Privacy Policy

This policy explains, in specific terms, what personal data Rechordly collects, why, who receives it, how long it is kept, and what you can require us to do about it. It is written to be checkable against how the product actually behaves rather than to cover every hypothetical.

Effective: 16 August 2026
Last updated: 16 August 2026
Version: 2.0

1Who we are and how to reach us

Rechordly is a melody-first reharmonization tool operated by Kushagra Srivastava, a sole proprietor (unincorporated) based in New Delhi, India, trading as Rechordly. Rechordly is not an incorporated company. There is no company standing between you and the person responsible: the operator named above is personally the data controller under the EU and UK General Data Protection Regulation, and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023. If that changes, this page will be updated and anyone with an account or a waitlist entry will be told by email before the change takes effect.

Throughout this policy, "we", "us" and "our" mean Kushagra Srivastavaoperating Rechordly, and "you" means the person the data is about.

Privacy contact: hello@mail.rechordly.com. This one address is our privacy contact point for every purpose in this policy: data subject requests under the GDPR, grievance redressal under the DPDP Act, and consumer rights requests under US state law. It reaches the operator directly, not a ticket queue.
Postal address: We do not publish a home address. A postal address for formal service of legal or regulatory notice is available on written request to the address above, and will be provided to any supervisory authority that asks.
Data protection officer: None appointed. We are not required to appoint one: we are not a public authority, we do not carry out large-scale monitoring, and we do not process special category data on any scale. The operator answers privacy questions personally.

2What this policy covers

This policy applies to the Rechordly website at rechordly.com, the Rechordly Studio application, the waitlist, and any email we send you. It applies wherever you are in the world.

It does not apply to third-party sites we link to, or to what a payment provider does with the details you give it directly on its own checkout page under its own policy. Those are covered in sections 10 and 18.

Our Terms of Service govern your use of the product itself. This policy is about data only.

3Summary

This summary is for orientation. The sections that follow are the operative text, and where they say more than this summary does, they govern.

Your music never reaches us. Melodies you draw or import, and every chord progression Rechordly generates from them, are computed entirely inside your browser. They are never uploaded, never stored on a server, and never used to train anything.
We collect very little. An email address if you join the waitlist or create an account, whatever you choose to tell us on the optional waitlist questions, which link brought you here, and technical data needed to keep the site up and secure.
We never sell or share your data for advertising. No ad networks, no data brokers, no cross-site tracking, no profiling.
You can get it all back, or have it deleted. One email to hello@mail.rechordly.com and we action it within 30 days, wherever you live and whichever law applies to you.
Every email has a working one-click unsubscribe. It takes effect immediately.

4What we collect and why

This is the complete list. If a category is not here, we do not collect it.

4.1 Data you give us directly

Waitlist email address: Required to join the waitlist. Used to send you a confirmation, to tell you when Rechordly opens, and to send you your founding-member code if you qualify for the pre-launch offer.
Optional waitlist answers: On the full waitlist form only, and every field is optional: which kind of musician you are, what you find hard about harmony, and what you would consider a fair price. We use these to decide what to build and how to price it. Leave them blank and you still join.
Account email and credentials: If you create an account for the Studio. Handled by our authentication provider, which stores the credentials. We hold your email address, your account role, and your access tier.
Payment and billing details: If you buy a paid plan, you provide these to our merchant of record on its own checkout page. We never receive, see, or store your card number, and we could not retrieve it if asked. We receive only your subscription status, plan, and renewal date.
Anything you email us: The content of your message, your email address, and whatever else you choose to include. Used only to answer you.

4.2 Data collected automatically

Acquisition attribution: The utm_source, utm_medium and utm_campaign parameters on the link you arrived through, plus the origin of the referring site (for example https://reddit.com). We deliberately record the origin only and never the full referring URL, because a full URL can carry someone else's search terms or identifiers in its query string. Captured once per browsing session and stored with your waitlist entry if you sign up, so we know which channels work.
Form placement: Which form on the site you submitted (the hero capture, the waitlist page, the final call to action). Distinct from the attribution above, and used for the same purpose.
IP address: Received by our hosting, security, authentication and rate-limiting providers as an unavoidable part of any internet request. We use it to enforce rate limits, block abuse, and diagnose errors. We do not log it against your waitlist or account record, and we do not use it to determine your location for any purpose beyond security.
Analytics events: Page paths you visit and eight specifically named product events, nothing else: waitlist_form_viewed waitlist_submit_attempted waitlist_signup_succeeded waitlist_signup_failed demo_played showcase_scrolled pricing_viewed faq_opened . Alongside these, our analytics provider records ordinary browser and device characteristics such as browser version, operating system, screen size and language. It does not receive your IP address, because analytics traffic is routed through our own server, which strips it before forwarding. See section 7.
Error reports: When something breaks, an automatic report of the error, the page it happened on, your browser and operating system version, and your IP address. Session recording and screen replay are switched off entirely: we never see your screen.
Bot signals: Two anti-abuse checks on the waitlist form: a hidden field a real person never fills, and how long you took between opening the form and submitting it. Neither is stored against your record; a trip produces an anonymous internal alert only.

