Who is responsible. For the data of a choir's members (records, registrations, payments, messages), the choir is responsible; Choralix processes it on the choir's behalf, following its instructions (section 13). For accounts (email, name, password, sign-ins), Choralix's own billing and technical logs, Choralix is responsible.
What we collect for accounts: email, name, password (stored in an irreversible hashed form), language, sign-in data and, if turned on, the second factor. This data is used to identify you, secure your account and send you the service's emails. We sell no data and show no advertising.
Breached passwords. To refuse a password that has already leaked, we send the Pwned Passwords service the first 5 characters of its hash; neither the password nor the email is sent.
Where your data is. All data is hosted in Canada, except payment data processed by Stripe, which may be processed in the United States, and the notifications of the mobile apps, which go through Google and Apple, outside Canada.
Processors: OVHcloud (hosting, including our FreeScout support tool, Beauharnois, Quebec); Amazon Web Services (sending emails, and passing on bounces and complaints, Montreal); Stripe (payments, Canada and the United States; card data stays with Stripe); Google, Firebase Cloud Messaging, and Apple, Apple Push Notification service (notifications of the mobile apps: device token and notification text, without the content of messages or announcements; outside Canada). Choralix keeps the current list and provides it on request.
Approximate place of a sign-in. When you approve a sign-in from the app, Choralix shows an approximate place, estimated from the IP address with a database kept on its own servers: the IP address is passed on to no one. IP Geolocation by DB-IP (https://db-ip.com).
Retention. An account with no choir is deleted after 90 days. A choir's data is deleted as described in section 7; its financial records are kept for 6 years after deletion. A ticket buyer's name and email are kept for 6 years with the choir's financial records and serve only the emails about their purchase; after the choir is deleted, only what a financial record requires remains. The email signature described in section 6 is kept for as long as it serves the purposes of section 6. Backups are kept for 30 days, technical logs for 90 days and the log of access to personal data for 3 years.
Your rights. You can ask to access, correct, delete or port your data, and withdraw a consent. For data a choir holds about you, contact the choir first; we will help it answer you. A choir's internal notes about a member are not given to the member.
Security. Data is encrypted in transit and at rest; access to data is logged.
Cookies. Choralix uses only the cookies it needs to work, such as the one for your sign-in session; no advertising or third-party audience-measurement cookies.
Incidents. If a confidentiality incident affects its data, the choir is notified without undue delay.
Person in charge of the protection of personal information: the company has designated a person in charge of the protection of personal information, reachable at privacy@choralix.com.