GUITAR CAP ALPHA LEGAL

Privacy Policy

Last updated: 25 September 2026

1. Who is responsible for your data

Guitar Cap is operated by Giuseppe Cappellacci, Via Corsica 3, 09126 Cagliari, Italy, VAT no. 04208860926 (“Guitar Cap”, “we”, “us”). Privacy, legal and support contact: hello@guitarcap.com.

Guitar Cap is the data controller for the personal data described in this policy, except where a service provider processes data for its own independent purposes under its own terms.

2. What this policy covers

This policy explains how personal data is handled when you visit the Guitar Cap website or Alpha landing page, use Guitar Cap as a guest, request Private Alpha access, use an account, save or sync guitar-practice data, choose optional product analytics, contact us, report a problem or load supported third-party content.

3. Data we process

Guest and practice data

You may create or save information such as instruments, Practice Items, routines, practice sessions, dates, durations, BPM, sets, goals, notes and progress-related data. When you use Guitar Cap as a guest, this data is stored primarily in browser storage on the device and browser you are using. It is not a cloud backup.

Account data

If you request or use an Alpha account, we process information such as your email address, authentication identifiers, account status, Terms acceptance information and a display name if you choose to provide one.

Uploaded or linked material

If supported, you may upload files or associate links and references with practice material. We process those items to provide the feature you requested.

Optional product analytics

If you choose Allow analytics, Guitar Cap uses first-party product analytics to understand whether users can move from the landing page into the product, reach the core practice workflow, return to practice and use key product features.

Analytics may include a randomly generated browser analytics identifier, an analytics session identifier, event and timestamp information, app route and release version, broad device class, acquisition information such as source, medium, campaign, content and test cohort, the entry surface used to reach the product, and limited structural practice information needed to measure product use.

Product analytics are designed not to include email addresses, display names, Practice Item names, Routine names, notes, free-text feedback, problem-report text, reference URLs, passwords or authentication tokens. Optional analytics are not used for advertising, cross-site tracking, behavioural advertising or advertising profiles.

Support and problem-report data

If you contact us or report a problem, we process the information you send. A problem report may also contain limited technical context needed to reproduce the issue, such as the current app route, app/release version, account-or-guest mode, viewport, browser/platform information and user agent. Guests may optionally provide an email address for a reply.

Technical, security and operational data

Our infrastructure and service providers may process technical request, authentication, security, delivery and diagnostic information needed to provide, protect and troubleshoot Guitar Cap.

4. Why we process data and our legal bases

Providing guest functionality. We use local data to run the app, save guest practice on the current browser, remember necessary preferences and recover interrupted practice. This processing is necessary to provide the features you request.

Accounts, authentication and cloud sync. We process account and cloud data to handle Alpha access, authenticate users, manage account status and store/sync supported practice data. This is used to take steps at your request and provide the service relationship.

Support and problem resolution. We process support information to respond to requests, diagnose failures and maintain service reliability. Depending on the context, this is necessary to provide the requested service and/or based on our legitimate interest in operating a reliable support and troubleshooting process.

Security and abuse prevention. We process limited security and operational information to protect accounts and data, prevent abuse, verify service integrity and investigate incidents. This is based on our legitimate interest in securing Guitar Cap and, where applicable, legal obligations.

Optional product analytics. We process Analytics V2 data only with your consent, to measure the Alpha funnel, activation, repeat practice, product behaviour, reliability and acquisition experiments.

Legal compliance. We may process data where necessary to comply with applicable legal obligations or valid legal requests.

5. Browser storage and analytics choices

Guitar Cap uses browser storage that is necessary to provide features such as guest practice, authentication state, preferences and interrupted-practice recovery.

Optional analytics identifiers and product events are created only after analytics are allowed. You can choose Only necessary or Allow analytics, and you can change this choice later from Settings.

If you withdraw analytics consent, Guitar Cap stops future optional analytics and removes analytics-only identifiers from the browser. Withdrawal does not affect processing that was lawful before withdrawal. See the Cookie & Browser Storage Policy for details.

