Privacy policy

Sound Republic AI, S.L.U., tax ID B26869776, registered office at Calle Valentín Sanz 23, 2º · 38002 Santa Cruz de Tenerife · Spain.

For anything about privacy, or to exercise your rights: legal@soundrepublic.ai or by phone on +34 640 112 637.

It is worth starting with what does not happen, because that is the unusual part:this site asks you for no data at all. It has no forms, it sets no cookies, it carries no analytics and no advertising pixels, it loads no third-party resources, and the typefaces are served from this same domain.

With that, the only data that comes to exist is of two kinds:

• Technical browsing logs. In serving any page, the hosting provider records the IP address, the user agent, the date and the resource requested. It is inherent to how the web works and it is not used to build a profile of you.
• What you send us. If you call, write on WhatsApp or email us, we process whatever you decide to tell us — name, phone, email, the project you are describing.

We do no behavioural advertising, we build no profiles and we take no automated decisions with legal effects on you.

• Technical logs: the hosting provider's retention period, in the order of days, and we keep no copies.
• Commercial enquiries: while the conversation is live and up to one year after the last contact. If it ends in a contract, whatever commercial and tax law requires.

We do not sell or transfer personal data. The only third parties involved are providers acting as processors:

Public authorities could also have access where a rule requires it. International transfers rely on an adequacy decision or on standard contractual clauses.

If at any point we add a form, a measurement tool or a consent manager, this list and the cookie policy get updated before that goes live, not after.

You can ask us for access to your data, its rectification or erasure, restriction of or objection to processing, and portability. Where the basis is your consent, you can withdraw it at any time without that affecting processing carried out beforehand.

Write to legal@soundrepublic.ai saying which right you want to exercise. We will reply within one month. If your data reached us through a club or festival that uses Sound Republic OS, the way to ask is in section 8.

If you are in the United Kingdom, the UK GDPR applies to your data and the supervisory authority is the Information Commissioner's Office — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113. You can complain to them if you believe we have not handled your request properly.

If you are in Spain or elsewhere in the EU, the authority is the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid).

Complaining to an authority does not cost you anything and does not require you to have written to us first — though we would rather you did, because we can usually fix it faster.

Besides this website, we make Sound Republic OS, the platform that clubs and festivals use to sell tickets, manage their relationship with their audience and answer their customers' questions. There, the data is not ours: it belongs to each business, which is the controller. We are its processor: we process the data on its behalf, only to provide the service, following its instructions and a data processing agreement under art. 28 GDPR. What each business does with your data is set out in its own privacy policy; here we explain what we do.

What follows focuses on the Inbox, the module each business's team uses to answer what people send through its website, by email, on Instagram and on WhatsApp, because that is where data from Meta comes in.

When a business connects its Instagram professional account or its WhatsApp Business number to the OS, Meta sends us the messages people write to that business. For each conversation we store:

• Who is writing. On Instagram, the ID Instagram gives you for that business, your name and your @username. On WhatsApp, your phone number, your WhatsApp user ID and your profile name.
• What you write and what you are told, including the replies the business sends from the Instagram or WhatsApp app itself, so the history is complete. Before storing your messages we remove any card numbers, IBANs, identity document numbers and email addresses written in them. Phone numbers are kept, because whoever writes one almost always wants a call back.
• Photos, voice notes, videos and documents are not downloaded. From WhatsApp we note that one arrived, with its caption; from Instagram, its type and the link Meta provides. From a shared location we keep the place name and address, not the coordinates.
• Earlier WhatsApp history, only if the business connects the number it already uses in the WhatsApp Business app: Meta sends the messages from the last 180 days, without group chats, and we store them as closed conversations, handled the same way. The phone's contact list, which Meta also sends at that point, is not stored.
• About the business's own account, its Instagram account ID and name, or its WhatsApp number and verified name, and the access token Meta issues, which we store encrypted.

• So the business's team can read and answer your messages from the Inbox. Replies only go to people who wrote first, within the time limits Meta sets.
• To answer you on WhatsApp with a help article the business itself has written and approved, when your question already has an answer. It comes with two buttons: one to say it helped, one to talk to a person. Anything that cannot be answered this way goes to someone on the team. The business can switch this off.
• To link the conversation to your contact record with that business, the same one that shows, for example, any tickets you have bought from it, so its team knows who they are talking to. Writing to a business does not sign you up to its marketing: the Inbox records no consent.
• To improve that same business's answers: from conversations already resolved, the system suggests new or corrected help articles, which a person reviews before they are published.

We do not sell this data, we do not use it for advertising (ours or anyone else's), we do not upload it to Meta or any other platform as audiences, and we do not combine it across businesses: each business's data is isolated from every other's in the database.

The Inbox uses Anthropic's models (Claude) to suggest draft replies to the team, to pick the help article that answers a question and to suggest improvements to those articles. Before sending anything we remove card numbers, IBANs, identity documents, email addresses and phone numbers from the text, and we do not send your name, your number or your IDs as separate data; if you write your name in the message, it goes with the text. Under its commercial terms, Anthropic does not use what it receives through its API to train its models. A draft is not sent until a person on the team sends it, and no decision with legal effects on you is taken by automated means.

These providers process it on our behalf, under contract and only for the purpose stated:

Transfers outside the European Economic Area rely on an adequacy decision or on standard contractual clauses. Meta is not on this list because it is not our provider: it processes your messages on behalf of the business, under the terms the business accepts when it connects its account.

• Conversations are kept while the business uses the service, so its team has each person's history. They are not deleted automatically after a set period: they are deleted when the business asks, when you ask (section 8) or when its contract ends, at which point we delete them or return them to the business, except for anything the law requires to be kept.
• If the business disconnects Instagram or WhatsApp, at that moment we ask Meta to stop sending us its messages, delete the access token Meta gave us and do not store anything that arrives afterwards. What was already there stays in its Inbox until it is deleted in one of the ways above.
• Files the team attaches to an email reply are deleted as soon as the email has been sent.

If you wrote to a club or festival on Instagram, on WhatsApp, through its website or by email, and you want what we hold from those conversations deleted:

1. Email legal@soundrepublic.ai with the subject "Data deletion".
2. Tell us which business you wrote to and from where: your Instagram @username, your WhatsApp number or your email address. You do not need to send us any document.
3. As that data belongs to the business, we pass your request on to it and, with its agreement, we delete your conversations, your messages and your identifiers from its Inbox and from your contact record. We confirm in writing once it is done, within one month.

You can also ask the business directly, as it is the one that decides about that data.

Three things worth knowing. Deleting or unsending a message on Instagram or WhatsApp does not delete it from the business's copy: that is what this route is for. If you also bought tickets from the business, the record of that purchase is kept for as long as commercial and tax law requires, but without your name, email address or phone number. And if you hold a ticket for an event that has not happened yet, we delete your data once it has: until then, your details are what that ticket relies on.

If you are a business using the OS, you can disconnect Instagram or WhatsApp at any time from the integrations settings, and erase a person's data from their contact record. To delete particular conversations without erasing the person, or all of them, email the same address.

When it changes, the date in the header changes. If the change is substantive — a new kind of processing, a new processor — it is also announced in the changelog, with its date.