PHI Privacy Notice

Last updated October 30, 2026 · Web version

Luis Enrique Amaya Vazquez, Mexico, operates PHI under the Legatto brand and is responsible for your personal data. Address: Calle 2, La Veleta, Tulum, Quintana Roo, Mexico, C.P. 77760. Privacy contact: info@legatto.space. This notice covers phi.legatto.space, its accounts and web features.

The essentials

We use data to provide access, synchronize what you choose to save, manage payments and protect the service. Not everything stays on your device: account information and certain settings are stored in the cloud. Microphone and MIDI access depend on permissions. You may request information, correction, deletion and other rights at the address above. You do not have to subscribe to advertising to use PHI.

1 Data we process

Account: email, identifier, authentication data and, if you choose Google sign-in, the profile data and permissions shown on that screen. Service: saved favorites, harmonies, themes, settings and location, trial and subscription status. Payments: customer and transaction identifiers, amount, currency, status and necessary billing data; Stripe handles payment data according to the integration. Support and security: messages, IP address, browser, device, access logs, errors and events necessary to protect the system.

2 Audio and permissions

Recordings downloaded to your computer remain under your control. Microphone use for tuning or ear training and MIDI connections require relevant permissions; you can withdraw them in your browser. PHI also synchronizes account data: a local file is different from a preference stored on servers. Exact processing of audio, MIDI notes and singing metrics: Microphone analysis, audio synthesis and MIDI interaction run in the browser; no audio or raw MIDI upload path was found in the reviewed implementation. Singing accuracy aggregates and recent training answers are synchronized as account preferences. The recorder captures audio from the source you select, which can include other applications; video tracks are stopped and audio files are stored in local IndexedDB (sphace.recorder). Looper clips use sphace.looper. They remain until you delete them or browser storage is cleared or evicted. Downloads remain under your control. We do not publish creations or use audio for AI training without separate authorization.

3 Purposes and legal grounds

Necessary purposes are account creation and authentication, trial and plan access, synchronization you request, billing, support, fraud prevention and legal compliance. Depending on jurisdiction, grounds are contract performance, legal obligations, consent for optional features or a proportionate, assessed legitimate security interest. Where consent is required, we request it. General acceptance does not justify every future purpose.

4 Optional choices

Promotions, newsletters, non-essential analytics and advertising require a separate choice where applicable. Refusal does not block contracted features that do not depend on that processing. You can withdraw consent or unsubscribe from marketing without cancelling your plan. Security, billing and essential service-change notices remain service communications.

5 Providers and recipients

Supabase provides authentication and account/service data storage; Stripe handles checkout, payments and billing; Google provides optional sign-in and fonts. Open-Meteo receives city-search text and language; BigDataCloud receives device coordinates rounded to four decimals and language when you request place lookup. Saved location synchronizes to your account. EarthGrid requests resources from unpkg and raw.githubusercontent.com. Direct requests disclose connection information to the corresponding provider. Hostinger’s precise role has not been verified, so we do not represent it as a confirmed recipient of PHI account data. Stripe and Google may also act as independent controllers under their own conditions.

International transfers

Providers may process information outside Mexico. PHI’s specific hosted regions, destination countries and contractual transfer safeguards have not yet been verified for this deployment. We therefore do not assert a particular region, adequacy decision or signed contractual mechanism. Request the current provider and transfer information at info@legatto.space. This notice is not blanket consent to transfers; any legally required safeguards and separate authorization must be established before the relevant processing.

Other disclosures

We may disclose information when legally required, to handle claims or to protect rights as necessary and proportionate. A reorganization or transfer of the service must maintain data protection obligations and communicate relevant changes. Our policy does not permit selling data or sharing it for behavioral advertising without required specific information and choice. School use requires an agreement on responsibilities and student data.

6 Cookies and storage

Necessary cookies or similar technologies may maintain sessions, preferences and security controls. Optional analytics or advertising technologies must not activate before consent where required; rejecting them must be as easy as accepting. Active inventory: Verified application storage: sphace.auth persists the authentication session; eligible sphace.* local preferences, including saved location and training progress, synchronize to Supabase. Authentication, recorder, looper and Light-mode data are excluded from this preference sync. Local files use IndexedDB sphace.recorder and sphace.looper. No timed expiration is implemented for these persistent local stores. Signing out does not clear device preferences or recordings. Instrument-opening activity (account ID, tool ID and time) is stored for administrator reporting. The production site uses Cloudflare Web Analytics for aggregate visits, page views and performance metrics, without analytics cookies or account identifiers supplied by PHI. It respects browser Do Not Track and Global Privacy Control signals and does not run on local or preview domains. Cloudflare processes the analytics requests; no advertising tracker is added. Provider session lifetimes remain pending verification. Permissions can be managed through PHI controls where available and in your browser; clearing storage may sign you out or delete local settings.

7 Retention

No scheduled cloud-data purge or verified fixed account, activity-log, support or backup deletion timetable has been established in the reviewed application. Account data remains stored until action is taken; the 30-day activity chart is not a retention limit. Request deletion or the applicable retention details at info@legatto.space. Deleting an authentication account cascades to its profile, preferences, roles and subscription row in the supplied schema, but activity and feedback records can remain, including feedback email/message, and Stripe records are separate. These records and backups require separate handling; we do not promise immediate erasure everywhere. Local recordings and clips remain until you delete them or clear browser storage; signing out does not delete them. Legal retention duties and rights remain applicable.

8 Security

We apply technical and organizational measures appropriate to risk, limit access and review providers. No service can guarantee zero risk. We investigate incidents and notify people and authorities when legally required. Privacy requests never require emailing your password, CVV or full card number.

9 Your rights and requests

Email info@legatto.space stating your request, account information and a reply channel. We request only reasonable information to verify identity or representation. In Mexico, you may exercise access, rectification, cancellation and objection rights (ARCO), limit use or disclosure and withdraw consent where applicable. We communicate our determination within the statutory 20-day period and, if granted, implement it within the following 15 days, subject to legally permitted justified extensions. We explain any legal limitation.

Other jurisdictions

Where applicable, you can request erasure, portability, restriction, objection and withdrawal of consent without affecting earlier lawful processing. Under the GDPR, we normally respond within one month, subject to legal exceptions and extensions. You may complain to your competent data protection authority; in Mexico, to the competent federal authority under current law. Ordinary rights requests are free where required. We do not use solely automated decisions with legal or similarly significant effects without required information and safeguards.

10 Children and schools

Ordinary account administration and purchasing are for adults. We do not enable independent accounts for children under 13 without a specific program including verified authorization and appropriate protection. Teacher supervision does not automatically replace legally required parental or guardian consent. If we discover children’s data processed without a valid basis, we restrict processing and investigate deletion or lawful regularization. Families and schools may contact our privacy address.

11 Changes and contact

The current notice and date are available here. Material changes requiring new information or consent must be communicated before the new processing. No follow-up email is sent before the trial ends; this does not remove mandatory legal notices or rights. Questions and privacy requests: info@legatto.space.

Provider policies

Supabase: supabase.com/privacy

Vercel: vercel.com/legal/privacy-notice

Hostinger: hostinger.com/legal/privacy-policy

Stripe: stripe.com/privacy

Google: policies.google.com/privacy

Their policies explain their services and do not replace PHI’s responsibilities for your information.