Musalea
Sign in

Privacy policy

What Musalea processes about you, why, where and for how long, and the rights you have under the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD).

Who is responsible

The controller is Integrated Biopharma Strategy S.L., CIF B22479976, C/ Astondo Bidea 612, 48160 Derio (Bizkaia), Spain. Write to contact@inbistra.com about anything in this policy.

What stays on your computer

The Musalea app keeps your library, your practice history, your recordings and your settings on your own computer. The app does not send them to us. It also keeps its sign-in and its licence there, encrypted by the operating system. Removing the app leaves your library and history in place, so a new installation starts where you left off.

What we process

Your account

Your email address and a hash of your password (scrypt with a random salt); we never keep the password itself.

To stop anyone guessing passwords, each sign-in attempt is recorded under a SHA-256 hash of the email and of the IP address used, never the address itself; these records are deleted once they are a day old. After five wrong passwords, an email cannot sign in for 15 minutes.

Sign-in sessions

When you sign in, the website or the app receives a random session token in the pp_session cookie. We keep only a SHA-256 hash of the token, with your email and its expiry date. A session lasts 30 days; signing out deletes it at once.

Your licence and your computers

When the app signs in on a computer, it makes a key pair for that computer. The private key never leaves the computer. We keep the computer's public key, an identifier made from it, a label (“Windows” or “Mac”), when it was added and when it was last used.

For your account we keep your plan (trial, paid, complimentary or blocked), when your trial started, the date a paid plan runs until, and the time zone your computer first reports, so that trial days follow your local day.

While the app is open and signed in, it tells our server once a minute. During the trial we count those minutes per day (only the date and the number of minutes), to know which days count as practice days.

To apply the fair-use limits in the Terms of use, we count the preparations and Method downloads of each account and computer per day and per month. These counters are deleted after 62 days.

When you download the app from your account, we record your email, the platform, the version, the file and the time.

Scores you import and work the app asks us to prepare

When you import a score (MusicXML, MIDI or MuseScore), the app uploads the file to our preparation service, which converts it and makes its exercises. When you ask for exercises or a band backing for a piece, the app sends that piece as prepared (its score, notes and sections) or its chord chart. Changes and reading exercises send only their settings and, for reading, which Method passages to choose from.

For each of these jobs we store, linked to your email: the uploaded file and its name and size, the prepared result, the kind of job and its settings, its status and its times. Files are kept in our private storage under a hashed name, and only your account can fetch them. Each job runs in an isolated process without internet access.

The files of finished jobs are kept so that the app can make further exercises or backings from them; the files of failed or cancelled jobs are deleted.

Your language

If you choose a language with the language switch, the pp_lang cookie remembers it. See the Cookie policy.

Server logs

For every request, our server logs the time, the method, the path (never the query or anything you send), the response status, how long it took and a shortened SHA-256 hash of the IP address. We use them to keep the service working and secure.

Why, and on what legal basis

We do not sell your data, show advertising, build advertising profiles or use your scores or your playing to train any model.

Who processes it for us, and where

Railway Corporation hosts our website, our database, our preparation service and our private storage in its EU West region, in Amsterdam (the Netherlands). Railway processes the data only on our instructions.

Railway is based in the United States. Where data is accessed from outside the European Economic Area, that transfer relies on the safeguards of chapter V of the GDPR, such as the European Commission's standard contractual clauses.

We do not use analytics, advertising or social media services, and this website loads nothing from other websites.

How long we keep it

When you ask us to close your account, we delete its data, except what the law obliges us to keep.

Security

The website and the app talk to our server only over HTTPS. Passwords and session tokens are stored only as hashes, uploaded files only in private storage, and download links last five minutes.

Your rights

You can ask for access to your data, its correction or deletion, a copy of it to take elsewhere, the restriction of its processing, or object to it. Write to contact@inbistra.com from the email of your account; we answer within one month.

If you think we have not respected your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).

Changes to this policy

When we change this policy, we publish the new version here with its date.

Last updated: 6 November 2026.