Effective date: 7 January 2026
This Privacy Policy explains how Soundsteps ("we", "us") collects, uses, shares, and protects personal data when you use our website and application (together, the "Service").
Soundsteps is a service provided by Enholm Holding AS, a limited liability company registered in Norway.
Organisation number: NO-889265922
Privacy contact: privacy@soundsteps.eu
General contact: post@soundsteps.eu
This policy covers personal data that we handle when you:
Links to third-party services have their own privacy notices.
We collect data that we need to run and protect the Service:
We use cookies and similar technology to track website usage. This can include:
Details appear in section 7.
Soundsteps lets you store and manage content such as pieces, practice sessions, notes, uploads of sheet music images/PDFs, and recordings.
Important: You control this content. We store it and show it back to you as part of the Service. We do not use this content for our own purposes. We do not read it for profiling or marketing.
We only use it to:
If you ask support for help that requires access to specific content, we access only what the request requires.
We use a payment provider ("Padde", as configured by Soundsteps). We receive billing status and transaction references that we need to manage subscriptions, fraud prevention, and accounting. We do not store full card details.
You can withdraw consent at any time. Withdrawal affects future processing that depends on consent.
Soundsteps offers optional AI analysis features. We run AI analysis only with your consent. You start the analysis inside the Service.
When you start an analysis, we may send to the AI provider:
Provider: OpenAI (ChatGPT).
Purpose: return analysis results to you inside Soundsteps.
International transfers can occur if the provider processes data outside the EEA/UK. We use valid transfer mechanisms such as Standard Contractual Clauses and apply safeguards where needed.
We use vendors that support the Service:
Some providers act as processors under our instructions. Some providers can act as independent controllers for parts of their processing, in particular payment processing and fraud prevention. In those cases, the provider's own privacy notice also applies.
We share data when law requires it, or when we need it to protect users, the Service, or our rights.
If we restructure or sell assets, personal data can transfer as part of that transaction, subject to applicable law.
If personal data moves outside the EEA/UK, we use an approved transfer mechanism, such as:
Soundsteps uses:
Where consent is required for analytics/tracking cookies, we rely on consent and offer controls through the cookie settings on the website (if enabled).
We keep personal data only for as long as we need it for the purposes in this policy.
Typical retention:
Backups can retain deleted data for a limited time until rotation completes.
We use measures that match the risk, including:
You have rights under GDPR, subject to conditions:
Send requests to privacy@soundsteps.eu.
Norway: Datatilsynet.
Soundsteps does not target children under 13. If a child under 13 has provided personal data, contact privacy@soundsteps.eu and we will delete it.
We can update this policy. We publish the current version on our website and show the effective date. For material changes, we notify users in the Service or by email.
Privacy questions: privacy@soundsteps.eu
General questions: post@soundsteps.eu