Privacy & Cookie Policy

Welcome to SongChoice. We are committed to protecting your privacy and personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (GDPR), and the Privacy and Electronic Communications Regulations (PECR).

This Privacy and Cookie Policy explains how we collect, use, store, and protect your personal information when you use our website at www.songchoice.co.uk.

The data controller responsible for your personal data is:

1. Information You Provide

• Account Information: Name, email address, password (encrypted)
• Church Information: Church name, role, membership details
• Content: Songs, services, notes, and other content you create
• Profile Information: Profile picture, preferences, settings

2. Information Collected Automatically

• Authentication Cookies: Session tokens for keeping you logged in (strictly necessary)
• Usage Data: Pages visited, features used, interaction patterns (only with consent)
• Technical Data: Browser type, device information, IP address (anonymized with consent)
• Performance Data: Page load times, error reports (only with consent)

Legal Bases for Processing

1. Contractual Necessity

To provide and maintain our service, including:

• Creating and managing your account
• Storing and organizing your church's song library
• Enabling collaboration within your church community
• Providing customer support

2. Legitimate Interests

• Improving and developing our service
• Ensuring security and preventing fraud
• Troubleshooting technical issues

3. Consent

With your explicit consent, we use:

• Google Analytics: To understand how users interact with our website
• Vercel Analytics: To monitor website performance and speed

You can withdraw consent at any time through our cookie preferences.

Cookies are small text files placed on your device to help websites function properly and provide usage information. We use the following types of cookies:

1. Strictly Necessary Cookies (No Consent Required)

2. Analytics Cookies (Requires Consent)

3. Performance Cookies (Requires Consent)

Third-Party Embeds

We use YouTube's privacy-enhanced mode (youtube-nocookie.com) for video embeds, which reduces tracking but may still set cookies when you interact with videos.

Where We Store Your Data

• Application Data: Hosted on secure servers in the EU
• Database: PostgreSQL with encryption at rest
• Backups: Encrypted and stored securely

How We Protect Your Data

• Industry-standard encryption (TLS/SSL)
• Password hashing with bcrypt
• Regular security audits and updates
• Access controls and authentication
• Automated backup systems

Data Retention

• Account Data: Retained while your account is active
• Analytics Data: Up to 26 months (Google Analytics)
• Audit Logs: 90 days for security purposes
• Deleted Accounts: Personal data removed within 30 days

Under GDPR and UK PECR, you have the following rights:

1. Right to Access

Request a copy of your personal data we hold.

2. Right to Rectification

Correct inaccurate or incomplete personal data.

3. Right to Erasure ("Right to be Forgotten")

Request deletion of your personal data.

4. Right to Restrict Processing

Limit how we use your data in certain circumstances.

5. Right to Data Portability

Receive your data in a machine-readable format.

6. Right to Object

Object to processing based on legitimate interests.

7. Right to Withdraw Consent

Withdraw consent for analytics and performance cookies at any time.

Some of our service providers are based outside the UK/EU:

• Google Analytics: Google LLC (USA) - Standard Contractual Clauses
• Vercel: Vercel Inc. (USA) - Standard Contractual Clauses

We ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

SongChoice is intended for use by churches and their authorized members. We do not knowingly collect personal data from children under 13 (or 16 in the EU) without parental consent.

We may update this Privacy and Cookie Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

If you have any questions about this Privacy and Cookie Policy, please contact us: