Privacy Policy
Last updated: 24 October 2026 · version 1.5
This is a translation for your convenience. The Slovene version is legally binding. Slovene version
1. Controller
The frajtonarca service (hereinafter the “service”, “we”) is operated by, and the controller of personal data is:
Pelechova cesta 24A, Preserje pri Radomljah, 1235 Radomlje, Slovenija
Registration number: 6349285000 · Tax number: 60393394 · not registered for VAT
Email: hej@frajtonarca.si · Telephone: 031 669 335
Contact for data protection questions: hej@frajtonarca.si. We have not appointed a data protection officer (DPO), as this is not required by law for the scope of our processing.
We process personal data in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the ZVOP-2 (Slovenian Personal Data Protection Act).
2. What data we process
| Account and identity | name, e-mail address, hashed password or Google identifier (Sign in with Google), profile picture |
| Purchased content | list of purchased sheet music and courses (entitlements) |
| Viewing progress | which lesson in a course was viewed and how far, viewing times |
| Comments and ratings | text comments and content ratings (thumbs up/down), for buyers, teachers and administrators only |
| Uploaded content (teachers) | MusicXML files (sheet music) and videos (courses); content metadata |
| Payments | content purchased, amount, purchase status, name and billing address (collected by Stripe), time of consent to immediate delivery; card details are held exclusively by our payment provider (Stripe) |
| Personalised sheet music (PDF) | the buyer’s name and address are imprinted on the downloaded copy of the sheet music, to protect copyright works against unauthorised sharing |
| Earnings (teachers) | sales shares, payouts |
| Technical data | IP address, browser/device, session tokens, access times, error logs |
| Visit analytics | pages visited, where you came from, device and browser, country; with your consent also clicks and a recording of the visit (data you enter is always hidden) |
3. Purposes and legal bases
- Providing the service: creating and managing accounts, access to purchased content, playing lessons, the virtual accordion, progress, comments. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
- Payments and business records: processing purchases, payouts to teachers, accounting documents. Art. 6(1)(b) and legal obligation, Art. 6(1)(c).
- Security and abuse prevention: protecting the platforms and users. Legitimate interest, Art. 6(1)(f).
- Replying to messages: communication with customers and teachers. Art. 6(1)(b) or (f), as applicable.
- Analytics and site improvements: counting visits without cookies (legitimate interest, Art. 6(1)(f)); cookies, clicks and visit recordings only with your consent (consent, Art. 6(1)(a) GDPR and ZEKom-2, the Slovenian Electronic Communications Act).
4. Who we share data with (sub-processors)
We do not sell data. Data at rest (database, backups) is stored in the EU.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hosting provider (VPS + Postgres) | running the application; data is stored at rest here | EU |
| Bunny.net | hosting and streaming of videos and images; token-protected | EU (Slovenian company; servers in DE) |
| Stripe (Stripe Payments Europe Ltd.) | payment processing, payouts to teachers | EU (IE) + USA |
| SMTP e-mail provider | sending system messages (OTP, magic link, notifications) | EU |
| Sign in with Google (OAuth) | USA / EU | |
| Google (YouTube API Services) | publishing our short videos on the Frajtonarca channel; receives no user data | USA / EU |
| TikTok (Content Posting API) | sending our short videos to our TikTok account; receives no user data | USA / EU |
| Cloudflare (Turnstile) | invisible protection of public forms (e.g. contact) against bots and abuse | EU / USA |
| PostHog (PostHog Inc.) | visit analytics; cookies, clicks, visit recordings and the signed-in user’s name and e-mail address only with consent | EU (servers in Frankfurt) |
| OpenRouter (and model providers, e.g. Google) | covers and news created with artificial intelligence; receives the song lyrics and, if a teacher uploads one, a photo of the band | USA |
Transfers to the USA (Stripe, Google, Cloudflare, OpenRouter, PostHog) are based on the EU Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework, where the provider is certified.
We publish short song videos on our YouTube channel via the YouTube API Services. In doing so, we send YouTube only our recordings and their descriptions, and no data about you. YouTube is subject to the YouTube Terms of Service and the Google Privacy Policy. We also send the same videos to our TikTok account; TikTok likewise receives no data about you in the process.
5. Retention
- Account, purchased content, progress: for as long as you have an account; after it is closed, deletion within 90 days, except where the law requires longer retention.
- Business documents and payout records: in accordance with applicable legislation (generally up to 10 years, ZDDV-1/ZGD-1, the Slovenian VAT Act and Companies Act).
- Comments and ratings: visible until you delete them or close your account.
- Backups: on a rotating basis, overwritten within 30 days.
- Analytics (PostHog): events for up to 1 year, visit recordings for a shorter period.
6. Your rights
Under the GDPR you may request: access, rectification, erasure, restriction of processing, objection (including to processing based on legitimate interest) and data portability; you may withdraw your consent at any time. Write to hej@frajtonarca.si; we will reply within one month at the latest.
You may lodge a complaint with the supervisory authority: the Informacijski pooblaščenec RS (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
7. Security
Encrypted transmission (HTTPS), hashed passwords, role-based access control, token-protected media sources, sub-processors on the principle of minimum scope. No one can guarantee complete security; in the event of a breach, we act in accordance with Art. 33–34 GDPR.
We protect public forms (e.g. the contact form) against bots and abuse with Cloudflare Turnstile, which checks the visitor invisibly, without puzzles and without tracking cookies. In doing so, Cloudflare processes limited technical data (e.g. IP address and browser data) solely to prevent abuse. Details are in the Cloudflare Turnstile Privacy Addendum.
8. Cookies and analytics
Strictly necessary cookies (without consent): the session cookie for signing in (BetterAuth) and a record of your cookie choice.
Analytics (PostHog, servers in the EU), so that we can see what works on the site and what does not:
- Without consent we count visits without cookies: we store nothing on your device; a visit is recognised by a hashed value on PostHog’s servers. There are no visit recordings.
- With consent (“Sprejmi”, i.e. “Accept”) PostHog uses a cookie and local storage, records clicks and records the course of the visit. Data you enter (passwords, e-mail address, forms) and your name and e-mail address in the menu are always hidden in recordings; your profile pages are not recorded.
We do not use advertising cookies. You may change or withdraw your consent at any time:
9. Children
The service is not intended for persons under 16 years of age, and we do not knowingly process their data. If we discover that we have inadvertently collected data of a person under 16, we will delete it without delay.
10. Changes to this policy
We may update this policy; we will notify you of material changes in the app or by e-mail. Continued use of the service constitutes acceptance of the updated version.