4.3 Special category and sensitive data

We do not ask for, want, or knowingly collect any of the following, and you should not send them to us: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, data about your sex life or sexual orientation, precise geolocation, government identifiers, or financial account numbers.

5Your music, and why we never see it

Rechordly's harmonization engine is deterministic code that runs in your browser. Not a hosted model, not an API call, not a queue. There is no server endpoint that accepts a melody, because the feature does not need one.

Concretely, this means:

Notes you draw in the piano roll, MIDI files you import, the detected key, the generated chord progressions, and anything you export are never transmitted to us or to any third party.
Nothing you create is saved anywhere by us. Closing the tab loses your work, which is a real limitation and the direct consequence of not uploading it. Export to MIDI to keep it.
No part of your musical work is used to train a machine learning model, by us or by anyone else. The engine contains no machine learning at all, so there is nothing to train.

The only way your music reaches us is if you attach it to an email and send it. Then it is an email, covered by section 4.1.

6Our legal bases for using your data

Where the EU or UK GDPR applies, we must have a lawful basis for every use of your data. Here is ours, use by use.

Waitlist signup and confirmation email: Consent (Article 6(1)(a)). You give it by ticking the box on the waitlist form. You can withdraw it at any time by unsubscribing or emailing us, with no effect on anything we did before you withdrew it.
Founding-member offer and referral code: Consent, and performance of a contract at your request (Article 6(1)(a) and (b)). Assigning and emailing you the code is how the offer is delivered.
Creating and running your account: Performance of a contract (Article 6(1)(b)). We cannot give you an account without processing your email address.
Billing, subscriptions and access tiers: Performance of a contract (Article 6(1)(b)), and compliance with a legal obligation for tax and accounting records (Article 6(1)(c)).
Security, rate limiting, and abuse prevention: Legitimate interests (Article 6(1)(f)): keeping a public form from being used to send unsolicited email to other people, and keeping the service available. We have weighed this against your interests and consider it low impact, since the data involved is transient and never used to make decisions about you.
Error monitoring: Legitimate interests (Article 6(1)(f)): a product that silently breaks for some users and not others cannot be fixed without automatic reports.
Analytics: Consent (Article 6(1)(a)), given through the banner described in section 7. Nothing loads and nothing is stored until you accept, and you can withdraw at any time from the footer of any page. We do not fall back to legitimate interests if you decline: declining means no analytics, not analytics under a different justification.
Answering your email: Legitimate interests (Article 6(1)(f)), or performance of a contract if you are a customer.
Defending a legal claim: Legitimate interests (Article 6(1)(f)), or compliance with a legal obligation (Article 6(1)(c)) where a court or authority requires it.

You can object to any processing we base on legitimate interests, and ask us to explain the balancing exercise behind it. See section 15.

7Cookies and device storage

Some things are stored on your device. The list below covers all of them, including browser storage that is not technically a cookie, because the law that governs this is about storing information on your device rather than about the word "cookie".

Nothing optional is stored until you say yes. The first time you visit, we ask whether you accept analytics. Until you accept, our analytics does not load at all, sets nothing, and sends nothing. Declining is one click, exactly like accepting, and the site works identically either way. If your browser sends a Global Privacy Control or Do Not Track signal we treat that as a no and do not ask.

