Privacy policy

Who is responsible

The service is run personally by its publisher, on a non-professional basis. For any question about your data or to exercise your rights, use the feedback button of the app (available once signed in): it reaches the publisher.

Host: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. The data is hosted in France.

The data we process

• Your account: email address and password (stored only in an irreversibly hashed form), musician name, instruments, language.
• Your groups: name, image, members, and the invitations sent by email.
• Your content: songs, setlists, structures, lyrics, personal notes, and the files you upload (music sheets, recordings, group images).
• Sign in with Google, if you use it: the Google identifier of your account, and the email address, name and "verified address" flag Google sends us. No access to your Drive is requested to sign in.
• Google Drive, if you connect it: the link to your Google account (the access token is stored encrypted) and the links to the documents you choose. The content of your documents is not copied.
• Your AI key, if you save one: it is kept for the AI features and never shown again. When you run an analysis, the analyzed content (music sheet, recording) is sent to the AI provider you chose, under its own terms.
• The feedback you send with the feedback button: your message, an optional screenshot and technical information (page, console errors).
• Technical server logs (IP address, date, requests), needed for security and for the service to work.

Why we process it

We use no audience-measurement tool and no advertising, and we do not sell any data.

• To provide the service you asked for: managing your songs and setlists, sharing them with the members of your groups, inviting you to a group (performance of the contract).
• To keep the service secure and fix problems (legitimate interest).
• To send the emails tied to your account: confirmation, invitation, password reset, being added to a group.

Who can see your data

• The members of your groups see the group content (songs, setlists, instruments) and the member list. Your personal notes on a setlist are visible only to you.
• The technical providers that are strictly necessary: the host (OVH) and an email-sending service.
• Google, if you sign in with Google or connect Google Drive, and the AI provider you chose, if you use the AI features.

Cookies and browser storage

Setlistr uses no advertising or audience-measurement cookies. The app keeps in your browser storage only what it needs to work: your login session, your language and your active group. No consent banner is therefore needed.

How long we keep it

• Your account and content are kept as long as your account exists.
• When you delete your account, your personal data (including the linked Google identifier) and the files you uploaded are erased. No backup keeps this data.
• A deleted group is permanently erased after 30 days, with its content; the deletion can be cancelled during that time.
• Technical logs are kept for a limited time.

Your rights

You can at any time access your data, correct it (from your profile), delete it (you can delete your account from the app), ask for its portability, or object to a processing. For any request, use the feedback button of the app.

You can also lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Changes

This page may change; the date of the last update is at the top. For an important change, users are informed by email.