Effective Date: 28 September 2026
The registered business Sebastian Karika, operating under the brand name Twiddle Coding ("we", "us", or "our"), operates the Mindful Harmony web application (the "Service"). This Privacy Policy explains how we collect, use, store, and disclose personal data when you use our Service. It also explains your rights under applicable data protection legislation and how you can exercise those rights. We are based in Sweden and, where applicable, process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Swedish data protection legislation. If you use the Service from a jurisdiction where the GDPR does not apply, additional or different privacy laws may apply to you. In such cases, this Privacy Policy does not necessarily describe all rights or obligations that may apply under your local law.
For the processing of personal data for which we determine the purposes and means of processing, we are the data controller.
Data controller:
Sebastian Karika
Femte villagatan 5B
50454, Borås
Sweden
Email: [email protected]
For certain personal data that you submit to third-party services, such as Paddle when making a purchase, the third party may act as an independent data controller. This is explained further below.
We process your name or alias to identify and display you within the Service and, where you choose to share songs you create with the community, to identify you as the creator. You are not required to use your real name as your alias. You may choose an alias instead. We process your email address to:
We retain this information for as long as your account remains active, unless a longer retention period is required by law. When you delete your account, we will delete the associated personal data unless we have a legal obligation or another lawful basis to retain it. We maintain regular backups. Personal data contained in backups may remain for up to 30 days before the relevant backup is deleted or overwritten.
Depending on the specific processing activity, our legal basis is:
Where we rely on legitimate interests, our legitimate interest is to operate, maintain, secure, and improve the Service and to communicate with users about matters concerning their use of the Service.
You may choose to link social-media or music-platform accounts, such as Bandcamp, Spotify, or SoundCloud, to your Mindful Harmony account.
The purpose is to allow you to display links to your external music profiles to other members of the community when you choose to share your songs. Linking these accounts is optional and is not required to use the Service.
We retain these links for as long as they are associated with your account or until you remove them. When you delete your account, we will delete the associated information unless we have a legal obligation or another lawful basis to retain it. Personal data contained in backups may remain for up to 30 days before the relevant backup is deleted or overwritten.
The legal basis for processing this information is Article 6(1)(b) GDPR (performance of a contract) where processing is necessary to provide an optional feature of the Service that you have chosen to use.
If you subscribe to our newsletter, we process your name or alias and email address to send you marketing communications and, where applicable, personalise those communications using your name or alias. Subscribing to our newsletter is entirely optional and is not required to use the Service. You may choose whether or not to subscribe, and you may unsubscribe at any time.
We retain your name or alias and email address for newsletter purposes for as long as you remain subscribed to the newsletter. You may unsubscribe at any time by using the unsubscribe mechanism included in our marketing emails or by contacting us. If you unsubscribe or otherwise object to the processing of your personal data for direct marketing purposes, we will stop using your personal data for such direct marketing. We may retain limited information where necessary to record your unsubscribe request or objection and ensure that we do not send you further marketing communications.
The legal basis for processing your personal data for newsletter and direct marketing purposes is Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest is to communicate with users who have chosen to subscribe to our newsletter and to promote and inform users about our products, services, and related offerings. We consider this interest to be legitimate because newsletter subscriptions are voluntary and are initiated by the user, and because the processing is limited to the information necessary to provide the newsletter and related marketing communications. You have an absolute right to object to the processing of your personal data for direct marketing purposes at any time, including any profiling carried out in connection with such direct marketing. If you object, we will no longer process your personal data for these direct marketing purposes. Your subscription is not mandatory, and you may withdraw from the newsletter at any time without affecting your ability to use the Service or any other rights you have as a user.
We may ask you to voluntarily provide additional information, such as your level of experience with music theory. We may use this information to make marketing communications more relevant to your experience level.
We retain this information for as long as it is necessary for the purpose for which it was collected, unless a longer retention period is required by law. If you delete your account, we will delete or anonymise this information unless we have a legal obligation or another lawful basis to retain it. Personal data contained in backups may remain for up to 30 days before the relevant backup is deleted or overwritten.
Where this information is used to personalise marketing communications, the legal basis is Article 6(1)(f) GDPR (legitimate interests), as the purpose is to make communications that you have given consent to receive more valuable to you.
We use analytics to understand usage patterns and understand demand for the Service. We configure our analytics to minimize the amount of personal data collected. The analytics data is anonymised at the point of collection so that you can no longer be identified. At the point of collection, the analytics tool only uses information included in an ordinary http request, and we do not collect additional information from your terminal, nor do we set any cookies on your device.