rechordly_consent: Strictly necessary · set by Rechordly (localStorage, not a cookie) · Until you clear your browser storage
Remembers whether you accepted or declined analytics, so we do not ask again on every page. It records your answer and the date, nothing else. Strictly necessary: without it we could not honour your choice.
__session, __client_uat and related Clerk cookies: Strictly necessary · set by Clerk · Session, up to 1 year for the sign-in state
Keeps you signed in and protects the session against forgery. Only set once you visit the sign-in page or the Studio.
rechordly_attribution: Optional · set by Rechordly (sessionStorage, not a cookie) · Cleared when you close the browser tab
Only set if you accept analytics. Remembers which link or campaign brought you to the site so a later waitlist signup can be attributed to it. Stores the referring site's origin only, never the full URL. If you decline, nothing is stored and we read the campaign parameters from the address bar at the moment you submit a form instead.
ph_* (distinct id and session state): Optional · set by PostHog · Up to 1 year
Only set if you accept analytics. Distinguishes one visitor from another across page views so we can count real visits and see where the waitlist form is abandoned. The identifier is randomly generated and is not linked to your name or email.
cf_* and Turnstile tokens: Strictly necessary · set by Cloudflare · Session to 30 days
Network security and the bot challenge on the sign-in page.

7.1 Changing your mind

Cookie preferences, in the site footer and at the foot of this page. This reopens the same choice at any time. Withdrawing is as easy as giving it, which is a legal requirement and not a courtesy. If you withdraw, we stop analytics immediately and discard the identifier.
Browser signals, honoured automatically. A Global Privacy Control or Do Not Track signal blocks analytics outright, with no banner and no action needed from you. We honour Global Privacy Control because several privacy laws recognise it as a binding opt-out.
Browser settings. Blocking cookies and site data for rechordly.com stops all storage. That includes the strictly necessary items, so sign-in will not work.
Ask us. Email hello@mail.rechordly.com and we will confirm analytics is suppressed for you.

We do not use advertising cookies, retargeting pixels, social media tracking pixels, fingerprinting, or session recording. There is no third-party advertising technology on this site of any kind, so there is no consent we could ask for on that front and none we do.

8How we use your data

Only for these purposes:

To run the waitlist and tell you when Rechordly opens.
To decide which founding-member spots are taken and deliver the code to the people who got one.
To create, authenticate and secure your account.
To unlock the features your plan includes, and to bill you for them.
To understand which pages, channels and demos work, and where people give up, so we build the right things.
To find and fix errors.
To prevent abuse, spam and fraud, and to keep the service up.
To answer you when you contact us.
To comply with law, and to establish or defend a legal claim if we have to.

If we ever want to use your data for a genuinely new purpose that is not compatible with the above, we will ask you first.

9What we never do

We do not sell your personal data. Not for money, and not for any other thing of value. We have never done so and have no plans to.
We do not share it for cross-context behavioural advertising in the sense US state privacy laws use those words, or for targeted advertising of any kind.
We do not rent, trade, or hand your data to data brokers.
We do not train machine learning models on your data or your music.
We do not use your data to make automated decisions about you that have legal or similarly significant effects.
We do not send marketing email to people who did not ask for it. Every email we send is either one you consented to or one about a service you are actively using.

11International transfers

We are based in India and every provider listed above is established in the United States. So if you are outside those countries, your data crosses a border. This is unavoidable for a service operated by one person for a global audience, and we would rather state it plainly than bury it.

Where the law requires a transfer safeguard, here is what we rely on:

From the EEA, UK and Switzerland:the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, or the Swiss equivalent), incorporated into each provider's data processing terms. Several of our US providers are additionally certified under the EU-US Data Privacy Framework and its UK and Swiss extensions. We have reviewed the practical risk and consider it low, given how little data is involved and that none of it is sensitive.
From India: the DPDP Act permits transfer to any country the Central Government has not restricted. None of the countries involved are currently restricted. If that changes, we will change providers or stop the transfer.
Other regions: we rely on your consent and on contractual protections with each provider, as permitted by the applicable local law.

You can ask us for details of the safeguard applying to a specific transfer at hello@mail.rechordly.com.

12How long we keep it

We keep each category only as long as the purpose behind it lasts. Specifically:

Waitlist record (email, your answers, attribution): Until you unsubscribe or ask us to delete it, and in any case no longer than 24 months after your last interaction with us.
Unsubscribe record: Kept after you unsubscribe, marked as opted out. This is deliberate: deleting the record entirely would let a later form submission recreate it and email you again, which is the exact opposite of what unsubscribing is for. Ask us to erase it fully and we will.
Account record (email, role, access tier): For as long as your account exists, then deleted within 30 days of account deletion, allowing for backup rotation.
Subscription and payment records: Up to 8 years, where Indian tax and accounting law requires us to keep records of a transaction. Our merchant of record keeps its own copy under its own policy.
Analytics events: No more than 12 months.
Error reports: 90 days, our error monitoring provider's retention period.
Rate limiting counters: Seconds. They expire with the rate limit window that created them.
Emails you send us: Up to 24 months after the conversation ends, or longer if we need it to defend a legal claim.

