Holtz Player privacy policy

Holtz Player gives existing Holtz Sound Studio clients and authorised collaborators access to their studio projects. This policy explains how personal information is handled through the iPhone and Android apps, their Portal services and related support.

The data controller is Amplitude (by Discolux.lu s.àr.l.), 19, route de Cruchten, L-7738 Colmar-Pont, Luxembourg. For privacy questions, access requests or deletion requests, contact studio@holtz-sound.lu.

Account information includes your email address, profile name where available, account identifier and access permissions. Sign-in credentials are sent to Supabase, our authentication provider. The app keeps session tokens in the iPhone Keychain or in private encrypted Android storage protected by Android Keystore so that you can remain signed in. Accounts and project invitations are managed by the studio; the apps have no public account-registration feature.

Project information includes audio, stems, artwork, versions, feedback, studio messages, session information and invoices available to your account. When you send files, we receive the files you select, their names and sizes, and any accompanying note. When you request a stem mix, we receive the selected stems and their levels. This information is linked to your account and project.

If you enable notifications on iPhone, we register an Apple push token, a registration identifier and your notification preferences with your account. Push notifications use generic previews rather than including project names or message text. Android version 1.0.0 does not include Firebase or push notifications.

The service records activity such as playback and download requests, feedback submissions, invoice access, messages, file transfers and stem-render requests. Hosting and service logs may contain IP addresses, request times and error information. Information you send when contacting support is used to respond to your request.

We use information to authenticate accounts, enforce project access, provide audio and file delivery, manage feedback and messages, show studio sessions and invoices, produce requested stem mixes, deliver optional notifications, and maintain and support the service.

Our legal bases are performance of our agreement with you, where applicable; legitimate interests in providing authorised project access, communicating about studio work, supporting the service and protecting it against misuse; and legal obligations relating to business records. Where particular optional processing requires consent, we rely on that consent and you can withdraw it.

Providing account information is necessary to use authenticated project features. Optional uploads, messages and notification permission depend on which features you choose to use. The native app contains no advertising or cross-app tracking SDK.

Authorised studio staff and project participants can access information appropriate to their permissions. Feedback may be visible to other authorised participants in the project. Messages are available to the relevant conversation participants and authorised studio staff. Other clients do not receive access to your project merely by having an account.

The services used by these features include Supabase for authentication and database services, Vercel for Portal hosting and APIs, Dropbox and the studio's transfer server for project files, Apple for push delivery, Rentman and studio-connected Google Calendar services for session and invoice information, Resend for Portal emails, and Luxhosting for studio email correspondence.

Provider processing can take place in the European Economic Area and elsewhere, including the United States. The location of a primary database or application server does not determine every provider's processing location. International-transfer arrangements depend on the provider and service, including applicable adequacy decisions or contractual safeguards. You can contact the studio for information about the arrangements and available safeguards applicable to your data.

Dropbox processes information under the terms applicable to the studio's subscription. Dropbox's Business data-processing agreement does not apply to a Plus subscription. The studio's provider review and contractual arrangements are separate from your project access permissions.

The app stores preferences and unsent message drafts locally. Android message and feedback drafts and file-transfer recovery journals use private encrypted storage protected by Android Keystore and are excluded from backups. The app accesses files you choose through the system picker, rather than requesting access to your entire file library. You can use project features without enabling push notifications. On iPhone, notification preferences can be changed in the app or in iPhone Settings; Android version 1.0.0 has no push notification controls.

When your permissions allow downloads, Make available offline saves the selected audio source and the project and track information needed to find and play it. Make all available offline saves project player sources across stages, versions, languages and formats. Cancelling keeps files already saved. These downloads use private app storage and device file protection and are marked for exclusion from device backups. The offline library does not store playback links or server credentials.

Offline access requires an online project-access check at least once every seven days. Changes to permissions or source files detected online can remove saved copies. Permission changes cannot take effect immediately while the phone is offline. Downloads can be removed in Settings → Offline audio. Signing out clears the offline library and saved session tokens and, where push is supported, attempts to unregister the phone for notifications.

Stem previews and files opened for preview outside the offline library are downloaded temporarily. Leaving the stem mixer removes its temporary previews. Files you export using Save or Share remain in the destination you choose and are outside the app's cleanup controls.

Retention depends on the purpose of the information, the studio relationship and any agreed archive service, applicable recordkeeping obligations, and the need to establish or defend legal claims. Account and project information supports ongoing work and authorised access. Project audio and masters may remain while an agreed archive service continues. Messages, feedback and activity history may remain relevant to delivery, revisions, support or a dispute after a session ends.

The Portal does not currently apply a general automatic age-based deletion schedule to accounts, messages or project records. Signing out or removing an offline download does not delete your studio account, project originals, invoices or other server records. Contact the studio to request account closure, erasure or the retention information applicable to a particular project or record.

Deletion requests are assessed individually, including identity verification, other participants' rights, legal retention duties and any ongoing archive agreement. We explain when information must be retained. Backups and file-version history may retain recoverable copies after an active copy is removed; expiry depends on the relevant provider and service. A Dropbox subscription's version-history period is not a guarantee of immediate erasure from every copy.

Subject to applicable law, you can request access to your personal data, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, withdrawing it does not affect processing already carried out lawfully. Send requests to studio@holtz-sound.lu; we may need to verify your identity.

You can lodge a complaint with the competent supervisory authority, including Luxembourg's Commission nationale pour la protection des données (CNPD). Information about the CNPD and exercising your rights is available at https://cnpd.public.lu.

We may update this policy when features or data practices change. The latest published version is available from Settings → Privacy policy and at https://portal.holtz-sound.lu/portal/holtz-player/privacy. Contact studio@holtz-sound.lu for privacy questions or app support.