SoundSurf Legal
Privacy Policy
Effective: 28 February 2026 · Last updated: 13 July 2026
3. How We Use Personal Data
SoundSurf may process personal data to:
- Create, authenticate and manage user accounts
- Provide access to SoundSurf features
- Save user progress and preferences
- Operate lessons, tasks, quizzes, examinations and learning paths
- Operate XP, levels, badges, rankings and other gamification systems
- Enable user profiles and social platform features
- Enable messages and communications between users
- Host and display user-generated content
- Process subscriptions and payments
- Provide invoices and transaction records
- Respond to support requests
- Investigate technical problems
- Prevent fraud, abuse and unauthorized access
- Moderate content and enforce platform rules
- Improve platform performance and user experience
- Analyze aggregated platform usage
- Send essential service communications
- Send marketing communications where the user has consented or where otherwise legally permitted
- Establish, exercise or defend legal claims
- Comply with legal, regulatory, accounting and tax obligations
SoundSurf does not sell personal data.
4. Legal Bases for Processing
Under the General Data Protection Regulation, personal data may be processed on the following legal bases.
4.1 Performance of a Contract
Processing may be necessary to:
- Create and maintain an account
- Provide platform functionality
- Save learning progress
- Process subscriptions
- Deliver purchased services
- Enable user-requested communications and features
4.2 Legitimate Interests
Processing may be based on SoundSurf’s legitimate interests in:
- Protecting accounts and platform security
- Preventing fraud and misuse
- Troubleshooting technical issues
- Improving platform functionality
- Understanding general service performance
- Moderating content
- Enforcing platform rules
- Establishing or defending legal claims
Where processing is based on legitimate interests, SoundSurf considers whether those interests are overridden by the rights and freedoms of users.
4.3 Consent
Consent may be used for:
- Non-essential analytics cookies
- Advertising and marketing cookies
- Optional marketing communications
- Other optional processing activities clearly presented to the user
Users may withdraw consent at any time. Withdrawal does not affect processing carried out lawfully before consent was withdrawn.
4.4 Legal Obligations
Personal data may be processed where necessary to comply with:
- Tax and accounting requirements
- Valid legal requests
- Regulatory obligations
- Fraud prevention obligations
- Court orders
- Other applicable laws
5. Whether Providing Data Is Mandatory
Certain information, such as an email address, username and authentication information, may be required to create and operate a SoundSurf account.
Payment information is required when purchasing a paid subscription.
Where required information is not provided, SoundSurf may be unable to create an account, process a payment or provide the requested service.
Optional profile information does not have to be provided unless clearly stated otherwise.
6. Artificial Intelligence
SoundSurf may use artificial intelligence-assisted tools to create or organize:
- Educational content
- Lessons
- Questions and answers
- Platform descriptions
- Structured learning materials
- Administrative or technical content
AI-assisted tools are not intended to make decisions that produce legal or similarly significant effects concerning users.
Where personal data is processed through an AI-assisted service, SoundSurf will seek to limit the information shared to what is reasonably necessary and use appropriate contractual, technical and organizational safeguards.
Users should not include unnecessary sensitive personal information in prompts, support requests, messages or uploaded content.
7. Service Providers and Recipients
Personal data may be disclosed to service providers that support the operation of SoundSurf, including providers of:
- Application infrastructure and database services
- Hosting and domain services
- Cloud storage
- Authentication
- Payment processing
- Email delivery
- Customer support
- Analytics
- Advertising
- Consent management
- Security and fraud prevention
- Error monitoring
- Legal, accounting and professional services
Current or potential providers
- Base44, for application infrastructure, databases and platform services
- IONOS, for domains, website infrastructure or related services
- Stripe, for payments and subscriptions
- CookieHub, delivered through Google Tag Manager, for cookie consent management
- Google Analytics, where enabled and consented to
- Google Ads, where enabled and consented to
Providers receive only the information reasonably required to perform their services and may act as processors, independent controllers or joint controllers depending on the service and processing activity.
Other disclosures
Personal data may also be disclosed:
- Where required by law
- In response to a valid legal request
- To protect users, SoundSurf or third parties
- In connection with a business restructuring, transfer or acquisition
- With the user’s direction or consent
8. International Data Transfers
Some service providers may process personal data outside Italy or outside the European Economic Area.
Where personal data is transferred to a country that has not been recognized as providing an adequate level of protection, SoundSurf will rely on an appropriate transfer mechanism where required, such as:
- European Commission adequacy decisions
- Standard Contractual Clauses
- Applicable data protection frameworks
- Other safeguards permitted by data protection law
Users may contact SoundSurf for additional information about applicable transfer safeguards.
9. Data Storage and Security
SoundSurf uses service providers, including Base44 and IONOS where applicable, to support its platform and infrastructure.
The specific location in which data is processed may depend on the provider, service configuration and data residency settings selected for the platform.
SoundSurf implements reasonable technical and organizational measures designed to protect personal data, including, where appropriate:
- Authentication controls
- Access restrictions
- Encryption in transit
- Provider security controls
- Database access rules
- Monitoring and logging
- Backup and recovery procedures
- Account and permission management
No online service or storage system can guarantee absolute security.