After a retention period ends, data is deleted or irreversibly anonymised. A deletion request under section 15 overrides these periods, except where we are legally required to keep something (a tax record, for instance) or need it to defend an active legal claim. If that applies to any part of your request we will tell you exactly which part and why.

13How we protect it

Security claims are easy to make and hard to verify, so here are the concrete measures rather than adjectives:

Everything is served over HTTPS only, with HTTP Strict Transport Security enforced.
The database has row level security enabled on every table with no access policies at all, so it refuses every request that does not come from our server. Your browser never talks to the database directly.
Database credentials are server-only and cannot be imported into code that runs in a browser. This is enforced at build time, not by convention.
Incoming webhooks from our authentication and payment providers are cryptographically signature-verified before their contents are trusted.
Every public API route is rate limited, and the one public write path also carries bot detection.
We never store card numbers. Payment card data is handled entirely by our merchant of record, which maintains PCI DSS compliance for it.
Security response headers and a content security policy restrict what can execute or be loaded on the site.
Access to production systems is limited to the operator, protected by strong unique credentials and multi-factor authentication where the provider supports it.

No system is perfectly secure, and we will not pretend otherwise. We hold no security certification such as ISO 27001 or SOC 2, and we do not claim one.

14If something goes wrong

If a personal data breach occurs, we will investigate immediately, contain it, and notify:

Affected people, by email, without undue delay, describing what happened, what data was involved, what we have done, and what you should do.
The relevant supervisory authorities, within the deadlines their law sets. That is 72 hours for a lead EU or UK supervisory authority where the breach is likely to result in a risk to people's rights, and within the timelines the Data Protection Board of India and India's national computer emergency response team require for an Indian data fiduciary.

If you believe you have found a security vulnerability in Rechordly, please email hello@mail.rechordly.comrather than disclosing it publicly. We will acknowledge it, and we will not pursue anyone who reports a genuine issue in good faith without exploiting it or accessing other people's data.

15Your rights and how to use them

The rights you have depend on where you live, and the region-specific sections below spell out the legal detail. In practice we do not want to run a two-tier service, so we honour all of the following for everyone, wherever you are, unless doing so would break another law:

Access: Ask what personal data we hold about you and get a copy of it, along with the information in this policy applied to your specific record.
Correction: Have anything inaccurate or incomplete fixed.
Deletion: Have your data erased. For a waitlist entry this is immediate and complete. For an account it removes your account record and subscription record, subject to tax records we must legally retain.
Portability: Receive the data you gave us in a structured, machine-readable format, or have us send it to another provider where that is technically feasible.
Withdraw consent: Withdraw consent at any time for anything we do on that basis. For waitlist email, unsubscribe or email us. For analytics, use the Cookie preferences control in the site footer or at the foot of that page. Withdrawal is prospective: it does not undo processing that was lawful when it happened.
Object and restrict: Object to processing we base on legitimate interests, or ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
Opt out of marketing: One click, from any email we send. It takes effect immediately, and we keep a suppression record precisely so that a later form submission cannot quietly resubscribe you.
No retaliation: Using any of these rights never degrades your service, your price, or your place on the waitlist.
Complain: Complain to us, and separately to your data protection authority. See section 24.

15.1 How to make a request

Email hello@mail.rechordly.com from the address you gave us, and say what you want. There is no form to fill in and no account required. Please state which right you are using so we do not have to guess.

Verification. We will normally treat a request sent from the email address on the record as verified, because that address is the only identifier we hold. If we have real doubt, we may email that address to confirm. We will not demand identity documents, and you should not send us any.
Timing. Within 30 days. If a request is genuinely complex we may extend once and will tell you why before the original deadline passes.
Cost. Free. We reserve the right to charge a reasonable fee only for a manifestly excessive or repetitive request, and we will tell you before charging anything.
Authorised agents. Someone may act for you if you give them written permission we can verify, or they hold a power of attorney. We may still contact you directly to confirm.
If we refuse. We will tell you which part we refused, the legal reason, and how to challenge it, including your right to complain to a regulator or seek a judicial remedy.

16Children

Rechordly's waitlist, accounts and paid plans are for people aged 18 and over. Do not join the waitlist, create an account, or buy a plan if you are under 18.

