We Are Voice - Privacy Policy

1. Controller and contact

We Are Voice AB (Org.nr 559089-7988) is the controller of personal data processed in the Service.

Address: Tärneskärsgatan 16, 421 57 Västra Frölunda, Sweden
Email: kontakt@wearevoice.se

We have not appointed a data protection officer. Contact us at the email address above with any question about your personal data.

2. Scope

This Privacy Policy describes how we collect and use personal data when you use We Are Voice, both the mobile app and the web app. It also applies to associated services we provide, such as support and account management. Your account is the same in the mobile app and the web app.

Our terms of use for the Service are described separately. This policy only covers how we handle personal data.

3. Personal data we collect

3.1 Data you provide

• Account and profile data: e.g. name, email address, phone number (optional, in the web app), whether you want to receive marketing emails, and other profile information you choose to provide.
• Group data: information you add when creating or managing a group (e.g. group name, description, group email, and optional group image).
• Group posts: posts, replies, images, videos and likes that you share in a group's feed.
• Support communications: messages and information you provide when contacting customer support.
• Reports: if you report a group post or reply, the report and any message you add to it.
• Billing details: when you buy a subscription in the web app, the billing name, address, phone number, email for invoices and any reference you add. If your organisation applies for a partner agreement, the organisation name, contact email, phone number and estimated number of members.

3.2 Data generated when you use the Service

• Group membership and activity: your memberships, invitations, requests to join, and actions within groups.
• Invites and deep links: if you open an invitation link or scan a QR code, we process the URL and invite code to connect you to the correct group.
• Usage and playback statistics: e.g. which content is accessed, session identifiers, play modes (audio/PDF/video/etc.), and time spent or playback positions. We use this data to understand usage, improve the Service, and troubleshoot issues.

3.3 Device and technical data

• Log and diagnostic data: timestamps, app version/build, crash reports and other technical logs needed for stability, security, and support.
• Device information: device model/brand, OS name/version, browser type, language settings, and similar technical information.

3.4 Data from third parties

• Authentication: if you sign in through a third-party identity provider, we receive identity-related information needed to create and manage your session.
• Push notifications (optional): if you enable push notifications, we process a device push token and a stable device identifier to register your device for notifications.
• Places search (optional): if you use the "place/location" field for groups, your input and the selected place may be processed by a places provider to return suggestions.

3.5 Permissions (device access)

• Camera (optional): used to scan QR codes for group invitations. We do not store photos from scanning.
• Photos/media library (optional): used if you choose a profile or group image from your library.
• Microphone: the app does not record or collect audio from your microphone.

4. Why we process your data (purposes & legal bases)

We process personal data only when we have a legal basis under applicable data protection law (including the GDPR). The table below describes typical purposes and legal bases.

Our legitimate interests

Where we rely on legitimate interests, our interests are to let choirs and other groups administer their members and work together, to answer and solve support requests, to handle reported content and keep groups safe, to keep the Service secure and stable, and to understand how the Service is used so that we can improve it. You can object to this processing (see Your rights).

Which data you must provide

You need to provide a name and an email address to create an account, because we cannot provide the Service without them. All other information, such as a profile image, group details, posts and device permissions, is optional. If you leave it out, some features may not be available to you.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

What other group members can see

• Group posts are visible only to members of the group. Group administrators can remove posts, and members can report posts and replies to us.
• Email addresses: group administrators can see the email addresses of the group's members. Members who have been approved can see the email address of the group's administrators. If you create a group, you become its administrator; you can hand the administrator role over to someone else.
• Your name and profile image are shown to other members of the groups you belong to.

5. Sharing and service providers

We do not sell your personal data.

We may share personal data with service providers that help us operate the Service (often referred to as "processors"). These providers process personal data on our behalf and under our instructions and agreements.