6. Guest data and cloud sync

Guest practice is tied to the browser/device where it was created and may be lost if browser/site data is cleared, storage is reset or that device/browser is no longer available.

If Private Alpha access is approved and you sign in on the same browser, Guitar Cap may transfer supported guest data into your account so it can be backed up and synced. Guest data is removed from local storage only in accordance with the successful import/sync flow or when you clear it.

7. Service providers and recipients

Supabase. Used for authentication, database, storage, server-side functions and first-party product-event processing. The primary Guitar Cap Supabase project is hosted in the EU West (Ireland) region.

Vercel. Used to host and deliver the Guitar Cap application and related technical services.

Resend. Used for authentication and operational email, email delivery and supported inbound email workflows. Resend states that customer email data may be stored in the United States under the transfer safeguards described in its Data Processing Addendum. Guitar Cap keeps email open tracking and click tracking disabled during the Private Alpha.

Operational email provider. We use an email service to receive and respond to support and Alpha communications. Where this setup changes materially, our privacy records and this policy will be updated as appropriate.

We may also disclose data where required by law or where necessary to establish, exercise or defend legal claims.

8. Third-party content

Practice references may link to third-party platforms such as YouTube or Instagram. Where supported, third-party embedded content is loaded only after you choose to load it. Once loaded, your browser connects directly to that third party and its own privacy and storage practices may apply. You can choose to open the original third-party website instead.

9. International transfers

Some service providers or their subprocessors may process personal data outside the European Economic Area. Where GDPR transfer rules apply, we rely on the safeguards made available under the relevant provider agreement, such as an adequacy decision, the EU-U.S. Data Privacy Framework where applicable and/or European Commission Standard Contractual Clauses.

You may contact hello@guitarcap.com for information about the relevant safeguards.

10. How long we keep data

• Guest practice: until you clear browser/site data, the data is successfully transferred according to the product flow, or local storage is otherwise removed.
• Account and cloud practice data: while the account is active and until deletion is requested or the account/service is closed, subject to limited backup, security and legal-retention periods.
• Raw optional product analytics: up to 12 months, after which they should be deleted or aggregated/anonymised unless a shorter period is appropriate.
• Problem reports and Guitar Cap-controlled support records: up to 12 months after resolution, unless longer retention is reasonably necessary for an ongoing issue, security matter or legal obligation.
• Guitar Cap-controlled security/operational records: only for the period reasonably necessary for security and troubleshooting; the current internal target is 90 days unless an active incident or legal need requires longer.
• Deleted account data in Guitar Cap-controlled backups: removed through the normal backup lifecycle. We aim for a maximum of 30 days where technically supported; provider-specific backup periods may apply.

Some infrastructure providers maintain their own technical logs, backups or service records for periods defined by their contracts and policies. We periodically review retention and reduce it where data are no longer needed.

11. Your rights

Subject to applicable law, you may have the right to access personal data we hold about you, correct inaccurate data, request deletion or restriction, receive applicable data in a portable format, object to processing based on legitimate interests, withdraw consent where processing is based on consent, and lodge a complaint with a competent data-protection authority.

In Italy, the supervisory authority is the Garante per la protezione dei dati personali. To make a privacy request, contact hello@guitarcap.com. We may need to verify proportionately that the requester is the person concerned before disclosing or deleting account data.

12. Is providing data mandatory?

You can use core guest functionality without an account and without optional analytics. An email address and authentication data are necessary only if you choose to request or use an account. Practice data are processed only to the extent you choose to save them. Contact information is optional in a guest problem report unless needed for a reply.

13. Automated decision-making

Guitar Cap does not currently use personal data for automated decision-making that produces legal effects or similarly significant effects on users. Alpha access may be reviewed manually.

14. Security

We use technical and organisational safeguards intended to protect Guitar Cap and its data, including access controls, authentication controls and restrictions around administrative data. No online service can guarantee absolute security.

15. Changes

We may update this Privacy Policy as Guitar Cap changes. If a change materially affects how we use personal data, we will provide appropriate notice where required.

16. Contact

Privacy, legal and support contact: hello@guitarcap.com.