Solista privacy policy

1. Who is responsible for your data

The App is operated by:

We act as the data controller for your account data. For the personal data you store about your clients (see Section 4), you act as the data controller and we act as a processor providing you the storage and processing infrastructure. The terms of this processing are set out in section 12 of the terms of service.

2. Data we collect about you

When you create an account and use the App, we collect and store:

• Account data — your email address, name, and optional profile photo. You can sign in with an email and password (the password is handled by Firebase Authentication; we never see it in plain text), or with Google or Apple, in which case we receive your email and name from that provider. Sign in with Apple lets you hide your email.
• Business profile data — your professional activity, services and prices, working schedule, country, currency, language, timezone, and notification preferences.
• Business records you create — appointments, income and expense records, notes, and attached photos.
• Notification data — a device token used to deliver the reminders, summaries, and news you have enabled, and the items in your in-app inbox.
• Subscription data — whether you have an active subscription, which plan, and when it renews or expires. Payments are taken by Apple, not by us: we never see or store your card details, billing address, or any payment credentials.
• Technical data — data required to operate the service (authentication identifiers, sync timestamps).
• Usage and diagnostics data — product-usage events (for example: a screen was opened, an appointment was created) and crash reports, used to find bugs and understand which features are used. These events are linked to your account identifier and a device-generated app instance identifier, and carry your country, currency, and language for aggregate statistics. They contain no names, client details, notes, phone numbers, email addresses, or financial amounts — only counts, durations, and yes/no flags. We do not use advertising SDKs, we do not collect the advertising identifier (IDFA), and we do not track you across other companies' apps or websites.

3. What we do NOT do

• We do not sell or rent your data to anyone.
• We do not use your data for advertising.
• We do not track you across other apps or websites, and we do not collect the advertising identifier.
• We do not receive or store your payment details.
• We do not collect data beyond what the App's features need.

4. Client data you store about others

The App lets you keep records about your clients: names, phone numbers, email addresses, messenger and social media handles (WhatsApp, Telegram, Instagram, Facebook, Viber), photos, appointment history, and notes. You may import this data from your device's contact book (only after you grant the contacts permission, and only the contacts you choose).

This data is stored privately in your account, is visible only to you, and is used solely to provide the App's features to you. It is never included in usage or diagnostics data. You are responsible for having a lawful basis to store your clients' information and for honoring their privacy requests (e.g. deleting a client's record when asked — the App provides deletion for every record). If you are one of these clients, see Section 8.

5. Where your data is stored and who processes it

• Google Firebase (Google LLC / Google Ireland Ltd.) — Firestore, Cloud Storage, Authentication, Cloud Functions, and Cloud Messaging store and process your account data and business records. Your database is located in the European Union (Firestore eur3 multi-region) and server-side processing runs in the EU (europe-west1). Google Analytics for Firebase and Firebase Crashlytics process the usage and diagnostics data described in Section 2. Google acts as our processor under the Firebase Data Processing and Security Terms.
• Apple (App Store / StoreKit) processes subscription payments and is the merchant of record.
• RevenueCat, Inc. manages subscription status on our behalf. We receive from Apple, through RevenueCat, only your subscription status and the account identifier it belongs to. RevenueCat acts as our processor.

Some of these providers (notably Google Analytics, Crashlytics, and RevenueCat) may process data in the United States or other countries outside the EU/EEA. Such transfers are protected by the European Commission's Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework, as provided in each provider's data processing terms.

Data in transit is encrypted (HTTPS/TLS); data at rest is encrypted by the providers' infrastructure.

A copy of your data is cached on your device so the App works offline; it is protected by your device's security and removed after you sign out (the next time the App starts) or when you delete the App. If you sign out while changes you made offline have not yet reached our servers, the cached copy is kept so those changes can sync the next time you sign in. A few non-personal display settings (for example, which in-app guided tours you have already seen) stay on the device after sign-out.

6. Permissions the App requests

All permissions are optional and requested only when you use the related feature:

7. How long we keep data and how to delete it

Your data is kept for as long as your account exists. You can delete individual records (clients, appointments, transactions, images) at any time in the App. Inbox items expire automatically.

Some data is kept outside the App after deletion:

• Usage and diagnostics data already collected is deleted automatically: usage events after 14 months (Google Analytics) and crash reports after 90 days (Crashlytics). It cannot be used to restore your account.
• Subscription records — Apple and RevenueCat keep the purchase history of your subscription as required for billing, tax, and refund purposes. Technical logs of subscription events, which contain your account identifier, are deleted automatically after 90 days.

Deleting your account does not cancel a subscription. Subscriptions are managed by Apple and must be cancelled in your App Store account settings; see the terms of service.

8. Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, rectify, export (data portability), restrict, and erase your personal data, and to object to its processing. You also have the right to lodge a complaint with a supervisory authority; in Poland, this is the President of the Personal Data Protection Office (UODO).

If you use the App. You can exercise most of these rights directly in the App: all your records are viewable and editable, reports are exportable, and your account is deletable (Profile → Delete Account). For anything else — including a full copy of your data in a machine-readable format, or objecting to the processing of usage and diagnostics data — contact admin@solista.me. We respond within one month, as required by the GDPR.

If you are a client of a professional who uses Solista. Your data is controlled by that professional, not by us (see Section 4). Please send requests about your data to them directly. If you contact us instead, we will forward your request to the professional concerned and let you know we have done so. We cannot change or delete their records on our own.

9. Legal bases

We process your data to perform our contract with you (providing the App and your subscription), and, for optional features such as push notifications, on the basis of your consent, which you can withdraw at any time in the App's settings or your device settings. Usage and diagnostics data is processed on the basis of our legitimate interest in keeping the App working and improving it; it is not used to make decisions about you, and you may object to it at any time (see Section 8).

10. Children

The App is intended for professionals and is not directed at children under 16. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy as the App evolves. Material changes will be announced in the App. The current version is always available at this address.