Privacy policy

1. Who we are

Choir Central is operated by Richard Keenan and Natasha May, trading in partnership as Choir Central. We are the controller of account, billing, support and service-usage data used to operate Choir Central. Contact us at support@choircentral.com.

A choir or its organiser may separately be the controller of member, event and other content entered into the service. In that case, we process that content on its instructions under our Data Processing Addendum.

2. Data we process

• Account details such as name, email address, profile image and authentication identifiers.
• Optional contact details, including telephone number and home address.
• Choir memberships, roles, voice parts, groups, invitations and join requests.
• Events, attendance responses, exclusions, notes, venues and calendar-feed tokens.
• Documents, music, recordings, links, programmes and other content uploaded or shared by users.
• Email preferences, support requests, feedback, optional feedback screenshots and related account, page, browser, device, display, network and diagnostic metadata.
• Subscription details, billing contact details, billing address and Stripe customer and subscription references. We do not receive or store full card details.
• Technical data such as IP address, browser details, request paths, security logs, errors and performance information.

We receive data from you, choir organisers, other members, Clerk, Stripe, your browser or device, and the services you choose to connect or embed.

3. Why we use data

• Contract: to create accounts, provide choir-management features, process subscriptions and support users.
• Legitimate interests: to secure, maintain, troubleshoot and improve the service, prevent misuse, manage operational messages and respond to feedback.
• Legal obligations: to keep tax and accounting records, respond to lawful requests and protect legal rights.
• Consent: where required, including when you permit browser location access. You may withdraw consent without affecting earlier processing.

We do not use personal data for solely automated decisions that have legal or similarly significant effects.

4. Choir content, sensitive data and children

Accounts are for people aged 18 or over. An organiser may manage data about members under 18 only where the organiser has appropriate authority and provides all required notices and safeguards.

Voice parts, attendance, choir membership, notes and files can reveal health, religious or other sensitive information. Organisers must only enter sensitive data where necessary, lawful and appropriately protected. Do not place detailed medical or safeguarding information in general notes or documents unless genuinely required.

5. Location data

Google Maps Platform provides venue search and maps. Search text, map interactions and, if you choose Near me, approximate device location may be sent to Google. We do not save the Near me search position to your profile. A selected venue or pin is saved with the event and may appear in calendar feeds. You can deny location permission and still use manual search.

6. Who receives data

We use the following providers where needed to run the service:

• Clerk for authentication and account sessions.
• Amazon Web Services for API hosting, databases, files, queues, backups and logs.
• Cloudflare for web hosting, network services and email routing.
• Stripe for Checkout, subscriptions, invoices and the billing portal.
• Resend for transactional email.
• Google Maps Platform for maps, venue search and place information.
• Sentry for error and performance monitoring.
• GitHub for private issue tracking when you submit in-app feedback.
• YouTube and Spotify when user-selected embedded media is loaded.

We may also disclose data to professional advisers, authorities or a buyer of the service where legally permitted. We do not sell personal data. Production personal data is not provided to AI model services.

7. International transfers

Our primary AWS region is London. Some providers operate internationally. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, as applicable.

8. Retention

We keep account and choir content while the relevant account or choir remains active and afterwards only as reasonably needed for deletion, disputes, security, backups and legal obligations. Billing and tax records may be kept for up to six years. Provider and security logs are kept for limited operational periods. Temporary email attachments are normally removed after 21 days, generated archive exports after seven days, and optional feedback screenshots after 30 days.

You can delete individual content using available controls or contact us to request account or organisation deletion. Some records may be retained where the law requires it or where another controller remains responsible for the content.

9. Security

We use access controls, encrypted transport, managed authentication, short-lived file links, encrypted cloud storage, backups and monitoring. No online service is completely secure. Keep credentials and calendar feed links private and tell us promptly about suspected misuse.

10. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your data, object to processing based on legitimate interests, or withdraw consent. Contact us at support@choircentral.com. We may need to verify your identity. If a choir controls the requested data, we may refer the request to that choir.

You may complain to the UK Information Commissioner’s Office at ico.org.uk. Please contact us first if you would like us to try to resolve the issue.

11. Cookies and changes

Our Cookie and storage policy explains browser storage and third-party embeds. We may update this policy when the service or law changes. Material changes will be highlighted in the service or otherwise communicated where appropriate.