Privacy Policy | Guitar Citadel

Seth Baccus Guitars Ltd (trading as The Guitar Citadel) is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

01 Data Controller

Seth Baccus Guitars Ltd (trading as The Guitar Citadel) is the data controller responsible for your personal data.

11a Kimberley Park Road, Falmouth, Cornwall, TR11 2DA, United Kingdom
Company Number: 11239391
Contact: privacy@guitarcitadel.com

02 Information We Collect

Identity data: name, username
Contact data: email address
Profile and content data: uploaded images, instrument records, notes, and related content
Technical data: IP address, device identifiers, browser type, operating system
Usage data: features used and interactions within the app
Location data: the town, region and country you enter for a professional profile. If you allow it, the app uses your device's location on your device to show distances; it is not stored or shared
Subscription and transaction data: plan, status, renewal dates, transaction identifiers, price, currency and App Store country, received from Apple through RevenueCat. We never receive your card details
Notification data: if you allow push notifications, a device token that lets us send them
Communications: contact requests initiated via the Service, sale enquiries and messages sent through our contact form
Mailing-list data: if you sign up for updates, your email address and, if you choose to give them, your first name, region and interests

03 How We Use Your Data

create and manage your account;
operate and deliver the Service;
process subscriptions and payments;
enable sharing, transfer, and contact request features;
improve platform functionality;
maintain security and prevent fraud;
comply with legal obligations;
send notifications you have allowed, such as transfer requests, sale enquiries and new followers;
communicate service updates where permitted;
send launch news and updates, if you have signed up for them.

04 Legal Basis for Processing (UK GDPR)

Contract: processing necessary to perform our contract with you
Legitimate interests: improving the Service, including app usage analytics, which you can switch off; maintaining security
Legal obligation: compliance with applicable law
Consent: website analytics cookies, push notifications and our mailing list; you may withdraw consent at any time without affecting prior processing

05 Cookies and Analytics

With your consent, this website uses Google Analytics 4, provided by Google, to understand visits and improve the website. It collects information such as pages viewed, approximate location and browser or device information. Google receives technical information, including your IP address, when your browser connects to its service.

Analytics is optional. We do not load Google Analytics or send it requests unless you accept analytics cookies. You can reject analytics and continue using the website. Authentication, password-reset and shared-gear pages are not tracked.

Google Analytics uses _ga and _ga_* cookies to distinguish visitors and sessions. We configure these cookies to last up to 180 days. Advertising features and Google signals are disabled. We exclude URL query strings and fragments from the page addresses we send.

Your choice is stored in your browser’s local storage under gc-cookie-consent for 180 days. This storage is used to remember your privacy preference. Use in the footer to change your choice or withdraw consent. Withdrawal stops future analytics collection and removes accessible Google Analytics cookies set on this website; it does not delete data already collected.

Google may process analytics information outside the UK. Read Google’s Privacy Policy for information about its processing and international safeguards.

After you send a message through our contact form, your browser also stores the time it was sent so the form is not sent twice by mistake.

Versions of the app that include usage analytics use Google Analytics for Firebase, provided by Google, to understand how the app is used. It records the screens you view and actions such as adding gear, following a member or sending an enquiry, along with device, app version and approximate location information. It does not record your name, email address or the content you enter, and we do not link it to your account.

App analytics is switched on by default. You can turn it off at any time in the app under Menu, Device Options, Share usage analytics.

The app does not use advertising identifiers or advertising tracking, and does not ask for permission to track you across other apps.

The app stores your sign-in session, settings and a working copy of your records on your device so it can work. This is needed for the app to function.

Versions of the app that support push notifications ask for your permission first. If you allow them, your device token is stored with your account and used through Google Firebase Cloud Messaging and, on iPhone, Apple Push Notification service to send alerts about transfers, sale enquiries, new followers and verification decisions. The notification text passes through these services. You can turn notifications off in your device settings, and the token is removed when you sign out.

06 Sharing of Data

We do not sell your personal data. We share data only with the service providers that run the Service for us, and only what each needs:

Supabase (database, file storage and sign-in, hosted in Ireland): your account and everything you store in the app;
Apple: Sign in with Apple, if you choose it; App Store purchases; and push notifications on iPhone;
Google: Google sign-in, if you choose it; website analytics, with your consent; app usage analytics and push notifications through Firebase (see section 05);
RevenueCat: manages App Store subscriptions, linked to your account ID rather than your name or email;
Resend: sending service emails, such as transfer invitations, sale enquiries and maker verification decisions;
MailerLite: our launch updates and dealer waiting list, when you sign up to them;
Google Gemini: the gear type, brand, model and year you ask Auto-fill to look up (no personal details);
OpenStreetMap: map images, and finding the town or region you enter for a professional profile;
Google Fonts: the app downloads its typefaces from Google, which sees your device's IP address;
Web3Forms: messages sent through our website contact form;
Krystal: website hosting and our email;
legal or regulatory authorities where required by law;
professional advisers under duties of confidentiality.

All third-party processors are contractually required to handle your data in accordance with applicable law.

We also share some information with other members when you use features that involve them. When you send a sale enquiry, the owner receives your username and the email address on your account so they can reply to you. The app tells you this before you send it.

07 Public Content

Information you choose to make public may be visible to other users or accessible externally. Guitar Citadel cannot guarantee complete removal from third-party systems that may have accessed that content.

08 International Transfers

The app's data is stored by Supabase in the European Union (Ireland). Some of our providers, including Apple, Google, RevenueCat and Resend, process data in the United States.

Where personal data is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including standard contractual clauses or adequacy decisions where applicable.

09 Data Retention

We retain personal data only for as long as reasonably necessary to provide the Service, comply with legal obligations, and resolve disputes. You may request deletion of your data at any time, subject to legal retention obligations.

You can delete your account in the app under Menu, Account, Delete Account. Deletion is immediate and permanent. It removes your profile, the gear you own with its photos and documents, and your collections, rigs, follows and likes. Deleting your account does not cancel an App Store subscription, which you manage through Apple.

Some records are kept after deletion. On instruments now owned by someone else, your place in the ownership history remains as "Private Member", without your name, prices or notes, and care entries you wrote stay with the instrument without your name. Certificates a maker has issued remain valid. We keep subscription records received from Apple for our accounts.

You stay on our mailing list until you unsubscribe, using the link in any email or by contacting us.

10 Your Rights

Subject to applicable law, you have the right to:

access the personal data we hold about you;
request correction of inaccurate data;
request deletion of your data;
restrict or object to processing in certain circumstances;
data portability;
withdraw consent at any time.

To exercise your rights: privacy@guitarcitadel.com

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully.

11 Security

We implement commercially reasonable technical and organisational measures to protect your data. Data is encrypted in transit, private files such as receipts and documents can only be opened by their owner, and location data is removed from photos before they are uploaded. No online system can be guaranteed 100% secure. Guitar Citadel shall not be liable for any unauthorised access to or loss of your data that occurs despite these measures, except to the extent required by law.

12 Children

The Service is not intended for persons under 18. We do not knowingly collect personal data from children and will delete it promptly if discovered.

13 Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes prior to them taking effect. Continued use of the Service constitutes acceptance.

14 Contact

Privacy enquiries: privacy@guitarcitadel.com