Name: Sho Ayuba

Contact: sho.yuba48@gmail.com

Concert record data contains no personal information and is stored locally on your device only. However, for premium features (background customization), we collect subscription purchase history and user identifiers via RevenueCat, and minimal authentication information when using Apple Sign In.

Our website (maestlog.app) collects minimal data:

• Contact Form: When you submit a contact inquiry through our website, we collect your name, email address, subject, and message content. This information is processed by Resend Inc. (US) for email delivery and stored for support purposes for up to 2 years.

• Language Preference: We store your language preference in your browser's local storage to provide a consistent experience. This data never leaves your device.

• Third-Party Services (Website):

  - Resend (Email delivery): Privacy Policy at https://resend.com/legal/privacy-policy

  - Google Fonts (Typography): Privacy Policy at https://policies.google.com/privacy

We process your information based on the following legal grounds under GDPR Article 6:

• Subscription purchase history via RevenueCat: Contract performance (GDPR Art. 6(1)(b)) - necessary to provide Premium features
• Authentication information via Apple Sign In: Consent (GDPR Art. 6(1)(a)) - you explicitly consent when signing in
• AI image analysis via Gemini: Consent (GDPR Art. 6(1)(a)) - you explicitly upload images for analysis
• Contact form submissions: Consent (GDPR Art. 6(1)(a)) - you explicitly submit your information

Concert record data is stored only on your device and is not processed by our servers. The app functions offline, but we perform minimal server communication for payment verification, authentication, and AI analysis (Premium feature only).

Concert record data is not shared with third parties and remains only on your device.

However, we share certain information with the following third-party services to provide app functionality:

• RevenueCat Inc. (USA) - Subscription management

  Data shared: Purchase history, app_user_id

  Purpose: Premium feature access verification

  Privacy Policy: https://www.revenuecat.com/privacy

• Apple Inc. (Various countries) - User authentication

  Data shared: Authentication tokens

  Purpose: Account management via Apple Sign In

  Privacy Policy: https://www.apple.com/legal/privacy/

• Firebase Functions / Google LLC (USA, asia-northeast1) - Premium verification

  Data shared: Anonymous app_user_id, subscription status

  Purpose: Server-side premium subscription verification

  Privacy Policy: https://policies.google.com/privacy

• Gemini AI / Google LLC (USA) - AI image analysis (Premium feature)

  Data shared: Uploaded images (temporary), app_user_id

  Purpose: Automatic extraction of concert information from tickets/programs

  Important: Images are processed temporarily and NOT permanently stored

  Privacy Policy: https://policies.google.com/privacy

• Resend Inc. (USA) - Email delivery (Website only)

  Data shared: Name, email address, message content

  Purpose: Contact form message delivery

  Privacy Policy: https://resend.com/legal/privacy-policy

• Google Fonts (Website only)

  Data shared: Font requests (may include IP address)

  Purpose: Typography on our website

  Privacy Policy: https://policies.google.com/privacy

All data is stored locally using Apple's SwiftData framework (iOS 17+) with iOS's standard security measures. Authentication tokens are securely stored in iOS Keychain. Enable device encryption and use Face ID/Touch ID for enhanced security.

We retain different types of data for the following periods:

• Concert record data: Retained on your device indefinitely until you manually delete it through the app
• Authentication tokens: Stored until you sign out or uninstall the app
• Subscription purchase history (RevenueCat): Retained according to RevenueCat's data retention policy and accounting requirements (typically up to 7 years from last transaction)
• Contact form submissions (Website): Retained for up to 2 years after inquiry resolution for support purposes
• Gemini AI image data: Processed temporarily and automatically deleted immediately after analysis - NOT permanently stored

LOCAL DATA: You have full control over concert data stored on your device. You can view, edit, export, or delete your data at any time within the app. Deletion is permanent and irreversible.

