1. Data Controller

The Data Controller for the personal data collected through the PulsePilot Live application (the "App") is:

Luca Saccinto
ID: SCCLCU97T30F205U
Grassobbio - Bergamo, Italy

To exercise the rights described in Section 7, or for any question about this Policy, you can write to: luca.saccinto@hotmail.it

2. What data we collect

PulsePilot Live collects only the data necessary to provide the service. Specifically:

• Email address

When it’s collected: it is collected when creating an account
Where it’s stored: it is stored in our database provided by the third-part Supabase

• Click Tracks, Sections, Metronome Presets, Setlists, Backing Tracks

When it’s collected: it is collected when created or imported by the user
Where it’s stored: it is stored Locally on the device only for the Free plan, and it is stored in the cloud from the Pro plan up in our database provided by the third-part Supabase

• Voice Prompts

When it’s collected: it is collected when recorded by the user
Where it’s stored: it is stored Locally on the device only for the Free plan, and it is stored in the cloud from the Pro plan up in our database provided by the third-part Supabase

• Subscription Plan

When it’s collected: it is collected when a subscription is purchased
Where it’s stored: it is managed via App Store / Google Play and server-side verification systems

3. Why we use this data (purposes and legal bases)

• Purpose: Creating and managing the user account
  Legal Basis GDPR: Performance of a contract (Art. 6.1.b)

• Purpose: Providing the App's features (metronome, click tracks, Stage Mode)
  Legal Basis GDPR: Performance of a contract (Art. 6.1.b)

• Purpose: Managing the subscription and payments via the app stores
  Legal Basis GDPR: Performance of a contract (Art. 6.1.b)

• Purpose: Syncing content to the cloud (paid plans)
  Legal Basis GDPR: Performance of a contract (Art. 6.1.b)

• Purpose: Sending marketing emails
  Legal Basis GDPR: Freely given, specific consent (Art. 6.1.a)

• Purpose: Preventing abuse and fraud, ensuring service security
  Legal Basis GDPR: Controller's legitimate interest (Art. 6.1.f)

• Purpose: Complying with tax and legal obligations
  Legal Basis GDPR: Legal obligation (Art. 6.1.c)

User-generated content — click tracks, notes, recorded voice prompts — is never used by PulsePilot Live for purposes other than providing the service itself (e.g. it is not analyzed, resold, or shared with third parties for commercial purposes).

4. Marketing Communications

If the user gives specific consent — separate and independent from acceptance of this Policy — PulsePilot Live may send promotional emails about new features, subscription offers, and product updates.

• Marketing consent is always distinct from acceptance of the Terms of Service and this Privacy Policy: the user can use the App even without giving it.

• Consent can be withdrawn at any time, without affecting continued use of the App, via the unsubscribe link included in every email or from the account settings.

• Refusing or withdrawing marketing consent does not limit access to the App or to any paid plan.

5. Who we share data with

Personal data is never sold to third parties. It may be shared, to the extent necessary to provide the service, with providers acting as data processors on behalf of the Controller, including, for example:

• Authentication and cloud database provider Supabase (for login and click track synchronization on paid plans).
  Supabase: Supabase | The Postgres Development Platform

• Apple Inc. and Google LLC, as operators of in-app purchases and subscriptions made through the App Store and Google Play (PulsePilot Live does not receive or store payment card data).
  Google: Privacy e termini – Google
  Apple: Apple - Legal

• Cross-store subscription management platform RevenueCat, to verify and manage active plans.
  RevenueCat: Privacy Policy | RevenueCat

• The provider used to send transactional emails Resend.
  Resend: Acceptable Use Policy · Resend

6. International data transfer

If any third-party provider listed in Section 5 is based, or processes data, outside the European Economic Area (e.g. the United States), the transfer takes place on the basis of adequate safeguards under the GDPR (e.g. the European Commission's Standard Contractual Clauses, or any applicable adequacy decision).

7. User Rights

As a data subject, under the conditions set out in the GDPR, you have the right to:

• Access your personal data and obtain a copy of it.

• Request correction of inaccurate or incomplete data.

• Request deletion of your data ("right to be forgotten"), including deletion of your account and associated content.

• Request restriction of processing in certain cases.

• Obtain portability of your data in a structured, commonly used format.

• Object to processing based on legitimate interest.

• Withdraw, at any time, a consent previously given (e.g. marketing), without affecting the lawfulness of processing carried out before the withdrawal.

• Lodge a complaint with the competent data protection authority (in Italy, the Garante per la Protezione dei Dati Personali, www.garanteprivacy.it), or with the supervisory authority of your country of residence.

Requests can be sent to luca.saccinto@hotmail.it.

8. Data Retention

• Account data (email, profile data): kept for as long as the account remains active, and deleted or anonymized within a reasonable time after a deletion request or account closure.

• Click tracks, setlists and voice files synced to the cloud: kept for as long as the account remains on a plan with cloud sync; in case of a downgrade to Free, content exceeding the free plan's limits remains archived but is no longer synced or playable, unless later deleted by the user.

• Billing/tax data related to subscriptions: kept for the periods required by applicable tax regulations.

9. Data security

PulsePilot Live adopts reasonable technical and organizational measures to protect data against unauthorized access, loss, or disclosure, including encryption of communications (HTTPS/TLS) and restricted access to data by authorized personnel only.

10. Technical identifiers and analytics tools

PulsePilot Live is a native application and does not use cookies in the traditional sense (a technology typical of websites). If the App integrates usage-analytics or crash-reporting tools, they are disclosed below, together with their purpose and any identifiers collected (e.g. device identifier, operating system version):

• None

11. Changes to this Policy

This Policy may be updated over time, for example following new App features or regulatory changes. Material changes will be communicated to users via an in-app notice or email, with the "last updated" date shown at the top of the document.

For any question regarding these Policy, you can contact the Controller at: luca.saccinto@hotmail.it