1Who we are
The controller of your personal data is:
REDROOM o.z.
Company ID (IČO): 51962322
Registered office: Jána Hollého 3513/111, 071 01 Michalovce, Slovak Republic
Registered in the Register of Civic Associations
Contact for data protection matters: info@flstudiomasterclass.eu
We have not appointed a Data Protection Officer — we do not meet the conditions under which one is required. Requests are handled directly by the controller at the address above.
2What we process and why
Course application
Data: name, e-mail address, Discord username, your DAW version and operating system, an optional note and the topics you are interested in, the chosen course variant and number of hours, price and any discount applied, payment status, IP address and browser information, and confirmation that you have read this policy.
Purpose: processing your application, entering into and performing the course contract, communicating about the course, and giving you access to the student portal.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). For the IP address and browser information, legitimate interest (Art. 6(1)(f)) — protecting the form against abuse and spam.
A copy of the submitted application, including the IP address, is delivered to our operational mailbox so that we can process it.
Payment
Data: amount, date, payment method, payment identifiers. For card payments, the card details are processed directly by the payment provider — we never see your card number.
Purpose: receiving payment and keeping accounting records.
Legal basis: performance of a contract and legal obligation (Art. 6(1)(b) and (c)) — accounting legislation.
Student account and portal
Data: e-mail, name, language, account status, your password stored only as a cryptographic hash (never in readable form), Discord username, the time zone detected from your browser, last login time, whether you have completed the onboarding guide, and whether and when you turned off lesson reminder e-mails.
Purpose: running the portal, giving you access to the course and recordings, booking one-on-one sessions, showing times in your own time zone, and sending lesson reminders.
You can turn off reminders for group lessons and for one-on-one sessions at any time — each on its own — using the link in the footer of the reminder, and turn them back on with the same link. We can also see in our administration that you have turned them off.
In “My account” you can add a profile: an artist name, a profile photo and links to your profiles on SoundCloud, Spotify and Instagram. We store the photo cropped to a square and without camera data (such as location) in our object storage (Hetzner, EU). We only check that a link has the right format; we never open it. The profile is optional and only you can see it; on a review you choose yourself what from it is published. You can change or delete the photo and links at any time, and they are deleted when your account is closed. When you change your password, we sign you out on your other devices and e-mail you about it; we keep the time of the change for at most 24 hours (for the three-changes-a-day limit).
When you book a one-on-one session, the lecturer whose slot you chose receives an e-mail with your name and the date, time and length of the session — they need to know who they are meeting and when. Your e-mail address is not passed on to them. Whether that e-mail reaches them is the lecturer's own setting; either way the booking appears in their schedule.
In their schedule a lecturer can see your name, your Discord name and your time zone, along with the topic you gave when booking — without those they could not reach you or know what to prepare for. They do not see your e-mail address, the price, or what you paid. They see only their own slots and the bookings on them, not other students.
The site administrator can see each lecturer's taught hours together with the students' names — we need this to settle up with our lecturers. Some lecturers are also administrators of the site; in that case they have an administrator's access, not only a lecturer's.
Legal basis: performance of a contract (Art. 6(1)(b)); the profile (artist name, photo, links) on your consent (Art. 6(1)(a)), which you give by filling it in and withdraw by deleting it.
Reporting a problem
Data: the text of your report, its language, the page you were on (and in the player the lesson and the recording), your browser, operating system and device type — prefilled from your browser and editable by you — and the technical string your browser identifies itself with. The report is linked to your account so we know whom it concerns.
Purpose: fixing faults on the site and in the portal. We read the reports; we do not reply to every one, and if we need more detail we will e-mail you.
Legal basis: legitimate interest (Art. 6(1)(f)) — keeping the service working.
When your account is erased the report is unlinked from you but not deleted — a player fault stays operationally useful to us afterwards. If you named yourself in the text of a report, we will redact that part on request.
Study activity
Data: which recordings you opened, how many times, how much of them you watched, how far you got and when you last watched, which lessons you marked as completed, your booked one-on-one sessions and your hours balance.
