top of page

PRIvacy policy

This Privacy Policy describes how HarmoniqSuite ("we," "us," or "our") collects, uses, stores, and protects information when you use Harmoniq, our orchestra management platform. By using Harmoniq you agree to the practices described here.

1. Who We Are

Harmoniq is operated by HarmoniqSuite. If you have questions about this policy or how your data is handled, contact your organization's administrator or reach us through the platform.

2. Information We Collect

We collect only the information necessary to operate the platform:

  • Account information — your name, email address, and contact details, provided when an administrator creates your account.

  • Usage data — performance metrics and device/browser statistics used solely to maintain and improve the platform. This data is never used for advertising or behavioral profiling.

  • OAuth credentials — if an administrator connects a Google or Microsoft email account, we store encrypted OAuth tokens as described in Section 4.

3. How We Use Your Information

Information collected is used exclusively to:

  • Operate and maintain the Harmoniq platform.

  • Allow authorized administrators to manage orchestra operations and communicate with ensemble members.

  • Send announcements on behalf of administrators who have connected an email account.

  • Improve platform performance and reliability.

We do not sell your personal information. We do not share your information with third parties for marketing or commercial purposes.

4. Google and Microsoft Email Integration

Administrators may optionally connect a Google Workspace (Gmail) or Microsoft 365 (Outlook) account to send orchestra announcements directly from their own email address. This feature is voluntary and administrator-only. Regular ensemble members are never asked to connect an email account.

What we access

  • Your email address — read once at connection time to display which account is linked in the Settings page. We request this via Google's userinfo.email scope or Microsoft's User.Read permission.

  • Email sending — we request permission to send email on your behalf via the Gmail API (gmail.send scope) or Microsoft Graph API (Mail.Send permission). This permission is used only to deliver announcements you explicitly compose and send within Harmoniq.

What we do not access

  • We do not read, index, or store the contents of your inbox or any received mail.

  • We do not access your contacts, calendar, files, or any other account data beyond what is listed above.

How we store your credentials

OAuth access and refresh tokens issued by Google or Microsoft are encrypted using AES-256-GCM before being written to our database. They are never logged, displayed in plaintext, or shared with any third party. They are used solely to send announcements on your behalf and to automatically refresh your session when the access token expires.

Revoking access

You may disconnect your email account at any time from the Settings page within Harmoniq. You may also revoke Harmoniq's access directly from your provider:

Revoking access through either method immediately stops Harmoniq from sending email on your behalf. Any stored tokens are deactivated in our system when you disconnect.

Use of Google user data

Harmoniq's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to send announcements you initiate within Harmoniq and is never used for advertising, transferred to third parties, or used for any purpose unrelated to this feature.

5. Data Storage and Security

Your data is stored in a secure database accessible only to HarmoniqSuiteand the administrators of your organization. We apply industry-standard security measures including encryption at rest and in transit. No security system is impenetrable; in the event of a breach affecting your data we will notify affected users as required by applicable law.

6. Data Retention

We retain your account information for as long as your account is active. OAuth tokens are retained until you disconnect the email integration or your account is deleted. You may request deletion of your account and associated data by contacting your administrator.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes — particularly to how we access or use Google or Microsoft user data — we will notify administrators before the changes take effect. The effective date at the top of this page will always reflect the most recent revision. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

8. Contact

If you have questions about this Privacy Policy or how your data is handled, please contact your organization's administrator or reach us through the platform.

bottom of page