GDPR RIGHTS (EU residents): Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data we hold
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your data under certain conditions
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format (JSON/CSV export available in-app)
• Right to Object (Art. 21): Object to processing of your data
• Right to Complain (Art. 77): Lodge a complaint with a data protection supervisory authority

SERVER-SIDE DATA DELETION REQUEST:

To request deletion of data transmitted to our third-party services:

1. Email us at sho.yuba48@gmail.com with subject "Data Deletion Request"

2. Include your RevenueCat app_user_id (found in Settings > About in the app)

3. We will process your request within 30 days

What gets deleted:

• Firebase: Your app_user_id and subscription verification records
• Resend: Contact form submissions (if applicable)
• Gemini AI: Images are automatically deleted after processing (no permanent storage)

Note: Deleting server-side data may affect Premium feature functionality. Subscription records with RevenueCat may be retained for accounting/legal requirements (up to 7 years).

RESPONSE TIME: We will respond to rights requests within 30 days (GDPR allows up to 1 month, extendable by 2 months for complex requests with notification).

MaestLog is rated 4+ on the App Store and is suitable for all ages. The core app functionality (concert logging with local storage) does not collect any personal information and can be used by children under parental guidance.

However, certain features that collect personal information require parental supervision for children under 13 in accordance with COPPA (Children's Online Privacy Protection Act):

• Subscription purchases (via App Store): Requires Apple ID, managed by parents
• Contact form submissions (website): Collects name and email address
• Apple Sign In (optional): Minimal authentication information

We do not knowingly collect personal information from children under 13 without verified parental consent. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information immediately.

If you believe a child has provided us with personal information, please contact us at sho.yuba48@gmail.com

Concert record data remains on your device without international transfer.

However, the following data may be transferred internationally:

• RevenueCat Inc. (USA): Subscription information

  Transfer Mechanism: EU Standard Contractual Clauses (SCCs) and appropriate technical/organizational measures under GDPR Chapter V

  RevenueCat Privacy Framework: https://www.revenuecat.com/privacy

• Google LLC (USA): Firebase Functions and Gemini AI

  Transfer Mechanism: EU Standard Contractual Clauses (SCCs) and Google's Binding Corporate Rules (BCRs)

  Google Privacy Framework: https://policies.google.com/privacy

• Apple Inc. (Various countries): Authentication information

  Transfer Mechanism: Apple's Binding Corporate Rules (BCRs) and Standard Contractual Clauses

These transfers are conducted with appropriate safeguards as required by GDPR. You can request more information about the specific safeguards used by contacting us at sho.yuba48@gmail.com

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

PERSONAL INFORMATION CATEGORIES COLLECTED (past 12 months):

• Category A - Identifiers: Apple ID, RevenueCat user identifiers, email address (contact form only)
• Category D - Commercial Information: Subscription purchase history, transaction records

CATEGORIES NOT COLLECTED: We do NOT collect: California customer records, protected classification characteristics, biometric information, internet activity, geolocation data, sensory data, professional/employment information, education information, or inferences.

SALE OR SHARING OF PERSONAL INFORMATION:

• We do NOT sell your personal information
• We do NOT share personal information for cross-context behavioral advertising
• Third-party sharing is limited to service providers (RevenueCat, Apple, Firebase, Gemini) for business purposes only, not for sale

YOUR CCPA/CPRA RIGHTS:

1. Right to Know: Request disclosure of personal information we collected, used, and disclosed (past 12 months)

2. Right to Delete: Request deletion of personal information (subject to legal retention requirements)

3. Right to Correct: Request correction of inaccurate personal information

4. Right to Opt-Out: Not applicable (we don't sell personal information)

5. Right to Limit Use of Sensitive Personal Information: Not applicable (we don't collect sensitive PI as defined by CCPA)

6. Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

EXERCISING YOUR RIGHTS:

• Email: sho.yuba48@gmail.com (subject: "CCPA Request")
• Response Time: Within 45 days (extendable by 45 days with notification)
• Verification: We will verify your identity using Apple ID matching
• Authorized Agent: We accept requests via authorized agents with proper California power of attorney

For more information about California privacy rights, visit the California Attorney General's website: https://oag.ca.gov/privacy/ccpa

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date.