This data lets you resume where you left off and see your progress. It is also visible to our staff for an individual student — we use it for support and to assess how clear and effective the course is.
Legal basis: performance of a contract (portal functionality) and legitimate interest (Art. 6(1)(f)) for assessing course quality.
Contact form
Data: name, e-mail, message, language, IP address and browser information.
Purpose: replying to your message.
Legal basis: legitimate interest (Art. 6(1)(f)) — handling your enquiry; for the IP address, protecting the form against abuse.
Contest
Data: e-mail, artist name, optionally full name and Instagram, track title and the uploaded audio file, language, IP address and browser information, and your consent.
Purpose: entering you into the contest, judging it and announcing the results.
Legal basis: consent (Art. 6(1)(a)), or performance of a contract under the contest rules. You may withdraw consent at any time; withdrawal does not affect processing carried out beforehand.
Newsletter
Data: e-mail, language, the page you subscribed from, traffic source information (UTM parameters), the date and method of consent, IP address and browser information.
Purpose: sending news and offers.
Legal basis: consent (Art. 6(1)(a)). You can unsubscribe at any time.
Discount code for signing up: if you sign up through the offer window on the website, we e-mail you a single-use discount code bound to your e-mail. We keep the code together with your e-mail and the dates it was issued and expires, so that it can only be used for an order with that e-mail and each e-mail gets only one code per round of the offer. If the offer is for a first order only, we check whether you have already paid for something with us. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b)); the newsletter itself stays on consent. The form is protected by Cloudflare Turnstile. We count how often the window is shown and closed only in aggregate, without personal data.
Offers to existing customers
If you have taken a course with us, we may send you an offer for a related follow-up product. You can unsubscribe at any time using the link in the e-mail footer; we honour and record unsubscribes. The list of unsubscribed addresses (the e-mail, the date and where you unsubscribed) is visible only to the website's administrators — they need it so that nobody sends you such an offer by hand either.
Legal basis: legitimate interest (Art. 6(1)(f)) — direct marketing to our own customers.
Student discount
If you have paid for the full or basic FL Studio course and are signed in, the website automatically shows you a discounted price on some products. We determine this from your paid orders; nothing new is stored (legitimate interest).
Reviews
You can write us a review in the student portal, through a link from us or through an e-mail invitation. We process the rating, the text and the profile details you choose yourself when writing the review: how your name appears (artist name, first name and initial of the last name, or full name), a copy of your profile photo and one Spotify or SoundCloud link. We store the copy of the photo when you submit it, in our object storage (Hetzner, EU), so that a published review does not change together with your profile. After our check the review is published on the website. You can hide it at any time in My account, or ask for it to be deleted; when we delete it we also delete the photo copy.
Legal basis: consent (Art. 6(1)(a) GDPR), which you give by ticking the box when you submit; we keep the time and version of the consent.
Record of e-mails sent
For every e-mail the website sends you (confirmations, reminders, invitations) we keep a record: the address, the subject, the kind of e-mail, the time, whether it was sent and whether it was delivered (as reported by our e-mail provider, including an unsubscribe). We do not store the content. The record lets us check whether and when we sent you something, and only administrators can see it. We keep it for 24 months.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — being able to show and verify that e-mails were sent and to deal with non-delivery.
Mix & Master
If you order mixing or mastering of your tracks from us (the Mix & Master service):
Data: name and e-mail address, the chosen variant and number of tracks, price and any discount applied, payment status, your description if you write one, links to reference tracks, track titles, the audio files you upload to us (your material) and the files we deliver to you, your change requests and their attachments, a record of the job's progress (e.g. when you uploaded or downloaded a file or approved a track), your request to start the service before the withdrawal period ends (time and text version), confirmation that you have read this policy (time and version), the IP address of the order.
