Privacy policy

This policy explains what personal data we process in Atril (the websiteuseatril.com and the applicationapp.useatril.com), what for, and what you can do about it.

Who the controller is

• Controller: Darío Pastor Fuentes
• Tax ID: 29524707K
• Contact email: [email protected]

What data we process

If you visit this website

Almost none. This site uses no tracking cookies, loads no third-party resources and does not follow you across sites. The server keeps request logs (IP address, date, page requested and browser) for a limited time, for security and fault-finding.

If you write through the contact form

Your name, your email, your band’s name if you give it, and your message. Only to reply and, if you ask us to, to let you know when Atril is available.

If you use the application

• Account: name, email address, phone number if you fill it in, password (stored hashed, never in the clear) and profile picture if you upload one.
• Band membership: which bands you belong to, with which role, and the instrument you play.
• Band activity: your attendance at rehearsals and performances (what you reply and what is taken at the register) and the pieces and parts assigned to you.
• Files: the sheet music your band uploads, and the logos and images it adds itself.
• Alerts: if you turn notifications on, the identifier your browser generates so we can send them. It identifies nothing beyond that, and it disappears when you turn them off.
• Preferences: language, and light or dark theme.

We do not process special categories of data (health, beliefs, religion). If anyone types them into a free-text field they do so on their own account, and we ask you not to.

Why we process it, and on what legal basis

• Providing the service (your account, your band, the calendar, attendance, sheet music): performance of the contract you accept when you register.
• Replying to what you write to us: your consent in sending the message.
• Sending you your band’s alerts (a new event, a time change, a reminder): performance of the contract. You can turn them off at any time.
• Keeping the service secure (server logs, rate limits, backups): legitimate interest in Atril working and not being abused.
• Complying with the law where applicable: legal obligation.

Who else sees your data

The members of your band, to the extent that makes sense within it: your name, instrument and section are visible to the band; your attendance reply and the parts you play are visible to those who manage it and, depending on the case, to your section. Your email and phone number are not shown to other musicians.

Never another band. The separation between bands is applied in every query the server makes; it is not a configurable option.

We work with these providers, acting on our behalf:

• Server and database hosting: servers located in Spain.
• File storage (sheet music and images): Cloudflare R2, with the data kept inside the European Union.
• Notification delivery: the push service of whichever browser you use (Google, Apple, Mozilla or Microsoft). They receive the alert in order to deliver it to you.

Your data is stored in the European Union. The server and database, as well as sheet music and images, are all stored inside the EU.

We do not sell or hand over data to anyone for advertising purposes. Ever.

How long we keep it

• Your account and activity: for as long as the account is open. If you delete it, the data is removed; anything forming part of the band’s history (that you attended a concert, say) may be kept without your name.
• Contact messages: up to one year after the last reply.
• Server logs: 90 days at most.
• Backups: overwritten on short cycles; deleted data disappears from them once the cycle completes.

Your rights

You may ask us for access to your data, its rectification orerasure, restriction of or objection to processing, and portability in a format you can open. Write to[email protected] and we will get back to you.

If you believe we have not handled it properly, you may complain to theSpanish Data Protection Agency.

Minors

Bands include musicians under 18. Atril is not intended for children under 14 to create an account on their own; below that age, consent from a parent or guardian is required. A band can keep a minor on its roster without an account, managed by those responsible for them.

Security

Passwords are stored hashed. All traffic goes over HTTPS. Sheet music lives in private storage with no public address: every download is authorised against your membership of the band and uses links that expire within minutes.

Changes

If this policy changes materially, we will say so in the app before it takes effect. The date above shows the last revision.