1. Who is responsible
The controller of your data is MIBNESS GROUP SL, tax ID (NIF) B54737895, registered address Avenida de Cuba 5, Urbanización San Sebastián, Torre II, 03503 Benidorm (Alicante), Spain. For any privacy question you can write to hola@tuttikit.com.
2. The short version
- Your files never leave your device. The tools (transposing, extracting parts, metronome, tuner, chords…) run in your browser. We do not upload or store your scores, audio or documents. The only exception is "PDF to MusicXML": to read the score, the file is sent to our server, processed and deleted when done (see below).
- The tuner uses the microphone only while you turn it on, and the sound is analysed on your device: it is not recorded or sent.
- You can use TuttiKit without giving us any data. We only ask for your email if you want an account, the newsletter or to join the Premium waiting list.
- We do not sell data or show personalised advertising.
- Visit statistics use no cookies and do not store your IP, and only run if you accept them.
3. What data we process, why, and on what legal basis
Using the tools without an account
Files you open are processed in your browser and never reach us. Some preferences (for example your instrument, your practice goal or the practice timer history) are stored only in your browser (local storage) so the tool remembers them. You can delete them at any time by clearing this site's data in your browser.
PDF to MusicXML (score recognition)
- Data: the PDF or image of the score you upload, and the recognized score (MusicXML). If the file contains personal data (for example, a name on the cover), that is processed too.
- Purpose: converting the score to MusicXML at your request.
- Where: on our own server rented from Hetzner Online GmbH in Germany (Nuremberg).
- Retention: the uploaded file is deleted as soon as recognition ends, whether it succeeds or not. The result is deleted after 30 minutes at most. We keep no copies.
- Usage limits: to apply the daily limit we store the job identifier, an anonymous daily identifier (or your account, if you have Premium), the number of pages and the date. This is deleted after 40 days.
- Your obligations: you may only upload scores you have the right to use (your own, public domain, or with permission from the author or publisher). We ask you to confirm this before each upload.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR) when you use the feature you request.
User account
- Data: your email address, language, sign-up and last sign-in dates.
- Why: to create your account, send you the sign-in link (no password) and keep you signed in.
- Legal basis: performance of the contract you accept when creating the account (Art. 6(1)(b) GDPR).
- How long: while you keep the account. Sign-in links expire within minutes and sessions after 30 days.
What you save in your account ("My stuff" and practice)
- Data: the songs with chords, reharmonizations, named metronomes, setlists and, with Premium, scores recognized with "PDF to MusicXML" that you choose to save, and your practice log (minutes per day, top tempo, sessions with the activity and any notes you write).
- Why: so you can get them back on any device and see your stats.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- How long: until you delete them or your account. Deleting your account deletes everything you saved.
- Tip: do not write other people's personal data or sensitive information in your practice notes.
Premium subscription and payments
- Sales and payments are handled by Paddle.com Market Limited ("Paddle"), which acts as Merchant of Record and is an independent controller of the payment and billing data you give it. See its privacy policy.
- We never receive or store your card details. Paddle sends us your customer ID, subscription status, plan and paid-period dates so we can switch Premium on or off in your account.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Paddle keeps billing data for as long as tax law requires.
AI mode
- When you use an AI feature (reharmonize, practice plan, adapt or polish chords), we send Anthropic, PBC (the AI model provider) only what is needed to generate the answer: the chord list, key and settings (tempos, days, instrument) and the text of your request. We never send song lyrics, your files or your email.
- Anthropic acts as a processor (Art. 28 GDPR). Under its commercial terms, it does not use data received through its API to train its models.
- To apply the daily limit of free uses we store an anonymous identifier, derived from your connection with a secret key that changes daily, and the number of uses. It is deleted after 40 days.
- Do not include personal data in your AI requests.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR) when you use the feature you request.
Newsletter
- Data: email, language, date and proof of your consent.
- Why: to send you TuttiKit news.
- Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email.
- How long: until you unsubscribe.
Premium waiting list
- Data: email, language, the features you are interested in, date and proof of your consent.
- Why: to notify you once when Premium is available.
- Legal basis: your consent (Art. 6(1)(a) GDPR). You can ask us to remove you at any time.
Usage statistics (only if you accept them)
- If you accept statistics in the cookie banner, we count anonymous visits and actions (page viewed, tool used, option chosen, download), together with the traffic source, device type and browser.
- We use no cookies for measurement and do not store your IP address. To count unique visitors per day we compute an anonymous fingerprint with a key that is renewed and deleted every day, so it is not possible to identify you or follow you from one day to the next. Country is inferred from your browser's time zone, not from your IP.
- Visits from people with "Do Not Track" or Global Privacy Control enabled are not counted.
- Legal basis: your consent (Art. 6(1)(a) GDPR). Kept for 25 months.
Tool ratings
If you rate a tool with stars, we store the rating, tool, language and date, with a daily anonymous identifier to prevent repeat votes. We do not store your IP.
Security and abuse prevention
To stop automated form submissions we keep an encrypted fingerprint of the connection (not the IP) for 24 hours. Legal basis: legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
4. Who we share data with
Only with the providers needed to run the service, under contract and with appropriate safeguards:
- Hostinger International Ltd. · website hosting, database and email delivery.
- Hetzner Online GmbH (Germany) · server where "PDF to MusicXML" is processed.
- Anthropic, PBC (USA) · AI model, only when you use AI mode.
- Paddle.com Market Limited (United Kingdom) · Premium sales and payments, as an independent controller.
We do not share data with third parties unless required by law.
5. International transfers
Anthropic is in the United States and Paddle in the United Kingdom. These transfers rely on the safeguards provided by the GDPR: the European Commission's adequacy decision for the United Kingdom and, for the United States, the EU-US Data Privacy Framework or the Commission's standard contractual clauses.
6. Cookies
We use one technical cookie to remember your cookie choice and, if you have an account, another to keep you signed in. Full details in the cookie policy.
7. Children
TuttiKit is for everyone, but to create an account, subscribe to the newsletter or join the Premium list you must be at least 14 (Art. 7 of Spain's Organic Law 3/2018). Under 14s need consent from a parent or guardian.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to hola@tuttikit.com, stating which right you are exercising and your account email if you have one. In My account you can also delete what you saved and delete your account with all its data. Premium also lets you download your practice history as CSV, but anyone, Premium or not, can ask us for a free copy of all their data by writing to us.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.
9. Changes
If we change this policy in a meaningful way, we will say so on this page and, if you have an account, email you.
Last updated: 4 November 2026.