ConcertAmi privacy policy

Version: 21 October 2026.

Controller and contact

HolySound — Rafał Bielecki, Dąbrowskiego 1, 35-036 Rzeszów, Poland. Contact: info@holysound.pl. We control account, service and support data. Your organization determines the purposes of member data and content it shares; you may also contact its owner.

Data and purposes

We process your email, profile name, account identifier and authentication data, optional contact details and photo, memberships, roles, invitations, plans, messages and uploaded materials to provide the service. Access within an organization depends on permissions. Security records include IP address, device information and login history, with approximate city or country derived from IP where available. Push notifications use an account-linked device token. The camera is optional for profile photos; Face ID and device passcodes are handled by the operating system without sharing biometric data with ConcertAmi. Local-network access supports optional Playback Remote integration.

Legal grounds

Necessary account and service processing is based on performance of a contract (GDPR Article 6(1)(b)); security, abuse prevention and legal claims on legitimate interests (Article 6(1)(f)); mandatory records on legal obligations (Article 6(1)(c)). Where a separate feature relies on consent, you may withdraw it without affecting prior lawful processing. Device permissions can be changed in system settings. Required account details are necessary to use the service; additional profile details are optional.

Providers and retention

Optional Apple or Google sign-in provides a provider identifier, verified email and shared name; Google may also provide a photo. Apple can hide your real email. We never receive your Apple or Google password. Linking requires an authenticated ConcertAmi session. Apple tokens needed for revocation are encrypted on the server.

We use Microsoft Azure for hosting, database, private files and email delivery, Apple for sign-in and APNs notifications, and Google when you choose Google sign-in. Authorized service personnel and providers may process data in their respective roles. Global providers may process data outside the EEA, requiring Chapter V GDPR safeguards such as an applicable adequacy decision or standard contractual clauses. Contact us for information about safeguards. We do not sell data or track users across apps for advertising.

Account data is retained while the service is used, and afterwards only as necessary for legal duties, claims and secure deletion. Database backups have 14-day retention; deleted-file protection and organization archives may retain data for 35 days. Shared organization materials may remain after their author's account is deleted.

Deletion and rights

Open My profile → Delete account. Apple-linked users can confirm deletion with Apple without setting a password. Organization owners must transfer ownership or delete the organization first. Account access is revoked on deletion; Apple authorization revocation is retried if the provider is unavailable. You can also contact us about your data.

You may request access, correction, erasure, restriction and, where applicable, portability; object to legitimate-interest processing; and withdraw applicable consent. You may complain to the Polish data protection authority (President of UODO). We do not make decisions with legal effects solely through automated profiling.