I. Introductory Provisions

  1. These contractual terms apply to the purchase and use of a license for the Mango Songbook application on the website www.mangosongbook.com (hereinafter "Application"), operated by Adam Motvička, ID: 74500431 (hereinafter "Operator"), contact email: [email protected].
  2. The application user is any natural or legal person who creates a user account (hereinafter "user"). Creating a user account involves entering an email address and password.
  3. The application is a web service primarily used for storing songs in your own songbook.
  4. We may continuously modify or supplement these Privacy Policy terms. The current version is always published on this page with the date of the last update. If you do not agree with the changes, you can delete your account at any time without any penalty.
  5. These Policy terms describe how we handle users' personal data, while complying with Regulation (EU) 2016/679 of the European Parliament and Council, the General Data Protection Regulation, also known as GDPR (hereinafter we will use the abbreviation "GDPR").

II. Mango Songbook is the Data Controller

  1. By granting consent in the application, we begin processing your personal data. We are therefore the data controller. Browsing the website may also result in the collection of personal data. We always process exclusively personal data obtained only from you.
  2. We process the following personal data within the meaning of Article 4(1) GDPR:
    • electronic mail address (email)
    • IP addresses of devices from which login to the application occurred
    • billing data, in case of subscription payment
    • data about the use of the application and technical data about the device (described in Section III)
  3. We process the above-mentioned personal data for the purpose of fulfilling the contract according to Article 6(1)(b) GDPR, which means providing services by making the application available, informing about planned maintenance outages of software and hardware, handling your inquiries through customer support, and informing about changes in the application or its use.
  4. For the purpose of protecting servers from attacks and user accounts from misuse by third parties within the meaning of Article 6(1)(f) GDPR
  5. For the purpose of being able to inform you, within our interest, about what's new in mangosongbook.com, what improvements and news we plan, what related products we are developing, so that you always have an up-to-date and accurate overview of the application status.
  6. We always store email communication with customer support for 12 months so that we can provide better quality services and help you immediately and effectively in cases of recurring application problems.
  7. We process personal data for the duration of the contract, i.e., for the duration of the user account existence, but no longer than 10 years. After its termination, in case of a dispute arising regarding the relationship between the company and the user related to the Terms of Use of the mangosongbook.com application or these privacy policy terms regarding compensation for damages.
  8. When providing services, we use the following processors. We only share the data they need for the given purpose:
    • Google (Firebase, Google Cloud) - user accounts and sign-in, all data in the application (songs, playlists, settings), uploaded files and server functions. Application data is stored in Google data centers in Frankfurt am Main (Germany).
    • Twilio SendGrid and Amazon Web Services (Amazon SES, Frankfurt region) - sending emails (registration confirmation, password reset, payment and membership information, news). Delivery, email opens and link clicks are recorded so that we can detect non-working addresses and stop sending news to people who have not read them for a long time.
    • ComGate Payments - payments by card, bank transfer and other payment methods on the web and in apps outside the App Store (Android, desktop). Card details are processed only by ComGate, we never see them.
    • Apple - subscriptions purchased in the iPhone and iPad app (App Store). The payment is processed by Apple, we only receive a confirmation of the purchase and its validity.
    • Capgo - delivering updates to the iOS and Android apps. When checking for an update, the app sends its version, platform and a random installation identifier, not data about you.
    • Meta Platforms (Meta Conversions API) - after registration and after a membership payment, our server notifies Meta that the event happened. It includes your email and account identifier in hashed (irreversibly encoded) form and the ad click identifier if you came from an ad on Facebook or Instagram. This is used only to evaluate and target our ads (legitimate interest under Article 6(1)(f) GDPR), and you can object to it at any time by email. We do not use the Meta Pixel or any other third-party tracking scripts on the website or in the app.
    • Functional Software (Sentry) - automatic reporting of application errors (technical description of the error, app version, device and browser type), servers in the EU. Used temporarily, it will be replaced by our own error reporting on our server (Section III).
    • Hetzner Online GmbH (Germany) - the provider of our server in the EU; our rented server runs the administration, email sending, search, PDF export and the measurement described in Section III.
  9. YouTube API Service
    • The Mango Songbook application uses YouTube API Services to search and display videos from the YouTube platform.
    • When using features connected with YouTube API Services, the Google Privacy Policy also applies.

