for uploading audio files.
  • Manage a subscription, a trial, payments and the Family plan, once sales open: performance of the contract; accounting and tax obligations for keeping the records.
  • Answer your support requests: performance of the contract; answer your requests about your information: legal obligation.
  • Protect accounts and the service (sessions, IP addresses, action log, fraud and abuse prevention, fixing errors): our legitimate interest in protecting accounts, users and the integrity of the service, within the limits set by law.

Where the law requires your consent, we ask for it for a specific purpose and you can withdraw it for the future. We do not use your information for a new incompatible purpose without the notice and, where required, the consent provided by law. We do not sell or rent your information, do not do targeted advertising and send no promotional emails: Instruzic emails concern your account (verification codes, password reset, account closure).

5. Automated decisions

Instruzic automatically computes levels, scores and exercise recommendations from your activities and practice results. These computations can influence your learning path. Based on the features currently offered, they do not produce a decision that has a legal effect on you or similarly significantly affects you within the meaning of Article 22 of the GDPR. You can ask for explanations and for inaccurate information to be corrected.

6. Minors

Instruzic does not collect dates of birth and does not currently have a mechanism to verify age or parental authority. Profiles reserved for children in the Family plan are not available.

Where the applicable law requires the consent or authorisation of a parent or legal representative, it must be obtained before the collection or use concerned. In Quebec, collecting personal information from a child under 14 is subject to the specific rules provided by law. In the European Union, where processing is based on consent, the age at which a child can consent alone depends on the Member State. In Cameroon, the processing of data about minors is subject to the applicable provisions of Law No. 2024/017; where the law requires the authorisation or involvement of the legal representative, it must be obtained.

The absence of technical age verification is not a confirmation that the required parental consent exists. If a required authorisation cannot be established, KTMA SOLUTIONS may restrict the processing concerned while the situation is reviewed.

Parents or legal representatives can report a minor’s use of the service and ask for the information concerned to be reviewed or deleted at contact@ktmasolutions.com. These requests are handled after appropriate verification of their capacity and in accordance with the applicable legal obligations.

7. Recipients

Depending on the features used, your information may be accessible or disclosed:

  • to our hosting and infrastructure providers, and to our email provider for sending account emails; they act on behalf of KTMA SOLUTIONS;
  • once sales open, to the payment provider or app store you choose (Stripe for cards, Flutterwave or PayDunya for mobile payment, Apple App Store, Google Play): they receive the information needed for the payment, for example your email address or, for mobile payment, your phone number, and act under their own terms and policies;
  • in the Family plan, to the owner and administrators of the household, who see members’ names, photos and email addresses but not their results; other data is shared only if you allow it, revocably;
  • to the Instruzic team, as needed (support, security, running the service); changes it makes to an account are logged;
  • to authorities, only where the law requires it;
  • to an acquirer in a business transfer, with the protections required by law.

No third-party analytics, advertising or tracking tool is used.

8. Hosting and disclosure outside Quebec

The Instruzic applications, database and active files are hosted in Canada, in Quebec. Backup copies may be kept in Canada, in a province other than Quebec, to ensure service continuity and data recovery. Backup copies of the database and of files are encrypted before they are sent; they are kept outside Quebec only with the security measures and contractual commitments adopted following the prior assessment described below. Some technical providers (for example for email) or, once sales open, payment providers may operate in other territories. Further information about our hosting providers is available upon request.

KTMA SOLUTIONS is required to assess in advance any disclosure of personal information outside Quebec, in particular through a privacy impact assessment and a written agreement ensuring adequate protection, and to comply with the safeguards required by the applicable laws. The location and processing conditions of each provider must be checked before a disclosure outside Quebec is authorised.

Where the General Data Protection Regulation (GDPR) applies to a transfer to Canada, KTMA SOLUTIONS examines whether the transfer benefits from the European Commission’s adequacy decision for the Canadian commercial organisations concerned; otherwise, the safeguards or derogations provided by Chapter V of the GDPR are examined before the transfer. Any onward transfers to other territories are analysed separately.

The categories of recipients, the territories concerned and the applicable safeguards can be requested at contact@ktmasolutions.com.

9. Retention

  • Account, profile, progress, projects, library and files: as long as your account exists, then as set out in section 10 if you delete it.
  • Imported audio files: until the project or the account is deleted.
  • Verification and password reset codes: 30 minutes.
  • Read notifications: 90 days.
  • Export archive of your data: 24 hours, encrypted.
  • Web app crash reports: 30 days.
  • Sign-in sessions: they contain in particular the IP address, the device and the identification of the browser or app. As things work today, they are not deleted automatically on their own before the account is purged.
  • Action log and technical payment events: they currently have no automatic purge period, and some of these records remain after the account is deleted. They serve in particular security, oversight of operations and incident handling.
  • Payment records, once sales open: for the period required by accounting and tax rules; when the account is purged, they are no longer linked to your account.
  • Server access logs: they may contain the IP address and information about requests; how long they are actually kept depends on the hosting configuration and is not set by the application.
  • Database and file backups: they are made periodically and current backups are replaced according to rotation rules; some remote copies, when configured, may be kept for 30 days in normal operation; separately retained backup copies, including copies held on independent recovery media, may be subject to different retention periods. Data deleted from the live system may therefore remain in a backup until that backup actually disappears. KTMA SOLUTIONS must govern these copies, limit their use to restoring the service and apply the retention, destruction and security obligations provided by law.

