Skip to content
nattaliepiano

Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains what personal data we collect on the website at nattaliepiano.com (the "Site") and through our Instagram account and Facebook Page @nattaliepiano, why we collect it, and what your rights are. We try to keep this brief and human-readable.

1. Who controls your data

Your personal data is controlled by Nataliia Kuzmina, a sole proprietor (ФОП) registered in Ukraine ("we", "us"). You can reach us about anything in this policy at [email protected].

2. What we collect, and why

We collect the minimum data needed to run the Site and serve you:

  • Contact form. When you write to us via the contact form, we receive your name, email, subject, and message. We use this only to reply.
  • Telegram channel. If you follow our Telegram channel, we don't collect anything ourselves — that's between you and Telegram.
  • Email list. If you ask for the free songbook, we add your address to our mailing list so we can send you the occasional letter about new sheet music. We also add you when you buy something (see below). Every letter carries a one-click unsubscribe, and you can leave at any time.
  • Purchases. When you make a purchase, Paddle.com Market Limited processes the payment on our behalf. Paddle collects your email, billing address, and payment details. We receive from Paddle: your email, the items you bought, and the amount paid (so we can deliver your purchase and answer questions). We never see your card number. Because you're now a customer, we also add your address to our email list to tell you about new sheet music — related to what you bought, never anything else. We tell you this at checkout, before you pay, and you can unsubscribe from the very first letter.
  • Instagram and Facebook comments. When you comment on a post or reel of @nattaliepiano on Instagram or Facebook, Meta sends us the comment's text, your username or name and user ID, and which post it is on. If the comment asks for sheet music, we send you one direct message (on Facebook, in Messenger) with the link to it and reply under your comment. We keep a log of these comments and our replies so we don't message you twice and can see which comments still need an answer. We don't use them for anything else and never add you to a mailing list.
  • Server logs. Cloudflare, our hosting and CDN provider, keeps short-term technical logs (IP address, browser type, requested URL) for security and to debug problems. These rotate out after a few weeks.
  • Analytics (optional). If we have Google Analytics enabled, it loads only after you accept analytics cookies on our consent banner. See our Cookie Notice.

3. Legal basis (GDPR)

If you're in the EU, the UK, or another jurisdiction that recognises a similar framework, the legal bases under which we process your data are:

  • Performance of a contract — for delivering purchases you've made.
  • Legitimate interest — for answering your Instagram or Facebook comment with the sheet music you asked for, for keeping the Site running and secure (server logs, fraud prevention), and for emailing existing customers about sheet music similar to what they bought. This is the "soft opt-in" permitted by UK PECR reg. 22(3) and the equivalent ePrivacy rules: we tell you at checkout, and every letter lets you leave in one click.
  • Consent — for optional analytics cookies, and for the email list when you sign up for the free songbook. You can withdraw either at any time.

4. Who else sees your data

  • Paddle — payment processing and tax handling. See Paddle's Privacy Policy.
  • Meta Platforms — Instagram and Facebook deliver your comments to us and our direct messages to you. See Meta's Privacy Policy.
  • Resend — delivers our emails and stores the mailing list. See Resend's Privacy Policy.
  • Cloudflare — hosts the Site and our Instagram and Facebook comment bot, stores the comment log, and keeps short-term technical logs (see above). See Cloudflare's Privacy Policy.
  • GitHub — runs our scheduled jobs, including a daily report that counts the Instagram and Facebook comments still waiting for an answer. See GitHub's Privacy Statement.
  • Google — if analytics is enabled, anonymised usage data flows to Google Analytics 4. See Google's Privacy Policy.

These providers process data on our instructions only. We do not sell your data, and we do not share it with anyone else for their own marketing.

5. How long we keep it

  • Contact-form messages: kept while we may need them to follow up; routinely purged after 24 months.
  • Mailing list: kept until you unsubscribe.
  • Purchase records: kept for the period required by Ukrainian tax law (usually 3 years), then deleted.
  • Instagram and Facebook comment log: deleted 14 days after the comment.
  • Server logs: rotated out by Cloudflare within weeks.
  • Analytics data (if enabled): retained per Google Analytics 4 defaults (currently 14 months).

6. Your rights

Where applicable law gives you these rights (e.g. under the GDPR), you can:

  • request a copy of the personal data we hold about you;
  • ask us to correct inaccurate data;
  • ask us to delete your data (subject to retention obligations);
  • object to processing or ask us to restrict it;
  • withdraw consent for any processing based on consent.

Email [email protected] with your request. We respond within 30 days.

Deleting your Instagram and Facebook data

To have us delete what we hold about your Instagram or Facebook comments, email [email protected] with your Instagram username or Facebook name. We delete the log entries and confirm by email. The log keeps a comment for 14 days at most anyway, and deleting your comment on Instagram or Facebook removes it there.

You also have the right to lodge a complaint with the supervisory authority in your country (in Ukraine, the Office of the Ombudsperson).

7. Children

The Site is not directed at children under 16. If you believe a child has given us personal data, please contact us so we can delete it.

8. International transfers

Some of our service providers (e.g. Paddle, Resend, Cloudflare, GitHub, Google) are based outside Ukraine and the EEA. Where data is transferred, we rely on those providers' standard contractual clauses and similar safeguards.

9. Changes to this policy

We may update this Policy. Material changes will be announced on the Site, and the "Last updated" date at the top will change.

10. Contact

[email protected].