Privacy Policy

1Who is responsible

[COMPANY NAME], [REGISTERED ADDRESS], is the controller of the personal data described here. Reach us through the contact page.

2What we collect

• Account: your phone number, which is required, and whatever else you choose to add — name, surname, username, email address, profile photo, and links to your own websites and social accounts.
• Wallet: the Ethereum address created for your account and the keys belonging to it, held on our servers.
• Band applications: the band's name, description, links and the members you list.
• Contact form: the name, email address, subject and message you send, together with your IP address and the browser identification string, kept so a flood of messages can be traced and blocked.
• Spotify: only if you connect it — an access token and the basic profile it returns.
• Server logs: ordinary records of requests to the site.

3Why, and on what legal basis

• To run your account and provide what you asked for — performance of a contract.
• To answer a message you sent us — our legitimate interest in replying, and your consent in sending it.
• To keep the service working and prevent abuse, including rate limiting and blocking — our legitimate interest in a service that stays up.
• To meet obligations the law places on us.

4Cookies

The site sets two cookies and neither is for advertising or analytics:

• token — keeps you signed in.
• lang — remembers which language you chose.

5Who else sees it

We do not sell personal data and we run no advertising networks. Data reaches others only where the service needs it:

• Service providers acting on our instructions: Amazon Web Services for file storage, Google Firebase for push notifications, SendGrid for email, and Spotify if you connect an account.
• The public blockchain. Transactions on the Ethereum test network are public, permanent and outside our control. Do not put anything on-chain you would not publish.
• The networks that serve parts of our pages — Google Fonts, the jQuery and unpkg CDNs, and CARTO for the map tiles. As with any web request, these see your IP address and which page asked.

6Where you are

We look up the country your IP address belongs to so the phone-number field starts on the right country code. The lookup uses a database stored on our own server and does not leave it. The answer is a default you can change, and we do not keep it.

7How long we keep it

Account data stays until you delete the account. Messages sent through the contact form are kept for up to 24 months so we can follow up on a conversation. Server logs are kept for a short period for security.

Anything written to a blockchain cannot be deleted by us or by anyone else.

8Your rights

Where the GDPR applies to you — and where the KVKK applies, on the same footing — you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, ask us to restrict it, and receive it in a portable form.

Write through the contact page and we will answer within one month. You may also complain to the data protection authority where you live.

9Children

The service is not intended for children under 16. If you believe a child has given us personal data, tell us and we will delete it.

10Security

The site runs over HTTPS, wallet keys are stored encrypted, and sensitive endpoints are rate limited. None of that makes any service perfectly secure, and the custodial wallet described in the terms is a risk you should weigh before putting anything into it.

11Changes

We post any new version of this policy here, with the date it took effect.