Privacy Policy
Version of October 18, 2026.
This policy explains what data we process, what for, who we share it with and what rights you have when you use the goditi.io website or the GODITI app (iOS and Android). We’ve written it in plain language on purpose. If anything isn’t clear, email us at admin@goditi.io.
The essentials in six sentences
- GODITI records the concert on behalf of the organizer. You mark the moment you want in the app and we deliver that part of the video to you. You don’t record anything.
- You can use the app without an account. You only need your name and email when you want to view and download your videos.
- We don’t sell your data. There’s no advertising and no tracking across apps.
- The event organizer sees overall figures (how many people got in, how many videos were downloaded), not your name or your email.
- App data is stored on servers in the European Union. Some providers (email, notifications, sign-in and, if you accept statistics cookies, Google Analytics) are in the United States or may process data there, with the safeguards we explain in section 6.
- You can delete your account from the app in two taps. What identifies you is deleted; the event video still belongs to the event.
1. Who the controller is
- Controller: GODITI PRODUCTIONS SL, NIF (tax ID) B22659833.
- Address: Calle Torre de los Siete Suelos 9, Esc. 1, 1.º A, 18008 Granada, Spain.
- Email for anything to do with your data: admin@goditi.io.
- We are not required to have a data protection officer. Your requests are handled by the company’s management.
2. What this policy covers
- The goditi.io website: information pages and a contact form. The website has no user accounts and no shop. It includes the short addresses we use in the QR codes at the entrance (goditi.io/e/…) and in the survey links we send by email (go.goditi.io/e/…).
- The GODITI app: used by people attending an event recorded by GODITI to mark their favorite moments and receive the video of that song.
The dashboard used by our team, door staff and organizers (GODITI Crew) has its own terms. Here we only explain what they can see about you through it (section 6).
3. What data we process
3.1 On the website
- Contact form: your name, email address and the message you write. It is only sent if you tick the box confirming you have read this policy. The message reaches us by email and is stored in the website’s content management system.
- News: if you tick the optional “I want to receive news” box, we use your email to send you GODITI news until you unsubscribe.
- Server logs: IP address, date and time, and the page requested. The hosting provider keeps them for security.
- Cookies: the website uses its own technical storage and, only if you accept them, Google Analytics statistics cookies. We explain this in the cookie policy.
- Visit statistics: if you accept statistics cookies, Google Analytics collects how you use the website: the pages you view and what you do on them (time, scrolling, clicks on external links, downloads), where you came from, your device type, browser and language, and your approximate country or city, with an identifier stored in the cookie. Google receives your IP address to work out your country or city and discards it without storing it. We don’t turn on Google Signals or the options to share data with Google, so this data isn’t used for advertising. If you don’t accept the cookies, Google Analytics doesn’t load and none of this is collected. We also count visits per page with Koko Analytics, a tool installed on the website itself that doesn’t use cookies, doesn’t store your IP address and only adds up visits; those counts don’t leave the website’s server.
3.2 In the app
Only the event code and, to view and download your videos, your name and email are required. Without the code you can’t enter the event; without your name and email we can’t deliver your videos. Everything else is optional.
- Event access. The event code, which you get by scanning the QR code at the entrance or typing the code you were given. We record that you have entered that event, how you got in (QR code at the venue, code at the venue or code entered remotely) and, where applicable, an internal identifier for the door staff member who gave you access. That identifier helps us see which access points work best.
- Guest without an account. Until you sign up, the app creates a guest account with a random identifier generated on your phone. It doesn’t carry your name or email. If you later create an account or sign in to one you already had, your moments, your event access and your notifications move to it and the guest account is deactivated.
- Account. Name, email address and, if you choose a password, the password (stored as a bcrypt hash, not in plain text). If you sign in with Google or Apple, we receive from them your name, your email (or the relay address Apple creates if you choose to hide yours) and a provider identifier. We don’t receive your Google or Apple password.
- Profile picture. Only if you decide to upload one. To choose it, the app asks for access to your photo library.
- Moments. Each time you tap to save a moment, we record the event, the camera you chose and the exact time of your tap. We use that to find the part of the video that matches that song.
- Videos. The video you receive is recorded by the GODITI team. We count how many times you play and download each video and when you first did so, so we know which videos have reached you and which haven’t. To save the video to your phone, the app asks for permission to add it to your photo library.