We set the bar at 18 rather than 13 or 16 on purpose. Indian law, which applies to us as an Indian operator, treats everyone under 18 as a child, requires verifiable parental consent before processing a child's data, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. We have no reliable way to verify parental consent at our size, so the honest answer is to not collect children's data at all rather than to build a mechanism we cannot stand behind.

Because the Studio's harmonization engine runs entirely in the browser and collects nothing, a younger musician can use the tool under a parent or teacher's supervision without any personal data reaching us. What they must not do is create an account or join the waitlist.

We do not knowingly collect personal data from anyone under 18, and we never knowingly direct advertising at children. If you believe a child has given us data, email hello@mail.rechordly.com and we will delete it promptly and confirm that we have.

17Automated decisions and profiling

We do not make decisions about you by automated means that have legal or similarly significant effects on you, and we do not build behavioural profiles.

Two things are automated but are not decisions about you as a person, and we mention them for completeness. First, the founding-member offer is allocated automatically in order of signup, which decides whether you get a discount code but is based on nothing about you except when you signed up. Second, the harmonization engine is fully automated, but it operates on musical notes rather than personal data and produces chords rather than conclusions about you.

18Links to other sites

Rechordly links out to places like X, GitHub and YouTube. Once you follow a link, that site's own privacy policy applies and this one does not. We do not embed social media tracking widgets, so simply loading a Rechordly page does not report your visit to any of those services.

19Additional information: EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, this section adds to the rest of the policy.

Controller: Kushagra Srivastava, New Delhi, India. Contact: hello@mail.rechordly.com.
Legal bases: Set out use by use in section 6.
Your rights: Articles 15 to 22 give you access, rectification, erasure, restriction, portability, and objection, plus the right to withdraw consent under Article 7(3). All of these are described in section 15 and available to you.
Transfers: Standard Contractual Clauses, the UK International Data Transfer Addendum, or the Data Privacy Framework, as set out in section 11. A copy of the relevant clauses is available on request.
Is providing data mandatory?: No. Nothing on the waitlist form is required except an email address, and joining the waitlist is itself entirely optional. If you do not give us an email address we cannot put you on the waitlist or give you an account, and that is the only consequence.
Article 27 representative: We have not appointed one. Article 27(2)(a) exempts processing that is occasional, does not involve special category data on a large scale, and is unlikely to result in a risk to individuals. Our processing is a single email address plus a handful of optional answers, from a pre-launch waitlist, with no tracking of behaviour across other sites. We have reached that conclusion in good faith, we keep it under review, and we will appoint a representative in the EU and the UK if the volume or the nature of what we process stops fitting that exemption. In the meantime the operator answers directly at the address above and will respond to any supervisory authority without a representative in between.
Complaints: You can lodge a complaint with the supervisory authority in your country of residence, work, or where the issue arose. In the UK that is the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. A list of EEA authorities is published by the European Data Protection Board. You may also go to court. We would appreciate the chance to fix it first, but that is your choice, not a precondition.

20Additional information: India

We are an Indian operator, so the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 apply to us. Parts of that framework are being phased in, with the main obligations on notice, consent and rights taking full effect in May 2027. We are not waiting for the deadline: the commitments below apply now.

Data Fiduciary: Kushagra Srivastava, New Delhi, India.
Grievance redressal: hello@mail.rechordly.com, marked "DPDP grievance". The operator handles grievances personally and will respond within 30 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India. Please raise it with us first: the Act expects you to exhaust the grievance route before approaching the Board.
Notice and purpose: Sections 4 and 8 are the itemised notice the Act requires: what personal data, for which specified purpose. We process on the basis of your consent, or of a legitimate use recognised by the Act where you have voluntarily given us data for an evident purpose, such as emailing us a question.
Withdrawing consent: As easy as giving it. Unsubscribe from any email, or email us. When you withdraw, we stop processing and erase the data unless a law requires us to keep it, and we ask our providers to do the same.
Right to nominate: You can nominate another person to exercise your rights on your behalf in the event of your death or incapacity. Email us their name and contact details and we will record the nomination.
Children: We do not process the personal data of anyone under 18, do not track or behaviourally monitor children, and run no targeted advertising at all. See section 16.
Accuracy and your duties: The Act asks you not to impersonate anyone else, not to suppress material information when giving data, and not to file frivolous grievances. We mention it because the Act provides for penalties on data principals who do, not because we expect it of you.

21Additional information: United States

Rechordly is a pre-launch, one-person operation and almost certainly falls under the size and volume thresholds in every US state privacy law, meaning none of them currently obliges us to do anything. We are giving you these rights anyway, because we would rather be honest about our practices than rely on being too small to be regulated. Nothing in this section is an admission that a particular statute applies to us.