Purpose: concluding and performing the service contract, communication about the job, delivering the finished tracks, being able to show that you asked us to start the service.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR); we keep the record of your request to start the service to meet and demonstrate our obligations under consumer-protection law (Art. 6(1)(c) and (f)). For the IP address, legitimate interest — protecting the form from abuse.
Who sees it: only the controller and the website's administrators. Files are stored in our object storage (Hetzner, EU) — no new recipient. E-mails about the job go out through our website e-mail provider (Mailjet).
An order does not create an account. If you order while signed in, the job is linked to your account and appears under My jobs. Otherwise the job is reachable through a secret link we e-mail to you; only you can link it to your existing account — by signing in with the same e-mail address and confirming on the job page; we never link it automatically by e-mail.
Retention: the job's files (your material, delivered versions, attachments to change requests) are deleted 3 months after the job is closed or cancelled. The order follows the order rules in section 6: an unpaid one is deleted after 12 months together with the job and its files, a paid one is kept for the accounting period and then anonymised. The job record (description, change requests, progress) of a paid order is kept with it; we delete it on request at any time.
Demo feedback
If you send us your demo for free feedback:
Data: name, e-mail, the link to your track, your message if you write one, language, confirmation that you have read this policy (time and version), the request's status and our answer (text, who sent it and when). If you are signed in, the request is linked to your account. We store no IP address or browser data for this request.
Purpose: to listen to the track and send you feedback by e-mail; to keep the rule of one open request at a time and a pause between requests.
Legal basis: steps taken at your request (Art. 6(1)(b) GDPR).
Who sees it: only the controller and the site's administrators. We listen to the track through your link — we never download it to our server and never pass the link on. The answer is sent through the site's e-mail provider (Mailjet). The form is protected by Cloudflare Turnstile.
Discount code: the answer may include a single-use Mix & Master discount code bound to your e-mail; it is recorded like the website window's codes (section 2.7).
Retention: the request is deleted 12 months after it was answered or closed (an untouched one 12 months after it was sent); earlier on request at any time.
Translating messages on Discord
On our Discord server you can have a message translated between Slovak and English (right-click the message › Apps › Translate). Only the person who clicked sees the translation.
Data: the text of the message you have translated (it may contain a name or other details its author wrote). We store neither the text nor the translation and do not record who clicked — we keep only a monthly count of translations.
Purpose: translating a message at a server member's request, so Slovak- and English-speaking members understand each other.
Legal basis: legitimate interest (Art. 6(1)(f)) — understanding in a bilingual community; a translation is always started by the member.
Who processes it: the text is sent for translation to Anthropic (the Claude model, processed in the USA), which does not use API texts to train its models. If translation through Anthropic is unavailable, we use DeepL (Germany); on its free plan DeepL may keep the texts for a while and use them to improve its services.
3Where the data comes from
We collect all data directly from you — from forms, from your account and from your use of the portal. We do not buy databases and do not obtain data from third parties.
4Who we share data with
We do not sell your data. We share it only with service providers who process it for us and on our instructions:
| Recipient | What they process | Location |
|---|---|---|
| Contabo (VPS hosting) | server and database operation | Germany (EU) |
| Hetzner (object storage) | video recordings, materials, contest tracks, Mix & Master job files, profile photos, copies of profile photos on reviews | Germany (EU) |
| Mailjet (Sinch Mailjet SAS) | sending the website's e-mails (confirmations, payments, reminders and other notices) | EU |
| Hostinger (mailbox) | our mailbox and correspondence; backup sending of the website's e-mails | EU |
| Stripe | card payments | Ireland / USA |
| Cloudflare | bot protection for forms (Turnstile) | USA |
| Discord | community communication and live lessons | USA |
| Anthropic | translating Discord messages at your request (the Claude model) | USA |
| DeepL SE | fallback translation of Discord messages | Germany (EU) |
We may also share data with our accountant, and with legal or other professional advisers if we ever had to establish or defend a legal claim, and — to the extent required by law — with public authorities.
