Draft. Highlighted parts are still being filled in. Questions in the meantime: see the imprint.

Privacy Policy

Version VERSION, e.g. 1.0 · Last updated DATE

DRAFT. Not legal advice. Needs review by a lawyer before publication. Sections marked VERIFY depend on contracts or settings that must be checked.

This policy explains what personal data Bandkit collects, why, who else receives it, how long we keep it, and what rights you have. It covers:

• the Bandkit app at mybandkit.com, including public band pages (mybandkit.com/<band>), shared rider and stage-plot links, invite links and the city directory, and
• our website at getbandkit.com.

The short version:

• We use your data to run Bandkit and nothing else.
• We don't sell it, don't show ads, and don't use analytics or tracking cookies.
• Your data is stored in the EU (Frankfurt, Germany).
• Some service providers we use are US companies; section 7 explains how those transfers are protected.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Jonathan Manierre, trading as Bandkit
Im Weichserhof 9
50678 Köln, Germany
Email: privacy@mybandkit.com

We have not appointed a data protection officer, because we are not legally required to (Art. 37 GDPR, § 38 BDSG). For anything about your data, write to the email address above.

2. When we are responsible, and when your band is

Bandkit is a workspace for bands, and two kinds of data pass through it:

• Data about you as a Bandkit user. This covers your account, how you use the service, and our communication with you. We decide how this is used, so we are the controller (sections 4.1–4.3 and 4.8–4.11).

• Data your band puts into Bandkit about other people. This covers booking contacts, venue and promoter details, band member entries, photos, and notes on gigs and opportunities. Your band decides what goes in and what it is used for. For this data, the band (through the account holders who run it) is the controller, and we process the data on the band's behalf under our Data Processing Agreement (Art. 28 GDPR).

  If you are in a band's contact list and have questions about your data, please contact that band first. If you don't know how to reach them, contact us and we will forward your request.

Public band pages are published by the band. The band decides what appears on them and is responsible for having the right to publish it. We host the pages and run the city directory (section 4.4).

3. Overview

4. What we process, in detail

4.1 Visiting mybandkit.com or getbandkit.com

Whenever you open a page, your browser sends technical information to our hosting provider: IP address, date and time, the page requested, referring page, browser and operating system. This is needed to deliver the page and to detect attacks and errors.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering a secure, working website.
• Retention: server logs are kept for N days by our hosting provider, then deleted. VERIFY against hosting plan's log retention
• Recipient: our hosting provider (section 6).

4.2 Your account

To create an account we ask for your email address, a password and, optionally, your name.

• The password is stored only as a cryptographic hash. We cannot read it.
• When you sign in, our authentication provider records the time, IP address and device information. This protects your account, for example by detecting suspicious sign-ins.
• Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for) and, for sign-in security records, Art. 6(1)(f) GDPR.
• Retention:
  • Account data is kept until you delete your account. After that it is erased within 30 days, apart from the backups described in 4.11.
  • Sign-in security records are kept for N days. VERIFY Supabase auth log retention

4.3 Working in a band workspace

Everything you and your bandmates enter is stored so the band can use it. That includes band identity, members, photos, stage plots, riders, gigs, venues, contacts, organisations, opportunities and notes.

• Who can see it: only people the band has given access, through roles of owner, manager or member. Bandmates can see each other's name, email address and role.
• Invite links: an owner can create an invite link. Anyone who has the link can join the band with the role it grants until the link expires (14 days) or is turned off. We store who created each invite, when, and how often it was used.
• Legal basis:
  • For your own data: Art. 6(1)(b) GDPR.
  • For data about other people that your band enters: we process it on the band's behalf (section 2). Your band needs its own legal basis to collect it, for example a booker's business contact details collected for a booking.
• Retention: until the band, or the person who entered the data, deletes it, or the band is deleted.

4.4 Public band pages, shared links and the city directory

• Band pages (mybandkit.com/<band>) are public. They show whatever the band chooses to publish, such as name, biography, photos, members, links and videos.
• Shared links: the band can share a rider or stage plot through an unguessable link. Anyone who has that link can view the document until the band turns sharing off.
• City directory: published band pages are listed on city pages (for example mybandkit.com/city/berlin) with band name, town, genre, photo and social links. Bands are listed by default and can switch the listing off at any time in Band Identity.
• Legal basis:
  • Publishing the band's page: Art. 6(1)(b) GDPR, at the band's request.
  • The city directory: Art. 6(1)(f) GDPR. Our legitimate interest is helping venues and bookers find bands.
• Your right to object: you can object to the directory listing at any time (section 9).
• Visitors to public pages are handled as described in 4.1. We do not track them.

4.5 Embedded videos (YouTube, Vimeo)

Band pages can show videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA).

A video only loads after you click it. Until then, no connection is made to YouTube or Vimeo. When you click, your browser connects to the provider. The provider then receives at least your IP address and device information, can set cookies or similar technologies, and may link this to your account with them. YouTube videos are loaded through the "privacy-enhanced mode" domain (youtube-nocookie.com).

• Legal basis: your consent, given by clicking the video (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Consent applies to that page visit only. You can withdraw it by leaving or reloading the page.
• Google and Vimeo may transfer data to the USA (section 7).
• Their privacy policies: policies.google.com/privacy, vimeo.com/privacy.

4.6 Venue and address search

When you type a venue or address in Bandkit, the text you enter is sent from our server to the Google Places API (Google Ireland Limited / Google LLC) to fetch suggestions and the selected place's address and coordinates. Your IP address is not passed on, because the request comes from our server.