III. Website Analytics, App Usage and Problem Reports

  1. The website is measured with our own simple tool without cookies and without identifying visitors. We record which page you opened, the domain you came from, campaign parameters in the link (utm), the website language, the rough device type (phone, tablet, computer), whether you saw the pricing and whether you clicked to open the songbook or download the app. Nothing is stored in your browser, individual visits are not linked together and IP addresses are not stored with the records. If Do Not Track or Global Privacy Control is enabled in your browser, we measure nothing. The data stays on our server in the EU.
  2. Use of the application is also measured with our own tool on our server in the EU, without any other processors. We record which features are used (for example opening a song, transposing, creating a playlist, playing time), the app version, device type, system version and application errors. The records are linked to an internal account identifier, not to your email or name, and we do not share them with anyone. They help us know what to fix and improve in the app. We process them based on legitimate interest under Article 6(1)(f) GDPR. You can turn the measurement off at any time in the app Settings. We keep the records for 24 months, after that only aggregate numbers without any link to an account remain. When you delete your account, the records are deleted.
  3. Problem reports. When you send us a problem report from the app, technical data needed to find the issue is sent with it: app version, device and system, the last few steps in the app, codes of recent errors and a screenshot if you attach one. Otherwise the record of recent steps is kept only on your device and leaves it only with a report you send yourself. We use the report only to solve the problem and keep it for 12 months.

IV. Data Processing Based on Your Consent

  1. We may further process your data mentioned above when you give us voluntary and informed consent within the meaning of Article 6(1)(a) GDPR. Using the application is never conditional on providing consent. However, it is advisable to give consent at least for processing data directly related to the application's operation.
  2. Consent in the application most often takes the form of a checkbox, email, or you grant it to us through an active step required in the email (clicking a button).
  3. You can grant us consent for different purposes individually each time.
  4. We may process personal data based on consent for the duration of service provision, i.e., for the duration of the user account existence. The processing period may be shorter if you withdraw consent.

V. Withdrawal of Consent

  1. You can withdraw consent for processing personal data according to the previous paragraph at any time in your user account (in user settings) or by sending a request to [email protected].
  2. If you do not want to receive emails from mangosongbook.com, you can always unsubscribe by clicking in the footer of each email. Unfortunately, this is not possible for emails that are necessary for the application's operation (e.g., password reset).
  3. Unsubscribing from the newsletter is always considered as withdrawal of consent within the meaning of Article 7(3) GDPR or filing an objection according to Article 21 GDPR in case of emails through which we inform you about related services and products of mangosongbook.com.
  4. Consent granted according to the above paragraphs also applies to companies appointed as processors.

