Privacy policy

This notice is a solid template but does not replace legal review — section 4 (international data transfer) in particular still needs confirmation before the site processes real users' data.

2. What we collect and why

When you just browse (no account): our hosting provider's server automatically logs technical data for every request (IP address, browser/device info, date/time, requested page) for a short period, to operate and secure the site (legitimate interest, Art. 6(1)(f) GDPR).

Cookies: a session cookie (keeps you logged in) and a language cookie (remembers DE/EN). Both are technically necessary — no tracking, advertising, or analytics cookies are used, and no cookie banner is shown because none of these require consent under German law (§ 25(2) TTDSG).

When you register: name, email, password (stored as a one-way hash, never in plain text), role (singer/conductor), and any optional details you add — city, phone, bio, voice type, composer tags, audio links, social links, profile photo. Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR), since this data is what makes the service work.

Listings and messages: the content of any listing you post and any message you send is stored so the service can function (Art. 6(1)(b)). Messages are visible only to sender and recipient.

Referrals: your unique referral code and, if you signed up through someone else's link, a reference to who referred you.

Optional emails: if enabled in your profile, we email you about matching listings or new messages (Art. 6(1)(a) — consent, since you can turn each off independently at any time in your profile).

Profile visits: we log that your profile was viewed (and by whom, if logged in) purely as an internal usage metric for the site operator — this is never shown to you or to anyone else in the interface, including through the badge system, which only ever reveals that a milestone was crossed (e.g. "100+"), never the exact figure.

Reports and blocks: if you report a listing or block another user, we store that action (and your stated reason, for reports) to keep the community safe (Art. 6(1)(f), legitimate interest in trust and safety).

3. Who we share data with

We do not sell your data. It may be processed by:

- Our hosting/database provider, to run the site.
- Our transactional email provider (currently Resend, api.resend.com, or none in local/console mode — see EMAIL_BACKEND in the project's configuration), solely to deliver verification, password-reset, match, and message-notification emails.
- Other users, but only what you choose to make public on your profile or in a listing; your email/phone are shown only to someone you're already in contact with through a listing you or they posted.

4. International data transfer

Because this site is operated from Brazil while primarily serving people in Germany, Austria and Switzerland, personal data may be transferred between these countries. [TO REVIEW WITH A LAWYER] — the specific safeguard used (e.g. EU Standard Contractual Clauses, or reliance on an adequacy mechanism) depends on the final hosting/email-provider setup and should be confirmed and documented here before the site accepts real users' data.

5. How long we keep data

Account data is kept while your account is active. If you delete your account, it is deactivated immediately (hidden from everyone) and fully erased after 6 months, unless you log back in and reactivate it within that window. You can request full erasure sooner by contacting us (see Impressum). A downloadable export of your own data is available anytime at /profile/export (GDPR Art. 20).

6. Your rights

Under GDPR Art. 15–21, you have the right to: access the data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to certain processing; and receive your data in a portable format. To exercise any of these, contact us using the details in the Impressum. You also have the right to lodge a complaint with a data protection supervisory authority.

7. Security

Passwords are hashed with bcrypt (never stored or logged in plain text); the connection is protected in transit, and form submissions are protected against cross-site request forgery (CSRF).

8. Changes to this notice

We may update this page as the site's features change. Check back occasionally for the latest version.