Raw anonymized analytics data is retained for 1 day. Aggregated statistics may be retained for up to one year or longer. Because data has been anonymised, we cannot subsequently identify you from that data and therefore cannot provide access to or erase data that can no longer be linked to you.
The legal basis is Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest is to understand and maintain the Service, improve its reliability and functionality, and understand how the Service is used. We apply data minimisation measures and seek to avoid collecting information that is not necessary for these purposes.
With your consent, we use the Meta Pixel, a web measurement and advertising technology provided by Meta Platforms Ireland Limited ("Meta Ireland"). The Meta Pixel is used to measure interactions with our website and Service and to measure the effectiveness of our marketing and advertising activities on Meta's platforms. After you have given consent through our cookie banner, the Meta Pixel may send information to Meta when you interact with the website. Depending on the functionality you use, this may include events such as:
For purchase events, we may send information associated with the purchase, such as the purchase amount and currency, and other information necessary to describe or measure the purchase event. We do not currently use Meta Advanced Matching, and we do not intentionally send your name, email address, telephone number, or similar directly identifying information to Meta through Advanced Matching. The Meta Pixel may nevertheless collect or receive information associated with your visit or device, including:
Information collected through the Meta Pixel may be associated with identifiers that Meta can use to recognise a browser or device and may be combined with other information held by Meta. We do not control Meta's subsequent processing of information that it receives as an independent controller.
The legal basis for processing personal data through the Meta Pixel is Article 6(1)(a) GDPR (consent). The Meta Pixel is activated only after you have given consent to the relevant category of cookies and similar technologies through our cookie banner. Providing consent to the Meta Pixel is voluntary and is not necessary to use the Service. You may refuse consent without affecting your ability to use the Service. You may withdraw your consent at any time through the cookie settings available on our website. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
For the collection of personal data through the Meta Pixel and its transmission to Meta, we and Meta Platforms Ireland Limited may act as joint controllers to the extent required under applicable data protection law and Meta's applicable terms for its Business Tools. Our responsibility as joint controller concerns the collection and transmission of the relevant information through the Meta Pixel. Meta is responsible for its subsequent processing of information it receives, including processing for purposes determined by Meta. For information about how Meta processes personal data and how to exercise applicable rights in relation to processing carried out by Meta, please refer to Meta's Privacy Policy.
The Meta Pixel transmits information to Meta Platforms Ireland Limited, which is established in Ireland. Meta operates internationally, and personal data collected through the Meta Pixel may be processed by Meta entities or made accessible from countries outside the EU/EEA, including the United States. Where personal data is transferred outside the EU/EEA, the transfer will be made using an applicable mechanism under Chapter V GDPR. Meta Platforms, Inc. participates in the EU-U.S. Data Privacy Framework for covered personal data. Where applicable to a particular transfer, Meta may rely on the EU-U.S. Data Privacy Framework as an adequacy mechanism under Article 45 GDPR.
We do not independently retain a separate copy of the data collected by the Meta Pixel for the purposes described in this section. Once information has been transmitted to Meta, Meta may retain and process it in accordance with its own policies and retention practices. We do not determine the retention period for Meta's subsequent processing.
You may withdraw your consent to the Meta Pixel at any time through our cookie settings. You also have the rights described in Section 5 of this Privacy Policy. Where Meta processes personal data as an independent controller, you may also exercise applicable rights directly with Meta.
We use third-party service providers to operate the Service. These providers may process personal data on our behalf and are therefore data processors where they process personal data according to our instructions. We enter into appropriate Data Processing Agreements (DPAs) with our processors where required by Article 28 GDPR.
Peakford Ltd, through its PikaPods service, provides hosting infrastructure for the Service. Personal data described in this Privacy Policy is stored using this hosting infrastructure. We use EU-based servers for the storage of the Service's data. We have entered into a Data Processing Agreement with Peakford Ltd.
We use Amazon Web Services (AWS) to store backups of the Service's data. Personal data contained in these backups may include the categories described in sections 2.1, 2.2, and 2.4. We have entered into a Data Processing Agreement with AWS where required. We use AWS infrastructure in the EU/EEA for the relevant storage. The use of an EU AWS Region does not by itself mean that no access or transfer outside the EU/EEA can ever occur. AWS describes additional processing and transfer mechanisms in its own privacy and data protection documentation. AWS states that Amazon Web Services, Inc. participates in the EU-U.S. Data Privacy Framework and that AWS is covered by Amazon.com's certification. Where a transfer of personal data outside the EU/EEA occurs, we will rely on an applicable transfer mechanism under Chapter V GDPR, such as an adequacy decision or appropriate safeguards, where required.