• Legal basis: Art. 6(1)(b) GDPR.
• Recipient: Google (section 6). Google may process the request in the USA (section 7).

4.7 AI features

Some features use an AI model provided by Anthropic PBC (548 Market Street, PMB 90375, San Francisco, CA 94104, USA). VERIFY address Today this is the "build my stage plot" feature.

• Nothing is sent unless you click the AI button.
• What is sent: your request, plus the band members' names (or stage names) and their instruments, so the model can place them on stage. RECOMMENDED: send roles instead of names, see compliance-gaps P1
• Under Anthropic's commercial terms, data sent through the API is not used to train its models. Anthropic retains inputs and outputs for a limited period (currently up to 30 days, longer only where needed for safety or legal reasons) and then deletes them. VERIFY current Anthropic commercial terms and DPA
• AI output can be wrong. Always check it before relying on it, for example before sending a stage plot to a venue.
• Legal basis: Art. 6(1)(b) GDPR.
• Transfer to the USA: see section 7.

4.8 Emails we send

We send emails needed to run your account: sign-up confirmation, password reset, invitations you trigger, and security or legal notices. We do not send marketing email without your separate consent.

• Legal basis: Art. 6(1)(b) GDPR.
• Recipient: our email provider (section 6).

4.9 Contacting us

If you email us, we use what you send (your address, your message, and any data in it) to answer you.

• Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract; otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).
• Retention: we delete the conversation when it is resolved and no longer needed, at the latest after 24 months, unless we must keep it longer by law.

4.10 Security, misuse and reports of illegal content

• What we process: we may use logs, account data and content to investigate misuse, prevent attacks and enforce our Terms.
• Reports: anyone can report content on a public page that they believe is illegal (Art. 16 Digital Services Act). We process the report, including the reporter's name and email if given, the content, our decision and our reasons. If we restrict content, we inform the account holder of our reasons (Art. 17 DSA).
• Legal basis: Art. 6(1)(c) GDPR (DSA obligations) and Art. 6(1)(f) GDPR (security of the service, establishing or defending legal claims).
• Retention: reports and decisions are kept for 6 months after the case is closed, or longer if needed for legal proceedings.

4.11 Backups

We keep backups so data can be restored after an error or incident.

• What and how long: copies of the database are retained for up to 14 days.
• After deletion: data you delete disappears from backups once those backups expire. We do not restore deleted data from backups, except to recover from an incident, and then we re-apply deletions.
• Where: backups are encrypted and stored at our hosting/database provider in the EU and/or on encrypted devices controlled by us in Germany. VERIFY: today a nightly copy is stored on the operator's Mac. FileVault must be on.
• Legal basis: Art. 6(1)(f) GDPR (availability and integrity of the service) and Art. 32 GDPR.

4.12 Payments

Bandkit is free during the beta, and we do not process payment data. Before paid plans start, we will update this policy and tell you.

5. Cookies and similar technologies

We only use what is strictly necessary to provide the service you asked for. That kind of storage does not require consent (§ 25(2) no. 2 TDDDG). We use no analytics, advertising or tracking cookies.

If you click to load a YouTube or Vimeo video, those providers may set their own cookies (section 4.5). If we ever introduce non-essential cookies, we will ask for your consent first.

6. Recipients and service providers

We share data only with providers we need to run Bandkit. Each one acts on our instructions under a data processing agreement (Art. 28 GDPR), except where marked as independent. VERIFY each DPA is signed/accepted

We also disclose data to authorities or courts where the law requires us to (Art. 6(1)(c) GDPR).

7. Transfers outside the EU

Some providers are based in the USA or may access data from there. We transfer data outside the EU/EEA only with protection in place:

• EU-US Data Privacy Framework: used where the recipient is certified under it (adequacy decision of 10 July 2023, Art. 45 GDPR). VERIFY current certification of Supabase, Vercel, Google, Anthropic at dataprivacyframework.gov
• Standard Contractual Clauses: used otherwise. These are the European Commission's clauses (Art. 46(2)(c) GDPR), with additional safeguards where needed.

You can ask us for a copy of the safeguards that apply.

8. How long we keep data

Unless stated above:

• We keep personal data only as long as we need it for the purpose it was collected for.
• Account and workspace data is deleted within 30 days after you delete your account or the band is deleted.
• Backups expire as described in 4.11.
• If we must keep data longer by law, we keep it only for that purpose. For example, invoices once paid plans exist: up to 10 years under §§ 147 AO, 257 HGB.
• Invite links: deleted [[90 days after expiry or revocation, see compliance-gaps]]

9. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• correct inaccurate data (Art. 16),
• erase your data (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw consent at any time, with effect for the future (Art. 7(3)),
• complain to a data protection authority (Art. 77). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), but you may contact the authority where you live or work.

Your right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. You can object to the city directory listing at any time without giving reasons.

To exercise any right, email privacy@mybandkit.com. This includes deleting your account or getting a copy of your data: for now we do both by hand when you ask, and we delete accounts within 30 days. We may ask you to confirm your identity, and we answer within one month (Art. 12(3) GDPR).

10. Do you have to give us your data?

You need an email address and password to create an account; without them we cannot provide Bandkit. Everything else is optional. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR).

11. Children

Bandkit is not meant for children. You must be at least 16 years old to create an account (see our Terms). If we learn that a child under 16 has created an account, we delete it.

12. Changes to this policy

We will update this policy when our processing changes. The current version is always at mybandkit.com/legal/privacy. If a change materially affects you, we will tell you by email or in the app before it takes effect.