Privacy Policy

1. Controller

The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. Hosting and Server Location

We host our application and databases with Google Cloud / Firebase. To ensure the highest data protection standards, we have chosen Belgium (region: europe-west1) as our server location. This means your data stays within the European Union and is subject to the strict requirements of the GDPR.

3. Data We Collect in Our App

For Stagedyver to work for musicians and bands, we process various types of data. Processing takes place to initiate and perform a contract (Art. 6(1)(b) GDPR) in the context of using our platform:

• Account & band data: We store details of your account (name, email address, profile picture, language setting) and of your bands: members and their roles, songs, setlists, events including the members' replies and an optionally entered fee, and the content of the band profile.
• Media & photos: Users can upload images (e.g. profile pictures, band covers) and files for songs. These are stored securely with our hosting partner Firebase Storage. When uploading, the user confirms that they hold the necessary copyright and usage rights.
• Place search: When creating an event you can search for the location via the Google Maps API (Places). Your search term is sent to Google for this.
• Communication: For sending system emails (e.g. sign-in link, email confirmation, trial notices, notice of moved or cancelled events, reminder of an open reply) we use the service Resend. Emails to members only go to the confirmed address of your sign-in. We log the recipient address, the type of email and the delivery status.
• Push notifications: If you allow push notifications, we store the device token issued by Apple (APNs) or Google (Firebase Cloud Messaging) so we can notify you when an event of your band is moved or cancelled, and remind you of an open reply or, the day before, of a rehearsal. Push notifications are optional; you can withdraw your consent at any time in your device settings, and we automatically remove tokens that are no longer valid.
• Band link and substitute link: When the band shares such a link, people without an account can read the shared setlists and songs. We create no account and no profile for these readers; only the technically necessary connection data is processed.
• Follow along via link: When you follow the band via a link, the page asks for the current song every few seconds. We set no cookies and create nothing about you: the request only contains the link token and a random ID per browser tab. We use your IP address and this ID only briefly in the server's memory for rate limiting and do not store them. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
• RSVP link: When the band shares an event with an RSVP link, anyone with the link sees the event's title, date, time and place, the first names or display names of the members asked and their answers; the link shows no email addresses, fee or notes. When someone answers via the link, we store the answer on the event, together with the note "via link" and the time. So you don't have to choose again every time, your browser remembers in your device's local storage whom you picked; this is not a cookie. The legal basis is Art. 6(1)(b) GDPR (organising the band), and for readers without an account Art. 6(1)(f) GDPR.
• Reminders: For reminders about open replies and before rehearsals we note which reminder went to which member for which event (event, member, type, time), so nobody gets the same reminder twice. We delete these entries after 30 days. You can switch reminders off in the settings under "Notifications".
• Abuse protection: For rate limits (e.g. sign-in link, contact form, RSVP link) we store counters whose key is a hash of the IP address or email address, never the address itself. The counters expire after their time window (Art. 6(1)(f) GDPR).

3a. Public Band Profiles and Contact Form

• Band profile: Anyone can view a public band profile. For the band we count the visits to its profile per day, without cookies and without storing the IP address; only the host name of the referring page is recorded. If your browser sends "Do Not Track", we count nothing. The legal basis is our and the band's legitimate interest in simple reach measurement (Art. 6(1)(f) GDPR).
• Contact form: When you write to a band via the contact form on its band profile, we process your details (name, email address, optionally phone number, date and occasion, message) in order to send them by email via Resend to the bandleader. Your email address is set as the reply-to address so the band can answer you directly. We do not store the content of your message in our database. The legal basis is Art. 6(1)(b) GDPR (handling your request).
• Abuse protection: To prevent mass submissions, we process your IP address and email address only as a pseudonymised counter (hash value) for rate limiting (Art. 6(1)(f) GDPR).
• The band's responsibility: Once received, the band you write to is responsible for handling your request, for example for its reply and for keeping it in its inbox.

4. Payment Processing

For processing payments (subscriptions) we use the service provider Lemon Squeezy, LLC(USA). Lemon Squeezy is our "Merchant of Record" and therefore the direct contractual partner for your payments. Payment data is processed directly via the secure systems of Lemon Squeezy in order to perform the contract (Art. 6(1)(b) GDPR). We do not store any credit card data ourselves. You can find more information in the privacy policy of Lemon Squeezy.

5. Third-Party Services

We rely on a small number of carefully selected providers to operate the service:

• Firebase (Google): Authentication, database and hosting. Privacy Policy
• Lemon Squeezy: Merchant of Record for payment processing. We do not store your full payment details on our servers. Privacy Policy
• Apple Music: We use the Apple Music API to fetch song previews. Privacy Policy
• Google Maps: Used to search for event locations. Privacy Policy
• Resend: Delivery of transactional system emails and of contact form messages to bands. Privacy Policy

We do not sell your personal data to third parties.

6. Your Rights

You have the right at any time to:

• Obtain information about the personal data we store about you (Art. 15 GDPR).
• Request the rectification of inaccurate data (Art. 16 GDPR).
• Request the erasure of your data ("right to be forgotten", Art. 17 GDPR).
• Request the restriction of processing of your data (Art. 18 GDPR).
• Receive your data in a structured, commonly used and machine-readable format (data portability, Art. 20 GDPR).
• Object to the processing of your data (right to object, Art. 21 GDPR).
• Lodge a complaint with a competent supervisory authority (Art. 77 GDPR).

You can request an export of your data directly in the app settings under "Account & profile", or fully delete your account there.

7. Security

For security reasons and to protect the transmission of confidential content, we use SSL/TLS encryption. Your data is transmitted to our servers in encrypted form.