Privacy
We only process personal data as far as the course needs it, under the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
Controller
Isaac Knapp, Karl Wiser Straße 6, 4020 Linz, Austria, email: [email protected].
What data we process and why
- Visiting the website: every page request involves technically necessary data (IP address, time, requested address, browser identifier) to deliver the page, detect abuse and fix errors. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR).
- Your account: email address, display name, password (stored only as an encrypted hash), language and learning settings, the courses you bought with order number and date, and your progress (which videos and songs you finished). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- Sign-in and devices: for each sign-in we store the session with IP address and browser identifier. Every account has two device slots; for each device we keep a random device ID (cookie, see below), a label such as “iPad · Safari” and the date. Sign-in attempts are counted for a short time to stop password guessing. Legal basis: performance of the contract and legitimate interest in account security and in protecting the content (Art. 6(1)(b) and (f) GDPR).
- Watermarks: to protect the content, your display name and order number are shown in videos and printed into downloaded sheet music. Legal basis: legitimate interest in preventing the content from being passed on (Art. 6(1)(f) GDPR).
- Emails: we only send what your account needs (a link to set or reset your password) and answer your questions. No marketing emails.
- Payment: lildizzy is in a test phase and doesn’t take online payments yet. Once it does, we’ll name the payment provider here and what data it receives.
Recipients and processors
- Server: the website and all data are on a server in Austria that is run technically on our behalf.
- Cloudflare: access to the website goes through the network of Cloudflare, Inc. (USA), which secures the connection and blocks attacks. Cloudflare processes technical data such as your IP address. The transfer to the USA is based on the EU-US Data Privacy Framework (adequacy decision) and Cloudflare’s standard contractual clauses.
- Sending emails: system emails go through an email provider acting as our processor; we’ll name it here once sending is set up.
We don’t sell data or pass it on for advertising. Fonts, images and videos come from our own server; nothing is loaded from Google, Facebook or similar services.
Cookies and local storage
We use no analytics or advertising cookies. We only store what the website needs to work (§ 165(3) Austrian Telecommunications Act 2021, no consent required):
- dizzy.session_token (and, with several accounts on one device, further “dizzy.session_token_multi-…”): keeps you signed in, for up to 90 days or until you sign out.
- dizzy_device: a random device ID for your account’s two device slots, 1 year. It contains nothing about you and isn’t used for tracking.
- dizzy_locale: the language you pick on the home page, 1 year. Only set when you switch the language yourself.
- dizzy-consent (the browser’s local storage): your choice in the cookie notice, so we don’t ask on every visit. Change it with “Cookie settings” in the footer.
- Offline page: if you install lildizzy as an app, the browser keeps a small offline notice and the app icon. Videos and sheet music are never stored.
Should we add optional services later (e.g. audience measurement), we’ll only load them after you agree in the cookie notice, and we’ll update this policy.
How long we keep data
- Account data and progress: as long as your account exists and your access runs.
- Order data: 7 years from the end of the calendar year, as tax law requires (§ 132 BAO).
- Sessions: until you sign out, at most 90 days; sign-in attempt counters: a few minutes.
- Technical access data: at most 30 days, unless needed to investigate an attack.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Write to [email protected]. If you think we process your data wrongly, you can complain to the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).