Privacy policy

Tonicset ("we", "our") helps churches and other organisations plan, practise, and lead music. This notice explains what personal information is handled through Tonicset, why it is used, who can see it, how long it may be kept, and what rights you have.

Who is responsible for your information

For account administration, platform security, support, product analytics, and operation of Tonicset, the operator of Tonicset decides why and how personal information is used.

For information entered into an organisation's workspace - such as member names, access roles, service assignments, leader history, setlists, and reviews - the organisation that invited you normally decides what is recorded and how it is used. Tonicset hosts and processes that information to provide the service. Your organisation may therefore also be a data controller for that information. Requests about an organisation's records should usually be made to its owner or administrator first.

Information handled through Tonicset

• Account and profile details. Your email address, display name, profile image, voice part, authentication identifiers, and any profile details you choose to add. If you sign in with Google, this also includes the name and profile photo Google shares with us.
• Membership, roles, and permissions. The organisations and services you belong to; whether your membership is active; your organisation-wide and service-specific roles; invitations; and records of role, membership, and permission changes. Roles are used to control which features and records you can view or change.
• Planning and historical activity. A member's name may be stored alongside services, setlists, lead assignments, songs, notes, repertoire suggestions, structured song reviews, decisions, and edits. This includes historical activity, including records created before a person had a Tonicset account or after their account is unlinked.
• Vocal range. If you complete the guided vocal-range tool, we store the note range you can sing comfortably, used only to suggest suitable keys for songs.
• Microphone audio. Tools like the tuner and the guided vocal-range flow use your microphone to detect pitch, live in your browser. We do not record or upload microphone audio to our servers.
• Connected accounts. If you choose to connect Spotify, we store only the minimum needed to build and sync a setlist's playlist (an access token and the playlist's ID) - never your Spotify password. You can disconnect this at any time from Settings.
• Usage, diagnostics, and security data. Product events, session and device information, authentication and request logs, error reports, and an account or session identifier. When signed in, product analytics may be associated with your user ID, name, and email address. For AI-assisted features, diagnostic records may include the relevant input and generated output so failures and quality can be investigated.

This information may come from you, your sign-in provider, an organisation owner or administrator, another member who plans a service or imports a historical setlist, or an integration you choose to use.

How and why we use it

• Providing the service (contract). We use account, profile, organisation, and integration information to authenticate you, provide requested features, sync connected services, and maintain your account.
• Organisation administration and shared history (legitimate interests). Tonicset and its organisations have legitimate interests in coordinating services, assigning appropriate access, keeping accurate setlist and leadership history, producing relevant internal statistics, and preserving the context of shared records. We limit this information to the relevant organisation and use role-based controls to reduce its impact on individuals.
• Security, reliability, and improvement (legitimate interests). We use logs, audit records, error reports, and proportionate product analytics to prevent misuse, diagnose problems, understand whether features work, and improve Tonicset. We do not use organisation activity to build advertising profiles.
• Legal obligations. We may use or retain information when necessary to comply with law, respond to a valid legal request, or handle a data-protection request.

Religious information

In a church or worship context, membership, service, or leadership records may reveal or suggest religious beliefs. Tonicset does not use those records to infer beliefs, make unrelated decisions about people, or target advertising. The organisation using Tonicset is responsible for ensuring it has both a lawful basis and, where required, an appropriate UK GDPR Article 9 condition for this information. For eligible not-for-profit religious bodies, this may include the condition for legitimate activities involving members, former members, or people in regular contact, with appropriate safeguards.

Who can see organisation information

Member names, roles, service assignments, and activity are available only within the relevant organisation, subject to its permissions. Some records are visible to all members because they form part of the shared planning or review history; management actions and audit records are more restricted. Historical leader information is not made globally searchable across Tonicset.

Invitation links use a separate random preview identifier. A messaging or social service that fetches the link may receive the invitee's first name and organisation name to create a preview. The private acceptance token is not used for that preview, and the preview stops being personalised once the invitation is no longer pending or has expired.

What we don't do

• We don't sell your data to anyone.
• We don't show personalised ads or use your activity for cross-site advertising.
• We don't share your organisation's setlists or notes outside that organisation.
• We don't make decisions with legal or similarly significant effects solely by automated means.

Service providers and integrations

We use the following providers to operate Tonicset. They receive information needed for the relevant purpose and process it under their own terms or our service arrangements:

• Google Firebase and Google Cloud - authentication, data storage, server functions, security, and operational logs.
• Google Sign-In - optional, if you choose to sign in with Google.
• Spotify - optional, only if you link a song or connect a playlist.
• CCLI SongSelect and PraiseCharts - optional, only when you search for song details through those tools.
• Google Gemini and Voyage AI - AI-assisted formatting, summaries, and lyric/search features. Text submitted to those features may be sent to the relevant provider.
• PostHog - product analytics, error diagnostics, and AI-generation diagnostics.

Some providers may process information outside the UK. Where UK data protection law requires safeguards for an international transfer, the responsible controller should ensure an applicable adequacy regulation, contractual safeguard, or other lawful transfer mechanism is in place. You can ask for more information about providers and transfer safeguards.

Data retention

• Account and private-profile information is kept while your account is active and removed when you permanently delete the account, subject to any information that must temporarily remain for legal or security reasons.
• Shared organisation records are kept for as long as the organisation reasonably needs them for current administration, accurate history, statistics, accountability, or dispute resolution. Organisations should review inactive members and older records periodically rather than keep information without a continuing purpose.
• If you delete your account, Tonicset removes the sign-in account, private profile, personal workspace, and links granting access to shared organisations. Your member record and display name may remain attached to historical setlists, lead assignments, suggestions, reviews, or audit history so those shared records remain intelligible. The member record is unlinked from your deleted account and can be corrected, deactivated, or removed by the organisation where appropriate.
• Security logs, product analytics, diagnostics, and provider records are retained only for the configured period reasonably needed for security, troubleshooting, service improvement, and legal obligations, then deleted or aggregated where practicable.

Your choices and rights

Depending on the circumstances and lawful basis, you may have rights to access your personal information, correct inaccurate information, obtain a copy, request erasure or restriction, and object to processing. These rights are not absolute; for example, an organisation may need to preserve a proportionate historical record while correcting an inaccurate attribution or removing the link to your account.

• You can edit your profile and vocal range from your profile settings.
• You can disconnect Spotify or another connected account from your profile.
• You can permanently delete your Tonicset account from your profile.
• You can ask an organisation administrator to correct a name, role, service assignment, or historical misattribution.
• You can complain to the Information Commissioner's Office.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page.

Contact

For a name, role, service assignment, setlist, review, or other organisation record, contact the owner or administrator of that organisation, or the person who invited you. For account, analytics, security, provider, or other platform-level questions, contact the operator through the contact details supplied with your access to Tonicset. We may need to verify your identity before acting on a request.