We use the Meta Pixel, provided by Meta Platforms Ireland Limited, to collect PageView, interaction, and purchase-related events after the user has provided consent through our cookie banner. Depending on how the Service is used, events transmitted through the Meta Pixel may include page views, interactions with website elements, and purchase events. Purchase events may include information such as the purchase amount and currency. Meta Ireland is not treated solely as a data processor for this processing. To the extent required under applicable data protection law, we and Meta Ireland act as joint controllers in relation to the collection and transmission of information through the Meta Pixel. Meta may subsequently process the information as an independent controller for purposes determined by Meta. The categories of information that may be transmitted through the Meta Pixel are described in section 2.6 of this Privacy Policy. Meta may process personal data outside the EU/EEA, including in the United States. Applicable transfers are made using a lawful transfer mechanism under Chapter V GDPR.
We use Paddle as our Merchant of Record for purchases made through the Service. Paddle operates as the reseller of our software and digital products. When you purchase a product through Paddle, your purchase is made from Paddle rather than directly from us. Paddle states that it acts as Merchant of Record and processes buyer data for purposes including payment processing, order fulfilment, fraud prevention, and product support. Paddle may therefore act as an independent data controller for personal data it processes in connection with your purchase. For information about how Paddle processes personal data, please refer to Paddle's Privacy Policy. We may receive certain information from Paddle that is necessary to provide the Service, identify your purchase, provide customer support, or comply with our legal obligations. Where we are legally required to retain purchase or transaction information for accounting, tax, or other legal purposes, we process that information under Article 6(1)(c) GDPR (compliance with a legal obligation). We retain such information for the period required by applicable Swedish accounting and tax legislation. The applicable retention period may therefore be longer than the retention period for your user account.
Under the GDPR, you have several rights concerning your personal data. These rights apply depending on the circumstances and the legal basis for the relevant processing. You can exercise your rights by contacting us using the contact details in section 1.1. We will facilitate the exercise of your rights and will generally respond to your request within one month. In accordance with the GDPR, this period may be extended by up to two further months where necessary due to the complexity or number of requests. We will inform you if an extension is necessary. Requests concerning your GDPR rights are generally handled free of charge, although the GDPR provides limited exceptions for manifestly unfounded or excessive requests.
You have the right to receive clear and accessible information about how we process your personal data, including information about the purposes of processing, legal bases, retention periods, recipients, international transfers, and your rights.
You have the right to ask whether we process personal data concerning you and, where we do, to receive a copy of that personal data together with information about how it is processed.
You have the right to request that inaccurate personal data concerning you be corrected. You may also have the right to have incomplete personal data completed.
You have the right to request deletion of your personal data in certain circumstances, for example where the personal data is no longer necessary for the purposes for which it was collected. This right is not absolute. We may be required to retain certain information to comply with a legal obligation or for the establishment, exercise, or defence of legal claims.
You have the right to request restriction of the processing of your personal data in certain circumstances, for example where you contest the accuracy of the personal data or where you have objected to processing and we need to determine whether our legitimate grounds override your objection.
Where the processing is based on your consent or on a contract and is carried out by automated means, you may have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. Where technically feasible and where the legal requirements are met, you may also request that we transmit the data directly to another controller.
You have the right to object to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR, including processing based on legitimate interests. You have an absolute right to object to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing.
You have rights concerning decisions based solely on automated processing, including profiling, where such decisions produce legal effects or similarly significantly affect you. We currently do not use solely automated decision-making that produces legal or similarly significant effects on you.
Where we process your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You have the right to lodge a complaint with a competent supervisory authority if you believe that our processing of your personal data infringes the GDPR. In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You can find information about submitting a complaint on IMY's website.
We primarily use service providers and infrastructure located within the EU/EEA. However, some of our service providers may involve entities or subprocessors located outside the EU/EEA or may otherwise involve access to personal data from a third country. Where personal data is transferred outside the EU/EEA, we will ensure that the transfer is made in accordance with Chapter V GDPR, using an applicable mechanism such as:
Where applicable, we will also implement supplementary measures required by applicable data protection law.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, disclosure, or other unauthorised processing. The specific security measures depend on the nature of the processing and the risks involved.
We may update this Privacy Policy from time to time to reflect changes to the Service, our processing activities, applicable legislation, or other relevant circumstances. When we make material changes, we will provide appropriate notice where required by applicable law. The effective date shown at the beginning of this Privacy Policy indicates when the current version came into effect.
If you have questions about this Privacy Policy or wish to exercise your rights under the GDPR, please contact us:
Sebastian Karika / Twiddle Coding
Femte Villagatan 5B
504 54 Borås
Sweden
Email: [email protected]