Klaviero
Last updated: 3 August 2026
This Privacy Policy explains how La Lumière Consulting SRL processes personal data in connection with the Klaviero application and website (the "Service"). It is provided in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Belgian law.
The controller responsible for the processing of your personal data is:
La Lumière Consulting SRL
Avenue Louise 323, 1050 Ixelles, Belgium
Enterprise number (BCE/KBO): 0762.735.942
VAT number: BE 0762.735.942
Email: frederic@lalumiereconsulting.be
We have not appointed a Data Protection Officer, as our processing does not meet the criteria of Article 37(1) GDPR. You may contact us at the address above for any question relating to this Policy.
We process the following categories of personal data for the purposes and on the legal bases set out below.
| Category | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Email address | To create and administer your account and to send account and billing communications. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Username and, if provided, avatar image | To identify you within the Service and on leaderboards you take part in. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Password (stored only as a bcrypt hash) | To authenticate you. We do not have access to your password. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Google account identifier | To authenticate you where you choose to sign in with Google. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Gameplay data (scores, accuracy, streaks, experience points, pieces played, friend connections) | To provide practice tracking, progress, rankings and leaderboards. | Performance of a contract, Art. 6(1)(b). | For the duration of the account. |
| Payment and invoice data | To take payment and issue invoices. This data is processed by Stripe (see Section 4). | Performance of a contract, Art. 6(1)(b), and compliance with a legal obligation, Art. 6(1)(c). | 10 years, as required by Article 60 of the Belgian VAT Code. |
| IP address | To apply rate limiting to sign-in and registration and to maintain the security of the Service. | Legitimate interests, Art. 6(1)(f), namely network and information security. | Held in the server's memory for the length of the rate-limiting window, at most one hour, then discarded. Not written to the database and not part of any log we keep. |
| Visit-counting data (a random number generated in your browser, the pages of the Service you opened, the website that linked you to us, and, where you go on to create an account, the fact that this number and that account are the same person) | To count how many separate people visit the Service and how many of them go on to create an account and subscribe, so that we can tell whether the Service is reaching anyone. This is the only measurement that works whatever choice you make in the privacy notice, and it is the reason we can keep the tools in the next row optional. | Legitimate interests, Art. 6(1)(f), namely understanding whether our own service is being used. The storage of the number itself is exempt from consent under the conditions European data protection authorities set for first-party audience measurement, set out in our Cookie and Storage Policy. The number is used by us alone, is never disclosed to anyone else, produces counts and averages only, and is not used to build a profile or to track you across other websites. | 13 months. |
| Audience measurement data (pages viewed, approximate location derived from IP address, device and browser type, referring source, interactions with the page such as clicks, scrolling and mouse movement, and a recording of the page as it was rendered during your visit) | To understand how visitors use the Service, which pages are used and where people get stuck, so that we can improve it. | Consent, Art. 6(1)(a). This processing takes place only if you choose "Accept all" in the privacy notice, and you may withdraw that consent at any time. | 2 months in Google Analytics. In Microsoft Clarity, 30 days for session recordings, and up to 9 months for recordings we mark as favourites and for a random sample retained by Microsoft. |
With your consent, we use Google Analytics 4, loaded through Google Tag Manager, and Microsoft Clarity to understand how visitors use the Service. Both are configured for audience measurement only. We do not use them for advertising, we do not carry out profiling, and we do not sell personal data. You can decline or withdraw this consent at any time and the Service works the same either way. Google's advertising consent signals are set to denied at all times, including when you accept analytics, so the measurement data is not used to personalise advertising.
If you decline, or choose only essential storage, none of these scripts is added to the page. No request is made to Google or to Microsoft, so your IP address is not disclosed to either company for this purpose.
Microsoft Clarity records how a page was rendered and how you interacted with it, which can be replayed as a session recording. Clarity masks input fields and drop-down menus in every configuration, and we additionally mark every field that can hold personal data, such as email, username, password, nickname and friend search, so that its contents are never transmitted. Masked content is not uploaded. Where you accept, Microsoft also sets cookies on its own domains that it uses to recognise a browser across websites, including for advertising on Microsoft services. We do not receive or use that data, and it is not set if you refuse.
The Service uses storage that is strictly necessary to provide the functionality you request, such as a login session token and locally stored settings and progress. No consent is required for that storage under Article 5(3) of the ePrivacy Directive. It also stores one item, nk-vid, to count visits; that is not strictly necessary but is exempt from consent on the conditions European data protection authorities set for first-party audience measurement, which are listed in full in the Cookie and Storage Policy. The analytics tools described above additionally set cookies, which are neither necessary nor exempt and are therefore set only where you have given consent through the privacy notice. Details of every item, including how to change your choice, are set out in our Cookie and Storage Policy.
We disclose personal data to the following recipients:
Your account and gameplay data are stored on servers located within the European Union, and no transfer outside the EU takes place for that data. Where Stripe or Google process data in the United States for payment or authentication, such transfers are made under the European Commission's adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework, to which those recipients are certified, and under the European Commission's Standard Contractual Clauses as a further safeguard.
Where you consent to audience measurement, limited data may additionally be processed outside the European Union:
A copy of the relevant safeguards is available on request. If you do not consent to audience measurement, no data is transferred to Google or Microsoft for that purpose.
We retain personal data for as long as your account remains active. When your account is deleted, the associated personal data is erased or anonymised, except for invoice and accounting records, which we are required to retain for 10 years under Article 60 of the Belgian VAT Code.
Audience measurement data, where you have consented to it, is retained separately and on shorter periods: 2 months for event data in Google Analytics, and 30 days for session recordings in Microsoft Clarity, extended to a maximum of 9 months for recordings marked as favourites and for a random sample retained by Microsoft. The analytics cookies themselves expire on the periods set out in the Cookie and Storage Policy.
Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, and to receive it in a portable format. You may exercise the principal rights within the Service:
If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
The Service is not directed at young children. Our processing of account and gameplay data is based on the performance of our contract with you and on our legitimate interest in security, and is not based on consent. In Belgium the age at which a child may consent to information society services is 13; a child below that age should use the Service only with the involvement of a parent or guardian. Only a person aged 18 or over may enter into a paid plan. If you believe that a child has provided us with personal data without the involvement of a parent or guardian, please contact us and we will delete it.
We apply appropriate technical and organisational measures to protect personal data, including the hashing of passwords, encryption of connections in transit, session expiry and access controls. No method of storage or transmission is entirely secure. We will notify affected individuals and the competent supervisory authority of any personal data breach where required under Articles 33 and 34 GDPR.
We may update this Policy from time to time. The date at the top of this page indicates when it was last revised. Where a change materially affects your rights, we will inform you within the Service or by email.
Questions about this Policy may be sent to frederic@lalumiereconsulting.be.