Users are responsible for keeping their login credentials confidential and should notify SoundSurf if they suspect unauthorized use of their account.
10. Data Retention
Personal data is retained only for as long as reasonably necessary for the purposes described in this Privacy Policy.
Retention periods may include:
- Account information: for the duration of the account and for a limited period after closure where necessary
- Learning progress and platform activity: while the account remains active or until deletion, subject to legal and technical requirements
- Public content: until removed by the user, removed by SoundSurf or deleted following account closure
- Private messages: for as long as necessary to provide messaging, safety and moderation functionality
- Support communications: for the time necessary to resolve the request and maintain appropriate records
- Security logs: for a limited period based on security and fraud-prevention needs
- Payment and transaction records: for the period required by tax, accounting and financial laws
- Cookie consent records: for the period necessary to demonstrate consent choices
- Legal records: for as long as necessary to establish, exercise or defend legal claims
When data is no longer required, it will be deleted, anonymized or securely restricted unless continued retention is required by law.
Account deletion does not necessarily require the immediate deletion of information that must be retained for legal, accounting, security or dispute-resolution purposes.
11. User Rights
Subject to the conditions and limitations established by applicable law, users may have the right to:
- Access their personal data
- Obtain a copy of their personal data
- Correct inaccurate or incomplete information
- Request deletion of personal data
- Restrict processing
- Object to processing based on legitimate interests
- Request data portability
- Withdraw consent at any time
- Object to direct marketing
- Receive information about applicable international transfer safeguards
- Lodge a complaint with a competent supervisory authority
SoundSurf may request reasonable information to verify the identity of the person submitting the request.
Requests will be handled within the period required by applicable law, normally within one month. This period may be extended where legally permitted for complex or numerous requests.
The right to deletion is not absolute. SoundSurf may retain information where continued processing is required by law or necessary for security, legal claims or other permitted purposes.
Users located in Italy may lodge a complaint with the Garante per la protezione dei dati personali.
12. Account Deletion
Users may request deletion of their SoundSurf account by:
- Using an account deletion feature, where available
- Contacting soundsurfwebapp@gmail.com
Following a valid deletion request, SoundSurf will delete or anonymize personal data associated with the account unless retention is required or permitted by law.
Certain public content, records contained in other users’ communications, transaction records, security information or anonymized statistical data may remain where legally permitted or technically necessary.
13. Automated Decision-Making
SoundSurf does not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects concerning users.
Automated platform functions may calculate:
- XP
- Scores
- Rankings
- Badges
- Progress
- Achievements
- Eligibility for platform rewards
These gamification calculations are used to operate SoundSurf features and do not produce legal or similarly significant effects.
14. Children’s Privacy
SoundSurf is not intended to collect personal data from children who cannot lawfully provide the information or enter into the required agreement without authorization from a parent or legal guardian.
In Italy, children who are at least 14 years old may provide consent to the processing of personal data in relation to information society services where consent is the applicable legal basis.
Users below the applicable age must use SoundSurf only with the authorization or involvement of a parent or legal guardian where required by law.
Parents or legal guardians who believe that a child has provided personal data without the required authorization may contact soundsurfwebapp@gmail.com.
SoundSurf may restrict or delete an account where it reasonably believes that the account was created in violation of applicable age requirements.
15. Cookies
SoundSurf uses necessary cookies and similar technologies for:
- Authentication
- Security
- Session management
- Consent management
- Essential platform functions
Analytics, advertising and other non-essential cookies are used only where enabled and after obtaining consent where required.
Users may accept, reject or customize non-essential cookies through the Cookie Settings interface.
Further details are available in the SoundSurf Cookie Policy.
Open Cookie Policy16. Marketing Communications
SoundSurf may send essential service messages concerning:
- Accounts
- Security
- Payments
- Subscriptions
- Platform changes
- Support requests
- Important service notices
These messages are necessary to operate the service and may not always be optional.
Promotional emails or other direct marketing communications will be sent only where permitted by law.
Users may unsubscribe from promotional communications using the unsubscribe link included in the message or by contacting SoundSurf.
17. Third-Party Links and Services
SoundSurf may contain links to third-party websites, services or content.
SoundSurf is not responsible for the privacy practices of independent third parties. Users should review the privacy policies of those services before providing personal data.
18. Changes to This Privacy Policy
SoundSurf may update this Privacy Policy when:
- Platform features change
- New service providers are introduced
- Data processing activities change
- Legal or regulatory requirements change
- Security or operational practices are updated
The “Last Updated” date at the beginning of this Privacy Policy will show when the latest revision was made.
Where required by law, users will be informed of material changes through the platform, by email or through another appropriate communication method.
Where a new processing activity requires consent, SoundSurf will request that consent separately. Continued use of SoundSurf alone will not be treated as consent where explicit consent is legally required.
19. Contact
For privacy questions, requests or complaints, contact:
Via Vetralla, 9 — 00048 Nettuno (RM), Italy
soundsurfwebapp@gmail.com