Privacy Policy
Last updated: 17 July 2026
This policy describes how the personal data of users of Ziricote (hereinafter the "Service"), available both as a web application and as a mobile app, is processed, pursuant to Regulation (EU) 2016/679 ("GDPR") and applicable Italian law.
1. Data Controller
The Data Controller is Appius S.r.l., with registered office at Via P.ssa Iolanda 21, 07100 Sassari (SS), contact e‑mail info@ziricoteapp.com, VAT number and Tax Code 03898560366.
2. Types of data processed
- Registration and account data: e‑mail address, chosen name, password (stored exclusively in encrypted form using bcrypt hashing, never in cleartext).
- Profile data (optional): profile picture, biography, instrument, location.
- User-generated content:
- Chord charts: they contain only chords (harmonic progressions), without melodies or lyrics. They are public content, shared in the community catalog and accessible to other users.
- Scores and melodies: content created by the user for personal use. They are stored on our servers for the sole purpose of enabling their saving, synchronization across the user's devices, and export. They remain private: they are not published in the catalog, are not made accessible, nor shared with other users.
- Reactions ("like"/"dislike") to songs.
- Technical and usage data (analytics): interaction events, pages visited/screens, device identifier, device type and operating system, language, approximate location information. This data is collected through PostHog when analytics is active and, where required, subject to prior consent.
- Session data: a technical authentication cookie (see the Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Creation and management of the account, provision of the Service | Performance of a contract (art. 6.1.b) |
| Sending the welcome e‑mail and service communications | Performance of a contract (art. 6.1.b) |
| Publication of chord charts in the shared catalog and management of reactions | Performance of a contract (art. 6.1.b) |
| Storage, synchronization and export of the user's personal scores (not published) | Performance of a contract (art. 6.1.b) |
| Statistics and improvement of the Service (analytics) | Consent (art. 6.1.a) or legitimate interest (art. 6.1.f) |
| Sending promotional communications about Ziricote products and news (marketing) | Consent (art. 6.1.a), optional and revocable at any time |
| Security, abuse prevention, legal compliance | Legitimate interest / legal obligation (art. 6.1.f/c) |
4. Recipients and external processors
To provide the Service we rely on suppliers who process data on our behalf as data processors:
- PostHog — statistical analysis of usage (web and app).
- Resend — sending of transactional e‑mails (e.g. welcome).
- Vercel Inc. (USA) — hosting of the web application and the APIs.
- Aruba S.p.A. (Italy) — hosting of the server and the PostgreSQL database on which the data, including users' personal scores, is stored.
Data is not transferred to third parties for marketing purposes.
5. Transfers outside the EU
Some suppliers may process data outside the European Economic Area. In such
cases the transfer takes place on the basis of adequate safeguards (e.g. Standard
Contractual Clauses of the EU Commission). For analytics, PostHog's European
infrastructure (eu.i.posthog.com) is used where possible.
6. Retention period
- Account data and content (including chord charts and personal scores): for the entire duration of the account and as long as necessary to provide the Service; deleted (or anonymized) within 30 days of the request for account deletion.
- Analytics data: retained for 14 months, then aggregated or deleted.
- Technical and security logs: 12 months.
7. Rights of the data subject
The user may at any time exercise the rights provided for by arts. 15‑22 GDPR: access, rectification, erasure, restriction, portability, objection to processing, as well as withdrawal of consent (without affecting the lawfulness of processing prior to withdrawal). Requests should be sent to info@ziricoteapp.com.
The user also has the right to lodge a complaint with the supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
8. Security
We adopt adequate technical and organizational measures: passwords encrypted
with hashing, communications over an encrypted channel (HTTPS), httpOnly
session cookies, restricted database access. However, no system is 100% secure.
9. Minors
The Service is not intended for minors under 18 years of age. We do not knowingly collect data of minors without the consent of those who exercise parental responsibility over them.
10. Changes
This policy may be updated. Material changes will be communicated through the Service; the date at the top indicates the last update.
11. Contacts
For any request relating to privacy: info@ziricoteapp.com.