Toneer

Effective from 9 October 2026. This is a translation for convenience; the Polish version is legally binding.

1. Controller

Your personal data is controlled by Tomasz Żuchowski, Tymiankowa 7C.m8. For anything about your personal data, write to admin@toneer.io.

2. What data we process

• Account data: email address, name (real or stage name), date of birth, encrypted password, chosen language, registration and approval dates.
• Profile data — only what you choose to add: photo, bio, instruments and level, genres, what you are looking for, availability, city and country, travel radius, lesson details, links, contact email, audio recordings. From your city we derive approximate (city-level) coordinates to show musicians nearby.
• Pages and events you run (bands, venues, rehearsal rooms, studios, producers, events), including place addresses, photos, recordings and pages you follow.
• Messages exchanged with other Users and booking requests (time, place, message, status).
• Google or Facebook sign-in data — if you use it: account ID, name, email address and profile picture.
• Consents and settings: newsletter consent (with its date), notification and messaging settings.
• Technical data: IP address, browser and device information, server logs, cookies (section 7).

3. Purposes and legal bases

• Running your account, profile and pages, search, messaging, bookings, email notifications — performance of the contract (Art. 6(1)(b) GDPR).
• Reviewing new accounts, security, preventing abuse and spam, moderating reported content, handling complaints, establishing and defending legal claims — our legitimate interests (Art. 6(1)(f) GDPR) and obligations under the Digital Services Act (Art. 6(1)(c) GDPR).
• Newsletter — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your account settings or via the link in the email.
• Visit statistics (analytics cookies) — your consent given in the cookie banner (Art. 6(1)(a) GDPR).
• Legal obligations, e.g. answering lawful requests from authorities — Art. 6(1)(c) GDPR.

Account data is voluntary but required to use the Service. All other profile data is entirely optional.

4. Who sees your data

• Other Users and visitors — only information on your published profile, according to each field’s visibility setting (“Everyone”, “Members only”, “Only me”). From your date of birth we show at most your age. Nobody sees your exact location — distances are approximate.
• Messages are visible only to their participants. We do not read them unless needed to handle an abuse report, for security, or when required by law.
• Our providers (processors): Namecheap, Inc. (website and email hosting); the Metricool service (statistics — only with your consent); the OpenStreetMap Foundation (Nominatim service — receives only a city name or place address to compute coordinates, nothing that identifies you).
• Google and Meta (Facebook) — only if you sign in with them; they process data under their own privacy policies.
• Authorities — when required by law.

5. Transfers outside the EEA

Some providers (e.g. Namecheap, Google, Meta) are based in the USA. Data may be transferred there under the European Commission’s adequacy decision (EU–US Data Privacy Framework) or the Commission’s standard contractual clauses. You can request a copy of the safeguards at the address in section 1.

6. How long we keep data

• Account, profile, pages, messages and bookings — until you delete your account. They are then deleted promptly, and removed from backups as those are rotated.
• Accounts we decide not to approve — deleted once that decision is made.
• Newsletter consent and analytics data — until you withdraw consent.
• Server logs and security data — as long as needed for security, usually no longer than 90 days.
• Data needed to establish or defend claims or prove compliance — until the limitation period ends.

7. Cookies

• Necessary: WordPress sign-in cookies (wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie) keep you logged in; toneer_lang remembers your language (1 year); toneer_oauth_state secures Google/Facebook sign-in (10 minutes). No consent needed.
• Analytics: Metricool cookies for anonymous visit statistics — used only after you consent in the cookie banner.

You can change cookie choices in the cookie banner and in your browser. Blocking necessary cookies prevents logging in.

8. Your rights

You have the right to access your data and get a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting processing before withdrawal). You can change or delete most data yourself in My account, including deleting the whole account. For anything else write to admin@toneer.io — we answer within one month.

You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your EU country.

9. Other information

• We do not make decisions about you based solely on automated processing, including profiling. Accounts are approved by a person.
• The Service is for people aged 16 and over.
• We use security measures: encrypted connections (HTTPS), hashed passwords, review of new accounts, and limits on login and sign-up attempts.
• We will notify you by email of significant changes to this policy. The rules for using the Service are in the Terms of use.