Privacy Policy

MyRhythm is operated by Rhythm Solutions (Pty) Limited, trading as myrhythm. Privacy requests and questions can be sent to info@myrhythm.io.

This policy applies to personal information processed through MyRhythm, including information relating to performers, parents/guardians, adjudicators, coaches, participants and visitors where applicable.

Depending on features used, we may process identity and account information; parent/guardian information; email and mobile numbers; photographs; videos; audio and voice; creative works; competition/event data; adjudication and feedback; support correspondence; and technical/security information.

We aim to avoid collecting precise location information from Minor accounts unless a specific feature has been reviewed and there is a clear lawful/product need.

Purposes may include account administration, providing selected services, storing/transcoding/streaming Content, adjudication and coaching, competitions and events, communications, security and abuse prevention, legal obligations, privacy requests, and optional publication or marketing where the required permission exists.

The lawful basis or statutory authorisation depends on jurisdiction and purpose. For South African Minor accounts, MyRhythm will use an authorisation pathway permitted by POPIA and will obtain prior consent from a competent person where that is the applicable route.

For GDPR/UK GDPR users, MyRhythm will document the applicable lawful basis for each purpose and seek valid consent where required.

Children's information receives enhanced protection. For Minor accounts, MyRhythm aims for:

• high-privacy defaults
• no public publication by default
• no marketing by default
• no precise geolocation by default
• no child profiling by default
• role-restricted media access
• age-appropriate information
• accessible reporting and privacy assistance
• data minimisation

Photographs, video and audio may identify a person and therefore may constitute personal information. Media may contain a child's face, voice, performance characteristics, clothing, background or location clues.

Parents and performers should review media before upload and avoid unnecessary private information.

Information may be shared with authorised MyRhythm personnel, adjudicators and coaches where required by a selected feature, authorised participants where a feature requires it, service providers, advisers, authorities where required or permitted by law, and parties expressly authorised by the User or Parent/Guardian.

Minor contact details and precise personal location are not public by default.

MyRhythm may use providers for hosting, storage, media processing, content delivery, security, messaging/OTP, email, support, analytics and moderation. Suppliers should be subject to risk-based contractual and security requirements.

Personal information may be processed in other countries. Where applicable law imposes international-transfer requirements, MyRhythm will use the required legal mechanisms and safeguards.

MyRhythm does not enable behavioural advertising or commercial profiling of Minor accounts by default. Any feature involving profiling or automated decisions that could materially affect a child must undergo privacy and child-impact review before deployment.

MyRhythm designs child-facing features around high-privacy defaults, minimisation, purpose limitation, access controls, secure media delivery, restricted sharing, granular consent where required, age-appropriate transparency and child-accessible reporting and privacy tools.

Measures may include encryption, authentication, mobile verification, least-privilege access, signed and expiring media access, logging, rate limiting, secure secrets, monitoring and incident response.

No internet service can guarantee absolute security.

Personal information is retained only as long as reasonably necessary for the purpose, unless longer retention is required or permitted by law.

Different periods may apply to accounts, consent evidence, Content, adjudication, security logs, safeguarding records, incidents and backups.

Depending on jurisdiction, rights may include access, correction, deletion, restriction, objection, withdrawal of consent, portability and complaint to a regulator.

Requests can be sent to info@myrhythm.io. Reasonable identity or authority verification may be required.

MyRhythm aims to provide age-appropriate routes for children and parents/guardians to ask what information is held, request correction or deletion, ask privacy questions, withdraw optional permissions and report concerns.

Where processing is based on consent, the consent record identifies the relevant purpose and document version. Withdrawal affects future processing based on that consent where required, but does not invalidate prior lawful processing. Third-party copies may remain outside MyRhythm's control.

Contact info@myrhythm.io first. Where applicable, a complaint may also be made to the relevant privacy regulator.

Depending on where you live, additional rights and contacts apply. The high-protection baseline in this policy always applies; these addenda add to it, never reduce it.

• South Africa (POPIA): MyRhythm's Information Officer can be reached via info@myrhythm.io. You may complain to the Information Regulator (South Africa) if you believe your information has been handled unlawfully.
• EU & UK (GDPR / UK GDPR): you have rights of access, rectification, erasure, restriction, portability and objection. Our processing of children's data follows the UK Age-Appropriate Design Code as a design baseline. You may lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA): MyRhythm does not sell or share personal information for cross-context behavioural advertising. California residents may request access to, correction of, or deletion of their personal information via info@myrhythm.io.
• Everywhere else: the same request routes apply to all members — privacy rights are not limited by geography.

The current version and effective date will be displayed on the website. We will give members at least 30 days' notice before a material change to this policy takes effect, and each version is listed in the document's version history.