- Notifications. If you agree to receive notifications, we store your device’s notification token, its operating system (iOS or Android) and your preferences: “Video ready” and “Event start” notifications. On iOS, during the event, the app may show a Live Activity on the Lock Screen with the name of the event and the venue; the app sends our server that activity’s token, which we currently neither store nor use.
- Language. The app is shown in your phone’s language. We don’t store that information on our server.
- Surveys. After the event we may ask for your feedback with a notification in the app and, at most, one reminder email. The questions are written by the organizer or by GODITI. If you answer, your answers (ratings, choices and, if any, free text) are linked to your account, the event, the way you got in and the door staff member’s identifier. Answering is voluntary.
- Camera. The app asks for camera permission only to read the QR code. It doesn’t record or store images or sound.
- Android: installing from the QR code. If you install the app from the QR code at the door, Google Play passes back to us the event code and the door staff member’s identifier you installed with, so you can go straight in without scanning again.
- Technical data. Your IP address is used temporarily, in memory, to limit abuse; we don’t store it in the database. The server’s technical logs may contain your IP address, the date and the path requested and, when you sign in with Google, your email. The app contains no third-party analytics or crash-reporting tools, doesn’t ask for your location or your contacts and doesn’t use advertising identifiers. On Android, the QR code reader runs on Google ML Kit: the camera image is processed on the phone itself and never leaves it, but ML Kit sends Google technical data about the device and the app (model, operating system and app version, an installation identifier, and the reader’s performance and errors) for diagnostics and to improve the service.
4. What we use your data for, on what legal basis and for how long
| What for | What data | Legal basis | How long |
|---|---|---|---|
| Replying to your message from the website form | Name, email, message | Steps taken at your request before entering into a contract (art. 6.1.b GDPR) | For as long as the conversation lasts and the time needed to deal with it |
| Sending you GODITI news | Consent (optional box; art. 6.1.a GDPR and art. 21 LSSI) | Until you unsubscribe | |
| Finding out how many people visit the website and which pages they view (Google Analytics) | Pages viewed and what you do on them, where the visit came from, device, browser and language, approximate location and the cookie identifier | Consent, when you accept statistics cookies (art. 6.1.a GDPR and art. 22.2 LSSI) | Details of each visit, 2 months; data linked to the cookie identifier, 14 months from your last visit; after that, only overall figures remain. The cookies, 2 years from your last visit |
| Counting visits per page of the website (Koko Analytics) | Page visited and referring website, with no cookies or IP address | Legitimate interest in knowing which website content people are interested in (art. 6.1.f GDPR) | Overall counts with no personal data; deleted after 25 months |
| Letting you into the event, creating your account, saving your moments, matching them with the video, delivering it to you, enabling the download and counting plays and downloads to know which videos you have received | Event code, access method, account, moments, play and download counts | Performance of the contract you accept when you use the app (art. 6.1.b GDPR) | For as long as you have the account (see section 7) |
| Sending you “Video ready” or “Event start” notifications | Notification token, operating system, preferences | Consent, when you allow notifications on your phone (art. 6.1.a GDPR) | Until you sign out, delete your account or turn off notifications |
| Inviting you to a survey after the event (one notification and, at most, one email) | Account, event, email | Legitimate interest in improving the service (art. 6.1.f GDPR) | The invitation expires 7 days after you receive your first video from the event |
| Storing your survey answers | Answers, event, access method | Consent: answering is voluntary (art. 6.1.a GDPR) | For as long as the event is in our system; without your name or email once you delete your account |
| Security and abuse prevention: rate limits, session expiry, single-use recovery codes, technical logs | IP address, sessions, codes, server logs | Legitimate interest in keeping the service secure (art. 6.1.f GDPR) | Logs: the minimum time needed for security and to resolve incidents; sessions and codes: see section 7 |
| Measuring how each event works and reporting to the organizer with overall figures | Attendance, access method, door staff member, steps taken in the app (entering, marking, signing in, downloading) | Legitimate interest in running the service (art. 6.1.f GDPR) | Kept without anything that identifies you once you delete your account |
| Complying with legal obligations (handling your rights, requests from authorities) | Whatever is needed in each case | Legal obligation (art. 6.1.c GDPR) | The limitation periods set by law |
Legitimate interest and right to object. Where the basis is our legitimate interest, we’ve assessed that the use is what you’d expect from an app and a website like these, that we process the minimum and that it doesn’t harm you. You can object to any of these uses at any time by writing to admin@goditi.io. For survey invitations, you also have the unsubscribe link at the bottom of the email.
