Privacy Policy
Last updated: September 18, 2026
1. Operating Entity & Statutory Scope
N.C Scores (noobcompany.my) is owned and operated by Noob Company, based in Kuala Lumpur, Malaysia. We are committed to safeguarding the privacy of our visitors, musicians, arrangers, and registered members.
This Privacy Policy governs our data processing practices in strict alignment with the Personal Data Protection Act 2010 (Act 709) ("PDPA") of Malaysia, the Personal Data Protection (Amendment) Act 2024, the European Union's General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA / CPRA).
2. Data Minimization & What We Collect
We strictly adhere to the principle of data minimization. We only collect information strictly required to authenticate your account, fulfill sheet music transactions, and ensure platform security:
- Account Credentials: Email address, username / display name, and unique user identifier (UID) generated securely via Google Firebase Authentication. We never request or store phone numbers, physical home addresses, government identification numbers, or birthdates.
- Payment & Transaction Identifiers: Stripe checkout session IDs, purchase timestamps, currency, and VIP promotion states. (Note: We never process, handle, or store raw credit card numbers or CVV codes; all card data is processed exclusively by Stripe under PCI-DSS Level 1 compliance.)
- User Repertoire & Preferences: Favorited piano scores, community song requests, and transpositions.
- Technical Telemetry & Cookies: De-identified page interaction metrics through Google Analytics 4 (which is activated only after explicit cookie consent) and essential session cookies. We do not store static IP addresses or execute invasive browser fingerprinting.
3. Age Restrictions & Children's Privacy (COPPA & GDPR-K)
child_care Protection of Minors
N.C Scores is not directed to children under 13 years of age (or under 16 years of age in the European Economic Area / UK). We do not knowingly collect personal information from children under these age thresholds.
During account creation, users must confirm they meet the minimum statutory age requirement. If we discover that a child under the applicable age threshold has registered without verified parental consent, we will promptly delete the account and purge all associated records. Parents or guardians who believe their child has provided personal information may contact us immediately at privacy@noobcompany.my.
4. Third-Party Service Providers & Cross-Border Transfers
We partner exclusively with certified, industry-leading infrastructure providers. Data transfers are governed by data processing agreements ensuring compliance with Section 129 of the Malaysian PDPA and GDPR Chapter V:
5. Cookies & Tracking Technologies
We deploy cookies and local browser storage to sustain authentication, prevent session timeout, and honor your preferences. For a detailed breakdown of all active cookies and their retention lifespans, or to reset your cookie consent, review our dedicated Cookie Policy.
6. California Consumer Privacy Disclosures (CCPA / CPRA)
No Sale or Sharing of Personal Information: We do NOT sell your personal information, nor do we share your personal information with third parties for cross-context behavioral advertising.
Non-Discrimination: We will never discriminate against you (by denying services, charging different rates, or degrading sheet music quality) for exercising any of your statutory privacy rights.
Shine the Light: California residents may request once per year a notice describing the categories of personal customer information disclosed to third parties (if any) for direct marketing purposes. We make zero such disclosures.
7. Your Statutory Rights & Data Deletion (GDPR Art. 17 & PDPA)
You are empowered with comprehensive statutory rights concerning your personal data:
- Right of Access & Portability: Request an electronic copy of the data we hold on your profile.
- Right to Rectification: Edit or update your display name and preferences at any time in your profile.
- Right to Erasure / Deletion: Permanently erase your account, favorites, and activity records. You can execute this instantly in your profile or submit a request via our Data Deletion Request Page.
- Right to Withdraw Consent: Revoke consent for optional cookies or marketing at any time.
8. Security Safeguards & Breach Protocol
All network traffic is encrypted end-to-end via TLS 1.3 / HTTPS. Cloud databases enforce granular row-level security rules, restricting user data access strictly to authenticated account owners.
In alignment with the PDPA (Amendment) Act 2024 and GDPR Article 33, in the event of a verified data breach involving personal data that presents significant risk to users, we will notify the Malaysian Personal Data Protection Department (JPDP) and affected users within 72 hours of verification.
9. Contact Our Data Protection Officer
For privacy inquiries, rights requests, or regulatory communications, contact our Data Protection Officer:
Legal Entity: Noob Company (Operating N.C Scores)
Registered Office: Kuala Lumpur, Malaysia
Official Support: support@noobcompany.my
Privacy & DPO Inquiries: privacy@noobcompany.my
Data Deletion Portal: noobcompany.my/main/data-deletion.html