21.1 Notice at collection

Categories collected: Identifiers (email address, IP address, account identifier, randomly generated analytics identifier); commercial information (plan, subscription status, purchase history); internet or network activity (pages visited, the eight named product events, referring site origin, campaign parameters); and, for paying customers, billing information collected by our merchant of record rather than by us.
Sensitive personal information: None collected. We do not collect precise geolocation, government identifiers, racial or ethnic origin, religious beliefs, union membership, health, sex life or sexual orientation, genetic or biometric data, or the contents of your mail, email or messages.
Sources: From you directly; automatically from your browser; and from the service providers listed in section 10.
Purposes: As listed in section 8.
Sold or shared: None. We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and its equivalents. We have never done so, including in the preceding 12 months, and we do not sell or share the personal information of minors under 16.
Disclosed for a business purpose: Identifiers, commercial information and internet activity are disclosed to the service providers in section 10, each under a contract that limits them to our purposes.
Retention: Set out per category in section 12.

21.2 Your rights

Depending on your state, you may have the right to know, access, correct, delete, and obtain a portable copy of your personal information; to opt out of sale, sharing, targeted advertising and profiling; to limit the use of sensitive personal information; and not to be discriminated against for using any of these. We extend all of them to every US resident regardless of state.

How to exercise. Email hello@mail.rechordly.com. Same process, verification and 30-day window as section 15.
Opt-out signals.We honour the Global Privacy Control automatically. There is no "Do Not Sell or Share My Personal Information" link because there is nothing to opt out of: we do not sell or share.
Appeals. If we deny your request, reply to our decision and say you are appealing. We will reconsider and respond within 45 days with a written explanation. If we deny the appeal we will tell you how to contact your state attorney general.
Notice of financial incentive. Our founding-member offer gives the first 50 waitlist signups a discount on Pro in exchange for providing an email address. That is a price difference connected to the collection of personal data, so here are its material terms: you join the waitlist, and if you are among the first 50 you receive a code for the advertised discount, which you may redeem when checkout opens. You may withdraw at any time by unsubscribing or asking us to delete your record, which forfeits the code. We estimate the value of the data to us as no more than the value of the discount itself, since the only thing we obtain is one email address, whose worth to us is the paid acquisition cost we avoid by not having to reach you again. The offer is reasonably related to that value, and we consider it fair because you can walk away from it at any time at no cost.
Shine the Light. California Civil Code section 1798.83 lets you ask which personal information we shared with third parties for their own direct marketing. The answer is none, in any year.

22Additional information: other regions

Canada: Under PIPEDA and equivalent provincial laws you may access and correct your personal information and withdraw consent, all of which section 15 provides. Our commercial email complies with Canada's anti-spam legislation: we send only with your express consent, we identify ourselves, and every message carries a working unsubscribe that we action immediately. You may complain to the Office of the Privacy Commissioner of Canada.
Brazil: Under the LGPD you have rights of confirmation, access, correction, anonymisation or deletion, portability, information about who we share with, and the right to revoke consent. Section 15 covers all of them. You may complain to the ANPD.
Australia and New Zealand: We handle personal information consistently with the Australian Privacy Principles and the New Zealand Privacy Act. You may access and correct your information and complain to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.
Japan and South Korea: You may request disclosure, correction, suspension of use, or deletion of your personal information, and withdraw consent, as described in section 15.
Everywhere else: Whatever your local law provides, and at minimum everything in section 15. If your jurisdiction gives you a right not listed here, email us and we will honour it.

23Changes to this policy

We will update this policy when our practices change. When we do, we change the version number and both dates at the top, so you can always see which text you are reading.

If a change materially affects you, for example a new purpose, a new category of data, or a new recipient, we will email everyone on the waitlist and every account holder before it takes effect, and give you the chance to object, withdraw consent, or delete your data first. Where the change requires fresh consent under the law that applies to you, we will ask for it rather than assume it. We will not apply a material change retroactively to data we already hold without telling you.

24Questions and complaints

Email hello@mail.rechordly.com, or just reply to any email we have sent you. A real person, the one who wrote the code, reads it.

If you are unhappy with how we have handled a privacy matter, tell us and we will try to put it right. You do not have to go through us first: you can complain directly to your data protection authority, the Data Protection Board of India, or your state attorney general, and you can seek a remedy in court. Section 19 lists the relevant authorities by region.