Match Play: Practice Studio

1. Operator And Contact

Match Play is provided under the Acantivo brand. For privacy questions and requests, contact support_matchplay@acantivo.com.

Address: Nishi-Shinjuku Mizuma Building 2F, Nishi-Shinjuku 3-3-13, Shinjuku-ku, Tokyo 160-0023, Japan.

2. Information And Purposes

Depending on the features you use, we process:

• Account information: email, display name, username, account identifier, sign-in method and any supplied profile image, for registration, authentication, user search and sharing.
• Practice and sharing data: pieces, scores, recordings, videos, annotations, comments, to-dos, selected files, recipients and invitations, for storage, sync, playback and collaboration. Content may contain identifying information such as faces and voices.
• Search and support information: search terms, results and selections, support messages and contact details, for searches, improving results and responding to requests.
• Purchase information: account, product and transaction identifiers and subscription/purchase status, for access checks, purchase restoration and analysis, billing support and fraud prevention. We do not receive or store full payment card numbers or bank details.
• Device and usage information: IP addresses, device, browser and app details, identifiers, interactions, crash and security information, and messaging tokens, for service delivery, analytics, troubleshooting, notifications and security. Advertising is described in Section 4.
• Privacy records: consent, withdrawal, deletion requests and their handling, to respect your choices and prevent deleted data from being recreated.

Where applicable, our legal bases are performance of the service contract, legitimate interests such as security and reliability, legal obligations, or consent. We obtain consent before processing that requires it. Without necessary information or permissions, the corresponding feature may not work.

3. Sharing And Service Providers

Content is visible to the people you choose to share with, according to their permissions. User search uses display names, usernames and related identifiers, but does not display email addresses. Invitations may use email addresses. Authorized staff access information as needed to provide and support the service.

Our main providers and purposes are:

• Google Firebase and Google email services, Cloudflare: authentication, storage and delivery, notifications, security, analytics/diagnostics and support email delivery.
• RevenueCat, Apple App Store, Google Play and Paddle: purchases, subscriptions, access checks and purchase analytics. Mobile access checks also send free users' identifiers to RevenueCat.
• Google and Apple, Google Drive, Dropbox and OneDrive: your chosen sign-in method or importing files you select.
• IMSLP and score providers, YouTube: receiving search terms, returning results, previewing, importing or playing material. Opening external content sends connection information, such as your IP address, to its host.
• Google AdMob and AdSense: advertising, measurement and fraud prevention (Section 4).

YouTube features use YouTube API Services. We use and store result metadata, including video IDs, titles, channels, links, thumbnails, durations and search/selection records, for searching, displaying and improving results. Videos play on YouTube; we do not copy or rehost them. The YouTube Terms of Service and Google Privacy Policy apply. You can revoke connected-service access in that provider's settings.

4. Permissions, Cookies, Ads And Diagnostics

Preparing and making recordings uses the microphone and camera; importing uses the photos or files you select. Manage permissions in device or browser settings. A messaging token may be stored even if you deny notifications; turning off notification display does not itself delete the token.

The app and providers use cookies, device storage and identifiers for sign-in, settings, playback, security and advertising. Embedded YouTube playback and Google's security checks may also process cookies and device information. Manage these in device or browser settings; clearing storage may also remove unsynced edits and recordings.

The free plan displays Google ads. Even non-personalized ads involve device/advertising identifiers, approximate location derived from IP, interactions and diagnostics. Plus removes ads, but advertising services may still process technical information. We request required consent through advertising notices and provide choices through available ad-privacy controls or device settings. Google's processing follows the Google Privacy Policy.

Released and older app versions may send usage and crash information, including account identifiers, through Firebase Analytics and Crashlytics. Check analytics and diagnostics choices in the app. Stopping reports or deleting the app does not erase previously sent data.

5. Machine Learning

Model training is currently disabled. Existing consent may allow review copies of eligible annotations with identifying information reduced; creating these copies does not start training.

Before introducing new training use, including audio and video, we will explain the purpose, data, retention, recipients and withdrawal process and request separate, optional, affirmative consent. Training consent is not required for normal or paid features. Recording permissions and acceptance of the Terms are not training consent.

Withdraw through the app's Privacy settings or our contact address. Once received, withdrawal prevents new training use and we delete the relevant stored copies. Offline requests do not take effect until received. Deletion may take time.

6. Security And International Processing

We use measures such as protected communications, access restrictions and staff/provider oversight to protect personal information. Contact us for information about these safeguards.

Our main database and files are stored in the United States. Other providers may also process data outside Japan or your country, under different data-protection laws. Where required, we use appropriate transfer safeguards such as Standard Contractual Clauses. Contact us for details or copies of applicable transfer safeguards.

7. Retention And Deletion

We generally keep account information and content with your account until you delete it. Deleting a piece starts removal of its data and files. Request account deletion in Settings → Account & profile → Delete account, or by email; see the deletion guide.

Account deletion removes your account, owned pieces and files, sharing access, consent records and review copies under our control. Completion may take time. Account deletion does not cancel a subscription.

• Ordinary exports and review copies expire after 30 days; annotation change history after 90 days. Dated search logs and purchase-processing records expire after 30 days, ordinary operational logs after 30 days, and required audit logs after 400 days. Removal may be delayed by processing conditions; legacy records without a determinable expiry need separate review.
• Recovery copies of deleted primary files remain for seven days. Firebase's provider-side deletion period for authentication data is within 180 days after deletion starts; see Firebase's explanation.
• Contributions to pieces owned by others remain with those pieces. Invitation and recipient information may remain until the invitation, sharing relationship or related record is removed.
• Support, billing, dispute and legally required records may remain after account deletion. Minimal identifiers needed to prevent deleted data from being recreated have no fixed expiry.
• Providers' own records have separate retention periods. We cannot recall copies saved elsewhere; older browser caches may remain for up to seven days, and download links may work until revoked, expired or the file is deleted.

Contact us about retained contributions, correspondence or deletion of particular data.

8. Your Rights

Depending on applicable law, including Japan's APPI, the EU/UK GDPR and applicable US laws, you may request access, correction, deletion, restriction, objection, a copy of your data, and withdrawal of consent. Withdrawal does not affect earlier lawful processing.

Send requests to the contact in Section 1. We may verify your identity and respond within applicable legal deadlines. You may also complain to the data-protection authority where you live.

9. Children

Match Play is not directed to children under 13 or the minimum age in their country. Contact us if you believe a child has supplied information, so we can address its deletion. Minors need parental or guardian consent under the Terms.

10. Changes

We update the revision date when this policy changes and notify you of material changes through the app, website or other reasonable means. Processing that requires new consent starts only after that consent is obtained.