Privacy Policy
Last updated: May 1, 2026
Who we are
Choralyx is a digital platform for choirs, accessible at www.choralyx.com. The personal data controller is Choralyx (hereinafter "we" or "the Controller"), reachable for any privacy matter at no-reply@choralyx.com. The Controller's full identifying details are provided on request by the data subject.
Data collected
We collect the following categories of personal data:
- Registration data: name, email address, password (stored encrypted).
- Choir data: choir name, city, description, logo, list of members.
- Uploaded content: audio files, scores, notes and other materials shared on the platform.
- Usage data: access logs, preferences, interactions with features (e.g. interest in events).
- Technical data: IP address, browser type, operating system, collected automatically at login.
Purposes and legal basis of processing
Service provision
Data is processed to provide Choralyx features (uploading tracks, track separation, choir management, events). Legal basis: performance of the contract (art. 6 par. 1 lett. b GDPR).
Service communications
We send emails related to your account (notifications, feature updates). Legal basis: legitimate interest (art. 6 par. 1 lett. f GDPR).
Newsletter (optional)
If you subscribe to the newsletter, we use your email to update you on news. Legal basis: consent (art. 6 par. 1 lett. a GDPR). You can withdraw consent at any time.
Security and fraud prevention
Processing of technical data to ensure platform security. Legal basis: legitimate interest (art. 6 par. 1 lett. f GDPR).
Statistics and service improvement
With your consent, we use Google Analytics only on public pages to collect aggregate statistics and improve them. We do not use it in the private app. This processing is based on your consent, which you can withdraw at any time via the "Cookie preferences" banner. More details in the Cookie Policy.
Advertising and marketing
Only on public pages and if you consent to the Marketing category, we use the Meta Pixel and Google Ads to measure and optimise our advertising campaigns (including retargeting and similar audiences). This involves sharing data with Meta and Google. This processing is based on your consent, which you can withdraw at any time.
Retention period
Your account data is kept for the entire duration of the contractual relationship. After account deletion, the data is removed within 30 days, unless retention is required by applicable law (e.g. tax data kept for 10 years). Technical logs are kept for a maximum of 90 days.
Data recipients
We share personal data only with providers that operate the service on our behalf (hosting, email, analytics) as data processors and — solely with your marketing consent — with Meta and Google as advertising partners. We never sell your data.
Transfers outside the EU
Some providers (Google and, with your marketing consent, Meta) may process data in the United States. These transfers are based on the EU-US Data Privacy Framework and the Standard Contractual Clauses approved by the European Commission.
Your rights
As a data subject, you have the right to:
- Access: obtain confirmation of processing and a copy of your data.
- Rectification: correct inaccurate or incomplete data.
- Deletion: request the removal of your data ("right to be forgotten").
- Restriction: request the restriction of processing in certain cases.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: withdraw at any time the consent you have given.
To exercise your rights, write to no-reply@choralyx.com. You also have the right to lodge a complaint with the competent supervisory authority (in Italy: the Italian Data Protection Authority).
Contact
For any question about the processing of your personal data, contact the Controller at: no-reply@choralyx.com.