Privacy Policy

At Light It App we take your privacy seriously. This policy explains what data we process, on what legal basis, what we use it for, who we share it with, and what rights you have. It applies to Light It App (iOS and Apple Watch), the website and web dashboard, and the web player used by the audience.

Light It App is a product of Kavnes LLC (a limited liability company formed in Wyoming, United States), which is the data controller for your data. For any question or to exercise your rights, write to us at info@lightitapp.live.

1. Who this applies to

We distinguish two roles: (a) Organizers, who create an account to build and control shows; and (b) the Audience, the people who join a show by scanning a QR code, without creating an account.

2. What data we collect

From Organizers (with an account): name, email address, organization or event name, password (always stored hashed, never in plain text) and, optionally, a phone number. Also account activity: campaigns and shows created.

If you choose to sign in with Google (optional, web only): Google tells us your email address, your name and an identifier of your Google account, and we store that data to identify you when you sign in. We never receive your Google password and we do not access your mail, contacts or any other data in your account. You can keep using email and password if you prefer.

From the Audience (no account, anonymous): when someone joins a show we record non-identifying technical and usage data: platform (web / iOS / watchOS), device model, operating system and app version, device language, an anonymous device identifier (which does not identify the person), the chosen group or section, the date and time of the connection, and approximate location (country and city).

Optional audience email (opt-in): when a show ends, the audience may voluntarily choose to leave their email to receive notice of the organizer's upcoming events, the event's photos or recap, and Light It App news. We only store it if the person leaves it on purpose, together with a record of the consent given. It is never required to take part in the show.

Content uploaded by Organizers: the background images you choose for your shows are stored on our servers, because they have to be delivered to the audience during the event. With each image we record which person on your account uploaded it, from which event, and when. Songs are not uploaded: they are analyzed on your own device and never leave it.

Payment data: organizers' payments are processed by Stripe. We do not receive or store full card details; Stripe only reports the payment result to us.

Technical data and logs: for security and operation, our servers may temporarily log data such as request times and errors.

3. How we handle your IP address

We use the IP address only to derive approximate location (country and city) and for abuse prevention. The IP is not stored raw: it is turned into an irreversible code (a hash) and the original is discarded. We never ask for or store precise location or GPS.

4. Legal bases for processing

Where the GDPR (EU/EEA) or an equivalent law applies, we process your data on the following bases:

• Performance of a contract: to provide the service (organizer accounts and running shows).
• Consent: for the optional audience email and any marketing communication. You can withdraw it at any time.
• Legitimate interest: for aggregated statistics, security, abuse prevention and product improvement, in a proportionate way that respects your rights.
• Legal obligation: where we must retain or disclose data by law.

5. What we use data for

• To provide and operate the service (create shows, sync the lights, live control).
• To generate aggregated statistics (how many people took part, from which devices and places).
• To process organizers' capacity payments.
• To communicate with organizers about their account and the service.
• With your consent, to send —or let the organizer send— notice of upcoming events, photos or recap, and news.
• Providing support and preventing misuse: a small number of people on our team may access the images you upload, solely for that purpose and for no other use.
• Security, fraud prevention and compliance with legal obligations.

6. Cookies and similar technologies

We use only first-party, necessary cookies: the session cookie (to keep the organizer signed in) and the language cookie. We do not use advertising cookies or third-party trackers.

7. Who we share data with

We do not sell or rent personal data. We share it only with providers that operate the service (data processors), under contract:

• Railway — hosting and database.
• Resend — sending transactional emails.
• Stripe — payment processing.
• Apple and Google — app distribution and notifications; Google also authenticates you if you choose to sign in with your Google account.
• IP geolocation databases — to derive country and city.

The optional audience email is also shared with the organizer of the event that person joined, so they can contact them according to the consent given. The organizer acts as an independent controller for those contacts and must use them in accordance with the law.

8. International transfers

Some of our providers may process data in countries other than yours (for example, the United States or the European Union). When this happens, we seek to ensure appropriate safeguards —such as standard contractual clauses— to protect your data.

9. How long we keep data

We keep the organizer's account data while the account is active. Anonymous audience data is kept for statistics. The optional audience email is kept until the person requests removal, or until the organizer's account or the associated event is deleted. Background images are kept while the organizer's account exists, or until we delete them at your request. You can request deletion at any time.

10. Security

We apply reasonable technical and organizational measures: encryption in transit (HTTPS), passwords stored with hashing, hashed IPs and restricted access to data. No system is 100% foolproof, but we work to protect your information.

11. Your rights

Depending on your country, you may have the right to:

• access your data,
• rectify it,
• erase it (right to be forgotten),
• restrict or object to its processing,
• data portability,
• withdraw your consent at any time,
• and lodge a complaint with your country's data protection authority.

To exercise these rights, write to us at info@lightitapp.live. Organizers can also edit or delete their account from the app.

California residents (CCPA/CPRA): you have the right to know what information we collect, to request its deletion, and not to be discriminated against for exercising your rights. We do not sell personal information.

12. Children

The service is intended for adult organizers (18+). We do not knowingly collect data from children under 16. Audience participation is anonymous; the optional email should not be left by minors without the consent of a parent or guardian.

13. Automated decisions

We do not make automated decisions with legal or similarly significant effects on you based solely on automated processing of data.

14. Changes to this policy

If we update this policy, we will change the last-updated date above. If the changes are significant, we will notify you through the reasonable means available.

15. Contact

For any privacy question or to exercise your rights, write to us at info@lightitapp.live. See also our Terms & Conditions.