Privacy Policy

This policy explains what information Nordbridge IT Solutions LLC (“Tonaleve”, “we”, “us”) processes when you use the tonaleve.app website, the my.tonaleve.app web application, and the Tonaleve apps (the “Service”).

1. The essentials, in 30 seconds

• Your sound profile never leaves your device. Your tone, level, session history, check-in logs, and sound program are stored locally, in your browser or in the app. They are never uploaded to our servers, we never see them, and we cannot hand them over to anyone.
• On our servers, we store the minimum needed to run your account: your email address, a profile name if you set one, the devices you’ve linked, and your subscription status.
• We never see your card data. It’s processed by Stripe.
• We do not sell or share your data with advertisers. There are no Meta, TikTok, or Google Ads pixels on the site, in the calibration flow, or at checkout.

2. Who is responsible

Nordbridge IT Solutions LLC, a company organized in the United States of America, operator of Tonaleve. Privacy inquiries: [email protected].

3. What data we collect

3.1 Account data

• Email address: your identifier and the channel through which you receive your access code, receipts, and subscription notices.
• Profile name: optional, used only to display within the app.

3.2 Access and security data

• One-time codes: stored in hashed form, along with their expiration and the number of attempts. They are invalidated once used.
• IP address and user agent of the code request, to detect and stop brute-force attempts and abusive use.
• Linked devices: a readable label (for example, “Chrome on macOS”), the date it was linked, and the date of its last contact with the server, so you can see and unlink your devices.

3.3 Subscription and billing data

• Plan purchased, status (trial, active, past due, canceled), trial end date, and period end date.
• Stripe customer and subscription identifiers. We do not store card numbers, expiration dates, or security codes: they never reach our systems.

3.4 Support data

If you file a support request or write to us, we store your email, the subject, what you tell us, and how it was resolved, so we can assist you and keep a record.

3.5 Technical data

Our infrastructure provider (Cloudflare) logs technical request data — IP address, user agent, date, and requested resource — to serve the site, protect it against attacks, and diagnose failures.

4. What we do NOT collect

This is just as important as the above:

• Your calibration profile (the tone in Hz and the level in dB SL), your measurement history, your session logs, your check-ins, and the sound program generated for you are stored exclusively on your device, in your browser’s or app’s local storage. They are never transmitted to our servers.
• We do not request or store diagnoses, medical history, medication, audiometric test results, or any data provided by a healthcare professional.
• We do not access the microphone or record audio.
• We do not collect precise location.
• We do not use device advertising identifiers (IDFA/AAID) or third-party tracking tools for marketing purposes. The only thing we measure about advertising is which of our ads brought a visitor to the site, using our own tool: see section 7.

If you clear your browser data, uninstall the app, or switch devices, that local content is lost and we cannot recover it, because we never had it. That’s why the app lets you export it.

5. How we use the data

We do not use your data for behavioral advertising, we do not build profiles for commercial purposes, and we do not use it to train artificial intelligence models.

6. Who we share it with

Only with providers we need to deliver the Service, and only what’s indispensable:

We may also disclose information if required by a competent authority, to enforce our rights, or as part of a merger or sale of the business (in which case we will notify you).

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under the California CCPA/CPRA and analogous laws in other states.

7. Cookies and local storage

• The tonaleve.app site does not use analytics cookies or third-party tracking pixels. The only cookie it sets is our own and serves a single purpose: if you arrived from one of our ads, it stores which ad you came from — the click identifier the platform appends to the URL and the campaign tags — so we can measure which ad is working and stop paying for the ones that aren’t. This is browsing information, not personal information: it does not carry your name, your email, your sound profile, or any of your content, it is never matched to your account, and it cannot identify you. We do not sell it, we do not share it, and we do not use it for any purpose other than measuring our own advertising. It expires automatically after 90 days, and you can delete it at any time by clearing your browser’s site data.
• The app uses your browser’s local storage to function: your session, your device identifier, and all of your profile content. This is technical data, indispensable for the Service, and it lives on your device.
• We measure usage of the site and the app with our own tool, without cookies. For each visit we record the screen, a few milestones along the way (for example, “started calibration”), the country, the device type, and where you came from. To count visitors we use a code derived from your connection that changes every day: it lets us know how many people visited today, and it cannot recognize you from one day to the next or identify you. We do not store your IP address in these statistics, and none of your sound profile, notes, or program is ever part of them. This information is not shared with third parties and is not used for advertising.

8. International transfers

Our infrastructure and our providers operate in the United States and on global networks. If you write to us from another country, your data will be processed in the United States, with the contractual safeguards those providers offer.

9. How long we keep it

• Account and subscription: for as long as the account is active, and afterward for the period required by accounting obligations and to defend against claims.
• Access codes: minutes; they are invalidated once used or upon expiration.
• Access logs and technical data: short periods, defined by the provider, for security purposes.
• Support requests: for as long as the matter is open, plus the applicable statute of limitations.
• Visit statistics: up to 400 days, already in the anonymous form described in section 7.

When you close your account, we delete or anonymize the data we no longer need.

10. Security

We encrypt data in transit (HTTPS), we don’t use passwords (access is via a one-time code, with a limit on attempts and a short expiration), we store codes in hashed form, we restrict internal access to what’s necessary, and we let you revoke devices from your account. No system is infallible: if an incident affecting your data were to occur, we will notify you as required by applicable law, including the FTC’s Health Breach Notification Rule when applicable.

11. Your rights

Regardless of where you live, you can ask us for:

• Access to the data we hold about you.
• Correction of inaccurate data.
• Deletion of your account and your data.
• Portability: a copy in a readable format.
• Withdrawal of consent when processing is based on it.

How to exercise these rights: write to us at [email protected] from your account’s email address. We respond within 45 days (extendable by another 45 days when the request is complex, with notice to you beforehand). We do not charge to exercise these rights, and we do not provide a lesser level of service or a worse price for doing so.

California residents: in addition to the above, you have the right to know the categories of personal information collected, their purposes, and the categories of third parties with which it is shared — all of that is set out in sections 3, 5, and 6 — to request its deletion, and not to be discriminated against for exercising your rights. We do not sell or share personal information, so there is no opt-out to activate.

Residents of Washington, Nevada, and other states with consumer health data laws: you have additional rights described in our Consumer Health Data Privacy Policy.

12. Minors

The Service is intended for people 18 years of age or older. We do not knowingly collect data from children under 13. If we discover that an account belongs to a minor, we deactivate it and delete the associated data. If you are a parent or guardian and believe a minor has given us data, write to us at [email protected].

13. Changes to this policy

If we update it, we change the “last revised” date in the header, and when the change is material, we notify you by email or within the app before it takes effect.

14. Contact

Nordbridge IT Solutions LLC — Tonaleve Privacy and exercising your rights: [email protected] Legal inquiries: [email protected]