Categories of service providers

• Sign-in and authentication: an identity provider, to enable sign-in and session management.
• Hosting and storage: a cloud provider, to run our backend services and store data.
• Push notifications: a notification service, which delivers notifications through Google's and Apple's push services, if you have enabled notifications.
• Logging and error reporting: monitoring and crash reporting providers, to find errors and improve reliability.
• Customer support: a support tool provider, only if you contact our support.
• Places search: a places provider, only if you use the optional place field for groups.

Contact us if you want to know which providers we currently use.

Payments

Payments are handled in the web app by a third-party payment provider. When you make a payment, your payment details (such as card information) are processed by that payment provider. We receive limited information needed to administer your purchase (for example, whether a payment was completed).

The payment provider acts as an independent controller for the processing of payment data under its own privacy policy.

Legal requests

We may disclose personal data if required to do so by law or if we believe such action is necessary to comply with legal obligations, protect our rights, or protect users.

6. International transfers

We aim to process personal data within the EU/EEA. Some of our service providers are based in the United States or may process data there, for example for push notifications, error reporting and places search. When personal data is transferred outside the EU/EEA, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

You can ask us for a copy of the safeguards used by contacting us.

7. Retention

We retain personal data only as long as necessary for the purposes described in this policy, unless a longer retention period is required by law.

• Account and group data: retained while your account is active, and for a reasonable period after deletion where needed (e.g. security, disputes, backups).
• Billing and accounting records: kept for 7 years after the end of the financial year in which they were created, as required by the Swedish Bookkeeping Act, also if you delete your account.
• Technical logs: retained for a limited period to troubleshoot issues and maintain security.
• Usage/playback statistics: retained as needed for service improvement and reporting, typically in aggregated or pseudonymized form where possible.
• Group posts: retained until they are deleted by you or a group administrator, or until the group or your account is deleted.
• Reports: retained while the report is being handled and for a limited period afterwards.
• Offline content on your device: stored locally until you delete it in-app or uninstall the app.

8. Your rights

Depending on your jurisdiction, you may have rights including:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction
• Right to object (in particular to processing based on legitimate interests)
• Right to data portability (when processing is based on contract or consent and is automated)
• Right to withdraw consent (where processing is based on consent), for example by turning off marketing emails in your profile

To exercise your rights, contact us at kontakt@wearevoice.se. You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se). You can also contact the authority in the country where you live.

9. Security

We implement reasonable technical and organizational measures to protect personal data, including access controls and secure storage for sensitive tokens on your device.

No method of transmission or storage is 100% secure, but we work continuously to improve security.

10. Children

The Service may be used by children, including in educational settings (for example, schools).

If you are a minor, you should use the Service only with permission and involvement of a parent/guardian or your school, as required by applicable law. Where we rely on consent, for example for marketing, a parent or guardian must give or approve the consent if you are below the age limit in your country (13 years in Sweden). If you are a parent/guardian and believe that a child has provided personal data to us without appropriate permission, contact us and we will take appropriate steps.

11. Cookies and similar technologies

The mobile app does not use cookies. It stores settings, sign-in tokens and downloaded content on your device so that the app works.

The web app only uses cookies and local storage that are needed for it to work. We do not use cookies for advertising or for tracking you across other websites. Examples:

• Sign-in: session cookies set by our identity provider so that you stay signed in.
• Settings: your chosen language and whether you have closed certain messages or banners.
• Payments: when you pay, the payment provider may set its own cookies, for example to prevent fraud.

You can remove cookies in your browser settings. The web app may then not work as intended, for example you may be signed out.

12. Deleting your account

You can delete your account at any time in the app or the web app, or by contacting us. When you delete your account, your profile, your playlists, your group posts and the titles you have uploaded are permanently deleted, and any subscription you pay for ends. Groups where you are the only member are deleted too. If you are the last administrator of a group that has other members, you need to make someone else administrator before you can delete your account. Some data may be kept for a limited period where required by law or for security reasons, as described under Retention.

13. Changes

We may update this Privacy Policy from time to time. The latest version will be available in the Service and on our website. For material changes, we will provide appropriate notice.