We don’t make automated decisions with legal effects on you. Nor do we use your data to build profiles for advertising or to decide anything about you: we look at website and event statistics as a whole.
5. Event videos
The event organizer or promoter decides to have the event recorded and is the controller for capturing images of the audience at the venue. GODITI records on their behalf, as a processor, under a contract that sets out what we can do with the recordings. The organizer gives notice of the recording at the entrance, at the venue or in the ticket terms.
The cameras are set up and operated by the GODITI team and point at the stage. The audience may appear in some shots. The clip you receive is the one that matches the moment you marked; we can’t promise a particular framing or that you will appear in it.
For what happens in the app (your account, your moments, the delivery and download of the video), the controller is GODITI.
The video you download is for your personal use. If other people appear in it, respect their image rights. GODITI does not use your account data or your moments for promotional purposes. If we ever wanted to use for that purpose a clip in which someone is recognizable, we would ask for their consent separately.
An event’s videos and clips belong to the event. We keep them for as long as GODITI provides the service for that event and while you have your account; they are not deleted when you delete your account: what is deleted is your link to them, and you no longer have access.
6. Who receives your data
We don’t sell your data or disclose it for advertising purposes.
The event organizer sees overall figures in their dashboard: how many people got in and how, how many moments were marked, how many videos were delivered and downloaded, and survey answers without names or emails. They don’t see your name, your email or your individual moments. The list of attendees with name, email, phone operating system, moments and downloads is only seen by authorized GODITI staff, to resolve issues (for example, a video that hasn’t arrived).
Processors. These providers process data on our behalf, under a data processing agreement, and only for the purposes we specify:
| Provider | Country | What for | Where the data is and safeguard |
|---|---|---|---|
| Supabase, Inc. | United States | App database | Servers in Stockholm (Sweden, EU). European Commission Standard Contractual Clauses |
| Amazon Web Services (AWS EMEA SARL) | Luxembourg | App server (Ireland); storage of videos, clips and profile pictures, and clip cutting (Stockholm) | All in EU regions |
| Webempresa Europa, S.L. | Spain | Hosting of the goditi.io website, including the Koko Analytics visit counts | EU |
| Vercel, Inc. | United States | Hosting of the interface of the dashboard used by our team and organizers | EU-U.S. Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | United States | Sending emails: recovery code, password-changed notice, “how to access your account” if you have a Google or Apple account, survey reminder and messages from the website form | EU-U.S. Data Privacy Framework |
| Expo (650 Industries, Inc.) | United States | Delivering notifications to Apple and Google. It receives your device token and the text of the notification | EU-U.S. Data Privacy Framework |
| Google LLC | United States | Verifying sign-in with Google (Firebase Authentication), notifications on Android, QR code reader on Android (ML Kit) and Google Play install referrer | EU-U.S. Data Privacy Framework |
| Google Ireland Limited | Ireland | Website statistics (Google Analytics), only if you accept statistics cookies | May transfer data to Google LLC in the United States: EU-U.S. Data Privacy Framework |
| Apple Inc. | United States | Sign in with Apple and notifications on iOS | European Commission Standard Contractual Clauses |
Transfers outside the European Union. App data is stored in the EU. Even so, Resend, Expo, Google, Vercel and Apple may process data from the United States. Resend (Plus Five Five, Inc.), Expo (650 Industries, Inc.), Google LLC and Vercel, Inc. are certified under the EU-U.S. Data Privacy Framework, recognized by the European Commission’s adequacy decision of July 10, 2023 (art. 45 GDPR). You can check each company’s certification at dataprivacyframework.gov. Google Analytics statistics are processed by Google Ireland Limited, which may transfer them to Google LLC under that same safeguard. With Apple and Supabase we apply the Standard Contractual Clauses approved by the European Commission, included in their data processing agreement. You can ask us for a copy of these safeguards.
When you sign in with Google or Apple, those companies process your sign-in data as controllers in their own right, under their own policies (Google, Apple).
We will only share data with authorities when the law requires us to.
