Privacy Policy

This legal document is available in English only.

Effective Date: August 14, 2026 · Last Updated: August 14, 2026

This Privacy Policy explains how Yanoma LLC collects, uses, shares, and protects your information across Cántico (parish music ministry), Cántico Academy (independent teachers), and Cántico School (K-8 institutions). Cántico School serves minors; if you are a parent, guardian, or school, please read Section 8 (Children's Privacy) carefully.

1. Who We Are (Data Controller)

Yanoma LLC ("Yanoma," "Cántico," "we," "us") is the company that develops and operates the Cántico platform and is the controller of personal data processed through the Services, except where Yanoma LLC acts as a processor on behalf of a contracting institution (see Section 8). For privacy questions or to exercise your rights, contact us at privacy@cantico.io.

2. Information We Collect

2.1 Information you provide

• Account data: name, email, password (hashed), role, and the organization (parish, academy, or school) you belong to.
• Profile and ministry data: voice part, instrument, availability, attendance and RSVP responses.
• Content you upload: scores, recordings of your voice, comments, forum posts, and course materials.
• Payment data: processed securely by Stripe. Cantico does not store full card numbers.
• Communications: messages you send us or through the platform.

2.2 Information collected automatically

• Usage data: pages viewed, features used, practice logs, and progress within courses and study plans.
• Device and log data: IP address, browser type, and timestamps, used for security and to prevent abuse.
• Cookies and similar technologies: strictly necessary cookies (session/auth) always run; non-essential cookies (analytics, attribution) run only with your consent where required (see Section 7).

3. How We Use Your Information

• Provide, operate, and secure the Services (authentication, multi-tenant data isolation).
• Enable ministry and education features: events, practice tracking, gamification, study plans, and progress reports to directors, teachers, and — for minors — parents/guardians.
• Process payments and manage subscriptions through Stripe.
• Send transactional emails (invitations, notifications) and, where you opt in, reminders.
• Improve the Services and understand usage in aggregate.
• Comply with legal obligations and enforce our Terms.

Legal bases under GDPR: performance of a contract (providing the Services), your consent (non-essential cookies, optional recordings), our legitimate interests (security, product improvement), and legal obligation. You may withdraw consent at any time without affecting prior processing.

4. How We Share Information

We do not sell your personal information. We share it only with: (a) other members of your organization as required by the features you use (e.g., a director sees their choir's attendance; a parent sees their child's progress); (b) service providers acting as our processors under contract (Stripe for payments, our hosting and email providers); and (c) authorities when required by law. Within your organization, access is limited by role, and the orgGuard control prevents access across organizations.

5. Data Retention

We keep personal data for as long as your account is active or as needed to provide the Services, and thereafter only as required for legitimate business or legal purposes (e.g., financial records). When you delete your account (see Section 6), we delete or anonymize your personal data, subject to any legally required retention periods.

6. Your Rights and Choices

Depending on where you live, you have rights over your personal data. We honor these rights for all users regardless of location.

6.1 EU/EEA/UK (GDPR)

• Access and portability: request a copy of your data (Settings → Export my data).
• Rectification: correct inaccurate data in your profile.
• Erasure ('right to be forgotten'): delete your account and data (Settings → Delete account).
• Restriction and objection: limit or object to certain processing.
• Withdraw consent: for anything based on consent, at any time.
• Lodge a complaint with your local supervisory authority.

6.2 California (CCPA/CPRA)

California residents have the right to know, access, correct, delete, and opt out of the sale or sharing of personal information. Yanoma LLC does not sell personal information. To exercise these rights, use the in-app controls or email privacy@cantico.io. We will not discriminate against you for exercising your rights.

To exercise any right, use Settings → Export my data / Delete account, or contact privacy@cantico.io. We may need to verify your identity before acting on a request.

7. Cookies and Tracking

We use strictly necessary cookies to keep you signed in and to secure the platform; these are always active. Where required by law (e.g., in the EU/EEA/UK), we ask for your consent before using non-essential cookies such as analytics or marketing attribution, and you can change your choice at any time via the cookie settings.

8. Children's Privacy (COPPA and Minors)

Cántico School and, in some cases, Cántico Academy serve students under the age of 13. In these institutional deployments, Yanoma LLC acts as a data processor (a 'school official' under FERPA where applicable) on behalf of the contracting school or academy, which is responsible for obtaining verifiable parental consent under the Children's Online Privacy Protection Act (COPPA) and equivalent laws.

• We collect from students only the data needed for the educational service: name, class/section, progress, and — only where enabled by the institution and consented to — voice recordings for the parent Achievements Folder.
• We do not use students' personal information for advertising or sell it.
• Parents/guardians may review their child's information, request deletion, and refuse further collection by contacting their school or academy, or Yanoma LLC at privacy@cantico.io.
• The Achievements Folder and any student voice recordings are governed by the institution's parental consent; the institution controls whether recording is available to a given student.

Outside of an institutional agreement, the Services are not directed to children under 13, and we do not knowingly collect their data without verifiable parental consent. If you believe a child has provided us data without consent, contact privacy@cantico.io and we will delete it.

9. Data Security

We use technical and organizational measures appropriate to the risk, including hashed passwords, encryption in transit, role-based access control, and multi-tenant isolation between organizations. No system is perfectly secure; we cannot guarantee absolute security.

10. International Transfers

Yanoma LLC operates from the United States. If you access the Services from outside the U.S., your data may be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

11. Changes to This Policy

We may update this Policy from time to time. We will post the new version with an updated 'Last Updated' date and, for material changes, provide notice within the Services. Your continued use after changes take effect constitutes acceptance.

12. Contact Us

For any privacy question or to exercise your rights, contact us at privacy@cantico.io. Yanoma LLC Cántico Website: cantico.io