5Transfers outside the European Union
Stripe, Cloudflare, Discord and Anthropic may process data in the USA. These transfers are safeguarded by those companies' certification under the EU–US Data Privacy Framework, or by standard contractual clauses approved by the European Commission.
If you join our Discord server, your use of Discord is governed by Discord's own policy, where it acts as an independent controller.
6How long we keep data
| Data | Retention |
|---|---|
| Paid applications and payment records | 10 years, then anonymised; only the amount, date and course type remain |
| Unpaid or abandoned applications | 12 months |
| Student account and study activity | for as long as you have access to the course; we close the account on request at any time |
| Contact messages | 24 months |
| Contest entries including uploaded tracks | 12 months after the contest ends |
| Newsletter | until you unsubscribe; we keep the record of the unsubscribe so we can honour it |
| Discount codes from the website window and from demo-feedback answers | 6 months after they expire, then an unused code is deleted and a used one loses the e-mail |
| IP addresses and browser information | 12 months, then removed |
| Records of e-mails sent | 24 months |
| Mix & Master job files (your material, delivered versions, attachments) | 3 months after the job is closed or cancelled |
| Mix & Master orders | as applications: unpaid 12 months, paid for the accounting period, then anonymised |
| Demo feedback requests | 12 months after the answer or close, an untouched one 12 months after it was sent |
For paid applications, accounting legislation requires longer retention — we cannot delete such records sooner, but on request we remove the personal data in them and keep only what accounting requires.
8Website analytics
We measure traffic with Plausible Analytics, which we host on our own server. It uses no cookies, creates no visitor identifiers, does not store full IP addresses and cannot follow you across websites. We only obtain aggregate statistics — for example, how many people visited a course page and how many of them opened the application form.
9Third-party content on our pages
- Cloudflare Turnstile — verifies that you are not a bot when you submit a form, and processes your IP address in doing so.
- Stripe — when paying by card, the Stripe payment form is loaded and sets its own cookies needed to process the payment and prevent fraud.
- Spotify — the About us and Mix & Master pages contain an embedded Spotify player.
When the About us or Mix & Master page loads, your IP address and browser information are transmitted to Spotify, which may set its own cookies — even if you never start playback. This processing is governed by Spotify's own privacy policy. If you would rather avoid it, do not visit these pages, or block third-party content in your browser.
10Security
Passwords are stored only as a salted cryptographic hash — not even we can read your password. Login sessions are likewise stored only as hashes. All communication with the site is encrypted (HTTPS). Administration access is password-protected and limited to a small number of people. Course files and contest uploads live in private storage and are served only through temporary links.
11Automated decision-making
We do not use automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.
12Backups
We back up the database regularly so that your data is not lost in the event of a failure. Deleted data may persist in backups for some time, until older backups expire. Backups are used solely to recover from a failure; if a restore ever happens, we repeat any deletion you requested.
13Your rights
You have the right:
- of access — to confirmation of whether we process your data, and a copy of it,
- to rectification of inaccurate or incomplete data,
- to erasure („the right to be forgotten“),
- to restriction of processing,
- to data portability — to receive your data in a machine-readable format,
- to object to processing based on legitimate interest,
- to withdraw consent where processing is based on it (e.g. newsletter, contest); withdrawal does not affect the lawfulness of processing carried out beforehand.
How to exercise them: write to info@flstudiomasterclass.eu. We will respond within 30 days at the latest. To make sure we do not hand data to the wrong person, we handle requests from and to the e-mail address we hold for you; if you write from a different address, we may ask for additional verification.
If you request erasure in connection with a paid course, we remove the personal data and keep only the record required for accounting (amount, date, course type) — see section 6.
If you request erasure while your course is still running, you will lose access to it — the account is how the course is delivered. While we are still providing the course, your data remains necessary to perform that contract, so we will point this out first and leave the decision to you.
14Complaints
If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27, Slovakia
We would appreciate hearing from you first — most things we can sort out straight away.
15Changes to this policy
We may update this policy if the way we process data changes. The current version is always available on this page and carries its effective date.
Effective from: 18 October 2026