Categories for which no period is set above are not presented as having a guaranteed retention period. KTMA SOLUTIONS must periodically review whether they need to be kept, in light of the applicable legal obligations, and handle admissible requests for deletion or anonymisation in accordance with the law. Precise periods will be published once they are applied.

10. Account deletion

You can delete your account in the app or on the Delete your account page, with your password. Deletion immediately deactivates the account, revokes your sessions, releases your email address and starts a purge procedure after a grace period normally set at 30 days. During this period, only our team can restore the account, after verification; the “this was not me” link in the confirmation email reports the request to us.

When this period ends, the learning data, account files and profile elements covered by this procedure are deleted. A residual technical identifier may be kept for authorised traceability purposes; keeping it does not, on its own, mean that all the remaining information is legally anonymous. Some information is however kept separately: the record of the request (the email address reduced to a fingerprint), the log of your requests about your information, payment records, technical payment events, credit history and audit records. Some of this data is detached from the account or anonymised, but detaching it does not on its own guarantee anonymity in all circumstances. Copies of the deleted information may also remain temporarily in backups, according to the rotation rules applicable to each category of copy; some one-off backups may be kept longer than current backups. Their retention and destruction remain subject to the legal obligations described in section 9.

Deleting the account does not replace exercising your legal rights to erasure, objection or restriction: you can ask for a specific review of the remaining data at contact@ktmasolutions.com, assessed in light of retention obligations, legal exceptions and applicable rights. Download your data before deleting your account if you want to keep a copy.

11. Security and incidents

  • encrypted connections (TLS);
  • passwords stored as salted, iterated hashes, limited attempts, one-time codes;
  • short-lived sign-in tokens, renewed with reuse detection; on mobile, stored in the device’s secure storage;
  • encrypted export archive and a 15-minute download link;
  • administration access limited to authorised addresses and roles, with changes logged;
  • no third-party script or tracker on the site and the web app.

No system is free of risk. When a confidentiality incident is identified, it is assessed in accordance with the applicable legal obligations, in particular regarding risk reduction, recording in the incident register and, where the legal criteria are met, notice to the competent authority and the people concerned.

12. Your rights

Depending on the law that protects you, and subject to its exceptions, you can ask for access to your information and a copy, its correction, its deletion, its portability in a structured, commonly used format, the end of its dissemination or its de-indexing where these rights apply, restriction of processing or object to it, and withdraw a consent for the future.

Directly in Instruzic: download your data (“Download my data” in Settings, on the web and in the app; one archive per 24 hours, in JSON format), manage your consent to uploading audio files, delete your account. The downloadable archive gathers the main categories of data linked to the account; it does not necessarily replace all the information that can be obtained through a legal access or portability request. For an additional request or any other request, write to contact@ktmasolutions.com. We may ask for the information needed to verify your identity, in proportion to the risk of disclosure. We answer within the time limits set by the applicable law: in Quebec, an answer to an access or correction request is in principle given within 30 days of receipt; where the GDPR applies, the answer is normally given within one month, which may be extended under the conditions of that regulation, with information to the person concerned. If we refuse in whole or in part, we tell you the reasons and the remedies provided by the applicable law.

You can also contact an authority: in Quebec, the Commission d’accès à l’information du Québec; in Canada, the Office of the Privacy Commissioner of Canada; in the European Union, the supervisory authority of your place of residence; in Cameroon, the personal data protection authority provided for by Law No. 2024/017.

13. Cookies and local storage

The public site sets no cookie; it only keeps in your browser the language you chose and the dismissal of the language suggestion. The web app uses cookies strictly necessary for your session (sign-in and protection against request forgery) and the browser’s local storage for your preferences, your calibration, working copies of your progress and pending uploads; the data linked to your account is erased from it when you sign out. The mobile app keeps your sign-in tokens in the device’s secure storage and working copies locally. No advertising or analytics cookie is used, so no cookie consent is requested.

14. Applicable laws

Depending on your situation: in Quebec, the Act respecting the protection of personal information in the private sector (as modernised by Law 25); in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies; in the European Union, the GDPR; in Cameroon, Law No. 2024/017 on the protection of personal data; and any other applicable mandatory law. Where the applicable law makes a processing operation or a transfer subject to a prior formality with an authority, that formality must be completed before the processing concerned.

15. Changes

We may change this policy to reflect changes in the service or the law. Each version is published here with its date; appropriate notice is given for a significant change. Previous versions are available upon request.