Privacy Policy
Concertmaster is an orchestra management platform operated by Alto Labs LLP (Singapore). It helps orchestra managers and fixers run their rosters: keeping track of musicians, instruments, and availability, and handling the messages and routines that go with every season. This policy explains, in plain language, what personal data we collect, why we collect it, and the choices you have.
Who this policy covers
Two groups of people interact with Concertmaster, and the policy treats them differently:
- Orchestra managers and staff: the people who create an account and use Concertmaster directly.
- Musicians: people whose details an orchestra keeps in its roster. If you are a musician, your orchestra (not Concertmaster) decides what is stored about you and why; we process that data on the orchestra's behalf and on its instructions.
What we collect
- Account data. When a manager signs up we collect their name and email address, used to create and secure their account.
- Roster data. Orchestras store information about their musicians in Concertmaster: names, phone numbers, email addresses, instruments, and availability.
- WhatsApp messages. If an orchestra connects its WhatsApp number to Concertmaster, the messages sent and received through that number are processed and stored by us. See the WhatsApp section below.
- Usage analytics. We use PostHog to understand how managers use the app, such as which pages are visited and which features are used, so we can improve it. Analytics is tied to manager accounts, not to musicians.
- Payment and fee data (future). Concertmaster does not handle payments today. If we add features for managing musician fees or payroll, we will update this policy before they launch.
Why we collect it
We use personal data only to provide and improve Concertmaster:
- to operate the product: rosters, scheduling, messaging, and workflow automation;
- to secure accounts and prevent abuse;
- to communicate with our customers about the service;
- to understand usage so we can fix problems and improve the product.
We do not use your data for advertising, and we never sell it.
WhatsApp messaging
Orchestras can connect a WhatsApp number to Concertmaster. When they do, Concertmaster sends and receives WhatsApp messages on the orchestra's behalf through the Meta WhatsApp Business Platform. Messages exchanged with that number, such as availability requests and replies, are transmitted by Meta and are processed and stored by Concertmaster to provide the orchestra's shared team inbox and to run its messaging workflows.
Meta acts as the messaging carrier for these conversations and handles them in accordance with its own terms and the WhatsApp Business data processing terms. Concertmaster does not use message content for advertising or for any purpose other than providing the service to the orchestra.
If you are a musician and you do not want to receive messages from your orchestra through Concertmaster, you can opt out at any time by contacting your orchestra manager and asking them to stop messaging you via the platform.
Who we share data with
We share personal data only with the service providers we rely on to run Concertmaster: trusted cloud providers that host our application, database, and website, Meta for WhatsApp message delivery, and PostHog for product analytics. Each provider processes data only as needed to provide its service to us. We do not sell personal data, and we do not share it with third parties for their own marketing.
We may also disclose data if required by law, or as part of a merger or acquisition, in which case this policy would continue to apply to the data transferred.
How long we keep data
We keep personal data for as long as the orchestra's account is active and it is needed to provide the service. When an orchestra deletes roster data, or closes its account, we delete the associated personal data within a reasonable period, except where we are legally required to keep it longer. Backups are retained on a rolling basis and expire automatically.
How we protect data
Concertmaster is hosted with trusted cloud infrastructure providers. Data is encrypted in transit, access is restricted to the orchestra it belongs to (enforced at the database level), and access by our team is limited to what is needed to operate and support the service.
Your rights
You can ask to access, correct, or delete personal data we hold about you.
- Managers can update their account details in the app, or contact us at [email protected] for anything else.
- Musicians should contact their orchestra manager first, since the orchestra controls what is stored in its roster. You can also contact us directly and we will work with the orchestra to resolve your request.
Singapore PDPA
Alto Labs LLP, the operator of Concertmaster, complies with the Singapore Personal Data Protection Act 2012 (PDPA). We collect, use, and disclose personal data only for the purposes described in this policy, we protect it with reasonable security arrangements, and we do not keep it longer than needed. If you have a question or complaint about how your personal data is handled, you can reach our Data Protection Officer at [email protected]. We will respond to access and correction requests within the timelines the PDPA sets out.
Children and young musicians
Concertmaster accounts are for adults: orchestra managers and staff. However, an orchestra's roster may include musicians who are minors, for example in youth orchestras. That roster data is collected and controlled by the orchestra, and the orchestra is responsible for ensuring it has the appropriate consent, from a parent or guardian where the musician is too young to consent for themselves, before storing a young musician's details or messaging them through Concertmaster. We process that data only on the orchestra's behalf. If you are a parent or guardian with questions about your child's data, contact the orchestra first, or reach us at [email protected] and we will work with the orchestra to resolve it.
Changes to this policy
If we change this policy, we will update this page and the "Last updated" date above. For significant changes, such as beginning to handle payment data, we will notify our customers directly.
Contact
Questions about this policy or your data? Email us at [email protected].