Privacy policy

The data controller is Duepuntodue S.r.l.s. (DUEPUNTODUE SOUND & LIGHT SERVICE), registered office Via degli Aceri 5, 00062 Bracciano (RM), Italy, VAT number 17494501004.

SoundImplosion is the rehearsal room of Duepuntodue S.r.l.s., at Via delle Palme, 5 - Bracciano, RM 00062, phone +39 379 209 3805.

For any privacy request, write to info@soundimplosion.it.

We only process the data needed to run your account and bookings:

• Account: email and username. Your password is handled by Firebase Authentication: the site never sees or stores it. If you sign in with Google, Google gives us your email and the basic data of your Google profile (name and photo), which stay in Firebase Authentication.
• Bookings: date and time, number of people, equipment notes, linked group and request status.
• Groups: name, description, notes, members and invites.
• Notifications: the messages you find in your personal area, such as request outcomes and invites. Booking notices also reach you by email, in the language you pick in your profile, where you can also turn them off.
• Musician profile: city, instruments and bio, only if you fill them in.
• People who book by phone or in person: if they are not registered yet, the managers enter their name by hand and, if they give them, email, phone and a note. If the person signs up, this data is linked to their account.

• Account, bookings, groups and notifications, by email too: needed to provide the service you ask for. The legal basis is the contract (GDPR art. 6.1.b).
• Security and abuse prevention: the controller's legitimate interest (GDPR art. 6.1.f).
• Legal obligations, including tax ones, where they apply: GDPR art. 6.1.c.

We do not use your data for advertising or profiling, and we do not sell it to anyone.

• The room's managers: they see bookings and the data needed to manage them.
• Other registered users: they can see your username and, if you filled them in, the city, instruments and bio of your musician profile.
• Members of your groups: they see the other members' usernames and the bookings made for the group.

Visitors who are not signed in only see whether a time is free or booked, never who booked it.

The site runs on Firebase, a Google service (Google Ireland Limited and Google LLC), which processes data on our behalf as a processor: website hosting, authentication, database and server functions.

The database and the functions are in the European Union (europe-west1, Belgium). Firebase Authentication data may also be processed outside the EU: in that case Google relies on the EU–US Data Privacy Framework and on the Standard Contractual Clauses approved by the European Commission.

The site's emails (booking notices and the confirmation that an account was deleted) are sent from the mailbox no-reply@soundimplosion.it of IONOS SE (Germany, EU), which processes them on our behalf as a processor. Replies go to info@soundimplosion.it.

The emails to confirm your address, reset your password or change your email come from the same mailbox too; the code in the link is generated by Firebase Authentication. To limit abuse we keep, for each address we send them to, a fingerprint (hash) of the address, not the address itself, with the time and number of the latest sends; we delete it with the account. Only the notice to your old address after an email change is sent by Firebase Authentication itself.

Firebase Hosting server logs (IP address and browser) are kept by the provider for security.

The site uses no analytics, advertising or profiling cookies. The fonts are hosted on the site itself: no request goes to Google Fonts.

In your browser we only store what the site needs to work:

• si_prefs (localStorage): theme and accessibility settings.
• si.in (localStorage): remembers whether you were signed in last time, to show the right button in the menu. It is not used to sign you in.
• si.a.* (sessionStorage): the listening settings of the instrument on the home page. They are cleared when you close the tab.
• Firebase Authentication (IndexedDB): keeps you signed in until you sign out.

These are technical tools the service needs, so we do not ask for your consent.

• Account and profile: as long as the account exists.
• Bookings: as long as the account exists. After the deletion we keep them only in anonymous form (date, time, number of people and status, plus the group's name if it was a group rehearsal), which no longer identifies you.
• Data the managers enter for people who book by phone or in person: until it is linked to an account or deleted by the managers. Here too the bookings stay only in anonymous form.
• Billing data: if we ever collect it, we will keep it for 18 months. The site collects none today.

You can delete your account yourself in your profile (Delete account), or write to info@soundimplosion.it. With the account we delete your profile and notifications, and remove you from your groups. The groups you own pass to their longest-standing member; we delete them only if you are the last member. Your bookings stay in the room's records only in anonymous form, without your name or the equipment notes, and the future ones are cancelled. We then send you a confirmation email.

Under articles 15–22 of the GDPR you can ask to access your data, correct it, erase it, restrict its processing, receive it in a portable format and object to its processing.

You can change your username, email, password, musician profile and email notifications yourself in your profile, where you can also delete your account. For anything else, write to info@soundimplosion.it.

If you believe the processing breaks the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

The service is meant for people aged 14 or over, the age of digital consent in Italy. Anyone under 14 may only use it with the consent of a parent or guardian.

If we change this policy, we update the date at the top of the page.