Privacy Policy

Last updated: May 1, 2026

Who we are

Choralyx is a digital platform for choirs, accessible at www.choralyx.com. The personal data controller is Choralyx (hereinafter "we" or "the Controller"), reachable for any privacy matter at no-reply@choralyx.com. The Controller's full identifying details are provided on request by the data subject.

Data collected

We collect the following categories of personal data:

  • Registration data: name, email address, password (stored encrypted).
  • Choir data: choir name, city, description, logo, list of members.
  • Uploaded content: audio files, scores, notes and other materials shared on the platform.
  • Usage data: access logs, preferences, interactions with features (e.g. interest in events).
  • Technical data: IP address, browser type, operating system, collected automatically at login.

Purposes and legal basis of processing

Service provision

Data is processed to provide Choralyx features (uploading tracks, track separation, choir management, events). Legal basis: performance of the contract (art. 6 par. 1 lett. b GDPR).

Service communications

We send emails related to your account (notifications, feature updates). Legal basis: legitimate interest (art. 6 par. 1 lett. f GDPR).

Newsletter (optional)

If you subscribe to the newsletter, we use your email to update you on news. Legal basis: consent (art. 6 par. 1 lett. a GDPR). You can withdraw consent at any time.

Security and fraud prevention

Processing of technical data to ensure platform security. Legal basis: legitimate interest (art. 6 par. 1 lett. f GDPR).

Statistics and service improvement

With your consent, we use Google Analytics to collect aggregate statistics on the use of the platform and improve it. Legal basis: consent (art. 6 par. 1 lett. a GDPR), which can be withdrawn at any time via the "Cookie preferences" banner. More details in the Cookie Policy.

Retention period

Your account data is kept for the entire duration of the contractual relationship. After account deletion, the data is removed within 30 days, unless retention is required by applicable law (e.g. tax data kept for 10 years). Technical logs are kept for a maximum of 90 days.

Data recipients

Your data may be processed by providers acting as data processors on our behalf: hosting and infrastructure providers, the email delivery service and, subject to consent, Google (Google Analytics). We do not sell or share your data with third parties for marketing purposes.

Transfers outside the EU

Some providers (in particular Google, for analytics cookies activated with your consent) may process data in the United States. Such transfers are based on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission, with appropriate supplementary measures.

Your rights

As a data subject, you have the right to:

  • Access: obtain confirmation of processing and a copy of your data.
  • Rectification: correct inaccurate or incomplete data.
  • Deletion: request the removal of your data ("right to be forgotten").
  • Restriction: request the restriction of processing in certain cases.
  • Portability: receive your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interest.
  • Withdrawal of consent: withdraw at any time the consent you have given.

To exercise your rights, write to no-reply@choralyx.com. You also have the right to lodge a complaint with the competent supervisory authority (in Italy: the Italian Data Protection Authority).

Contact

For any question about the processing of your personal data, contact the Controller at: no-reply@choralyx.com.