7. How long we keep it
| Data | How long |
|---|---|
| Website form messages | For as long as the conversation lasts and the time needed to deal with it; after that they are deleted |
| Email for news | Until you unsubscribe |
| Account, moments, profile picture and preferences | While you use the app or until you delete your account from the app (Profile). We don’t currently delete accounts for inactivity; if we do so in the future, we will let you know by email beforehand |
| Notification tokens | Deleted when you sign out or delete your account; deactivated when Apple or Google treat them as expired |
| Password recovery codes | Valid for 10 minutes. We only store a hash of the code, which is deleted along with the account |
| Sessions | 7 days, renewable while you use the app, up to one year without use |
| Survey invitations | 7 days from when you receive your first video from the event |
| Survey answers | For as long as the event is in our system; without your name or email once you delete your account |
| Event videos and clips | For as long as GODITI provides the service for that event; your access ends when you delete your account |
| Event counts (attendance and steps taken in the app) | Kept without anything that identifies you once you delete your account |
| Website statistics in Google Analytics (only if you accepted the cookies) | Details of each visit, 2 months; data linked to the cookie identifier, 14 months from your last visit; after that, only overall figures remain. Google Analytics cookies last 2 years from your last visit |
| Koko Analytics visit counts | No personal data; deleted after 25 months |
| Server technical logs | The minimum time needed for security and to resolve incidents |
| Live Activity token (iOS) | Not stored |
After those periods, any data the law requires us to keep is blocked and used only to deal with legal liabilities, until they become time-barred.
8. Your rights and how to exercise them
You can access your data, correct it, ask us to delete it, restrict or object to its processing, ask us to give it to you in a portable format, and withdraw any consent without affecting what was done before then.
- By email: write to admin@goditi.io from your account’s email address or attach something that lets us know it’s you. We reply within one month at most; if the request is complex, within up to three months, and we will let you know about the extension.
- Deleting your account from the app: Profile → Settings & Privacy → Delete account, then type DELETE to confirm. It is immediate and cannot be undone. We delete your name, your password, your profile picture, your Google or Apple identifier, your moments, your notification tokens and your recovery codes; your email is replaced with an anonymous value; all your sessions are closed; and, if you signed in with Google, your Firebase user is deleted. We keep only event counts (that someone got in, how, and what steps they took in the app) and your survey answers, linked to an internal identifier that no longer carries a name or email. If you wrote something in a free-text answer that identifies you, ask us to delete it and we will. The event videos still belong to the event.
- Deleting your account without the app: email us at admin@goditi.io from your account’s email address and we will do it for you, with the same result.
- Notifications: turn them off in the app (Profile → Notifications) or in your phone’s settings.
- Survey emails: unsubscribe link at the bottom of the email.
- GODITI news: unsubscribe link in every email, or by writing to admin@goditi.io.
- Website statistics cookies: withdraw your consent whenever you like from “Manage consent”, on the website itself.
If you think we haven’t handled your rights properly, you can lodge a complaint with the Agencia Española de Protección de Datos – AEPD (Spanish Data Protection Agency) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). We’d appreciate it if you wrote to us first so we can try to resolve it.
9. Minors
The app and the website form are not intended for anyone under 14. In Spain, from the age of 14 you can give consent yourself; below that age, you need authorization from your parent or guardian. When you create your account, you confirm that you are 14 or older. We don’t check age automatically. If we learn that we have collected data from someone under 14 without that authorization, we will delete the account and its data as soon as we detect it; if you are a parent or guardian and think this has happened, email us at admin@goditi.io.
10. Security
Communications are encrypted (HTTPS). Passwords are stored using bcrypt. Videos are served through temporary links that expire within one hour at most. Access to the database and storage is restricted to the server and authorized staff. We apply rate limits to curb abuse. No system is infallible: if a security breach occurred that posed a high risk to you, we would tell you and notify the AEPD within the legal deadlines.
11. Cookies
The website uses its own technical storage, which is exempt from consent, and Google Analytics statistics cookies only if you accept them in the cookie notice. You can change your choice whenever you like from “Manage consent”. The app doesn’t use cookies. We go into detail in the cookie policy.
12. Changes to this policy
When something relevant changes, we will publish the new version at goditi.io/privacy-policy, update the date at the top and, if the change affects how we use your account data, let you know in the app or by email. This version replaces all previous ones and is the same in all languages and in the App Store and Google Play listings.