VI. Data Processing Agreement

  1. The user always enters into a gratuitous personal data processing agreement with the company, the content of which is determined by the following provisions, according to Article 28(3) GDPR.
  2. Users provide the application with the following personal data: email (login to the application), optionally also first or last name, in case of purchase billing data necessary for issuing a tax document.
  3. The company undertakes to process personal data exclusively for the purpose of storing and ensuring data transfer to storage and based on user instructions.
  4. The company has an obligation to establish a sub-processor relationship and appoint Google, or other sub-processors, if necessary for the application's functionality.
  5. The company will ensure the functionality and operation of the application, undertakes its regular maintenance and makes it available to the user.
  6. Maintenance and service of the application performed by the company are purely incidental, consisting of the need to fix errors and maintain systems.
  7. The user agrees to the use of additional processors, especially Google, whose processing consists of storing data on cloud servers, and self-employed persons, if necessary for security or ensuring application functionality. No additional processor will be involved in processing without user consent or without concluding a contract that binds the sub-processor to substantially similar obligations regarding personal data processing to which the company is bound.
  8. If the company intends to involve another processor in processing, the company is obliged to inform the user. All instructions for additional processors will be in accordance with personal data protection legislation. The company will always ensure appropriate selection of processors.
  9. The company undertakes to ensure that additional processors or persons participating in processing on behalf of the company always meet a high standard of trust, primarily by concluding a confidentiality agreement.
  10. The company undertakes to secure personal data in accordance with Article 32 GDPR. The parties declare that as of the date of contract conclusion, the company has adopted technical measures ensuring personal data security by encrypting data transmission using HTTPS protocol.
  11. The user acknowledges that they have full control and responsibility for data they enter into the application. The requirement for accuracy, adequacy, time limitation, and minimization of stored data must be fulfilled by the user. If the user performs data deletion, these are deleted. The company does not make copies or otherwise backup user data, nor does it interfere with data transfer between the user and Google.
  12. The parties are obliged to provide mutual cooperation in case of suspicion of misuse of data subjects' personal data. The parties will make maximum effort and take such measures to prevent the risk of personal data misuse.
  13. Upon termination of this agreement, i.e., upon user account termination, all entered data will be destroyed within 7 days. The user always has the option to export stored data and save it to their own storage to prevent irreversible loss of entered data. Neither the company nor appointed processors are responsible to the user for damage caused by loss of data entered into the application, after 7 days from user account termination.
  14. This agreement also includes the provisions of the Privacy Policy that follow.

VII. Additional Provisions on Personal Data Protection

  1. We do not process personal data of children or special categories of personal data, so-called sensitive personal data, within the meaning of Article 9 GDPR.
  2. Processors that we appoint for processing must meet a high standard of protection and will always handle data within the limits of these principles.
  3. We collect technical data about devices and about the use of the website and the application only to the extent described in Section III.
  4. After termination of service provision or cessation of the reason for data processing, we will destroy personal data.
  5. We will always make maximum effort to prevent unauthorized processing of personal data by other persons, however, we are not responsible to the user or other data subjects for damage caused by unauthorized processing of personal data by a third party.
  6. Application data is stored in the EU: in Google data centers in Germany and on our server in the EU. Some processors (especially Twilio SendGrid, Meta, Apple and Google for sign-in) may also process data in the USA. Such transfers are governed by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission. Data entered by users is not duplicated, checked or modified.
  7. Emails that we will send to you are not considered by us or you as unsolicited commercial communication within the meaning of Act No. 40/1995 on advertising and Act No. 480/2004 on certain information society services.
  8. In case we learn of a security risk related to personal data, we will notify you without undue delay.
  9. We undertake that in case of damage related to personal data breach or other circumstances that lead to damage, we will provide the user with cooperation and legal assistance in claiming compensation from responsible processors. However, the company itself is not responsible for errors of processors appointed by it.
  10. You confirm to us that the provided personal data is true, accurate and relates exclusively to you or that you have provided data whose use did not interfere with the rights of third parties. Always notify us of changes in personal data so that only current and complete data is processed, either at our request or without request. If we ask you to do so, always provide us with current and truthful data.
  11. Personal data will be processed in electronic form in a non-automated manner. Anonymized personal data may also be processed automatically. Data subjects will not be subject to individual automated decision-making within the meaning of Article 22 GDPR.

VIII. Support in Handling Personal Data

  1. If you believe that we are processing your personal data in violation of the protection of your private and personal life or in violation of the law, especially if personal data is inaccurate with regard to the purpose of their processing, you can always request an explanation from us at [email protected], file an objection against processing for legitimate interest purposes by email to [email protected], or request information about the scope or method of processing your personal data. We will provide you with the data within an adequate period (max. 30 days). You can also contact the data protection authority directly.

IX. Final Provisions

  1. All private law relationships arising from or in connection with personal data processing are governed by the legal system of the Czech Republic, regardless of where access to them was realized. Czech courts, which will apply Czech law, are competent to resolve any disputes arising in connection with privacy protection between the user and the company.
  2. These Privacy Policy terms take effect on March 1, 2019. Last updated: October 7, 2026 (list of processors, website and app analytics, problem reports).