Privacy Policy
Draft. This policy covers the Plugin Music Booking app, which opens to invited testers soon, and this website. It will be reviewed and finalised before the app opens. Parts in [brackets] are still being decided.
1. Who we are
Plugin Music Booking (“we”, “us”) is a booking and tour-management tool for artists. The controller for the personal data described here is Creative Urban Event, trading as Plugin Music and Plugin Music School, registered office: Rijnvoorde 33, 3085 TH Rotterdam, the Netherlands, Chamber of Commerce no. 74277324 (the “Company”). Contact for privacy questions: support@pluginmusicbooking.com.
2. The short version
- We keep the data you put into Plugin Music Booking so the app can work for you - nothing more.
- We don't sell your data, don't show ads and don't use your data to train AI models.
- You can download all your data, or delete your account and everything in it, at any time.
- Your data is stored in the European Union.
This website
pluginmusicbooking.com is a plain information site. It sets no cookies, uses no analytics or tracking, loads nothing from other companies (fonts and images are served from our own hosting) and has no forms. Our hosting provider, Websupport (EU), keeps standard server logs - IP address, time, page requested, browser - for security and troubleshooting, for a limited period. If you email us to request access, we use your message only to answer you and to send an invite.
3. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: email address, password (stored only as a secure hash by our login provider), sign-in times | To create your account and keep it secure | Contract (Art. 6(1)(b)) |
| If you sign in with Google: the name, email address and profile picture Google shares with us (never your Google password) | To create and sign in to your account | Contract |
| Access requests (by email): your email address, artist name, what you perform and a music link | To invite you to the beta. Kept until you are invited or for at most [12] months | Your consent (Art. 6(1)(a)); you can withdraw it any time by emailing us |
| Profile: name, artist name, contact details, city and country, time zone, profile photo | Shown on your pitches, riders, press kit and contracts | Contract |
| Business details: company, address, VAT/tax ID, Chamber of Commerce number, bank account (IBAN/BIC) | Printed on the contracts and documents you create | Contract |
| Your work in the app: venues, notes, outreach history, gigs, fees, riders, press kit, contracts, tour plans, settings | That is what the app is for | Contract |
| Technical logs: IP address, browser type, error reports, time of requests | Security, preventing abuse, fixing bugs. Kept for [30] days | Legitimate interest (Art. 6(1)(f)): keeping the service safe |
| Emails we send you: reminders and notifications you switched on | To send the reminders you asked for | Contract; you can switch each type off in Settings |
We do not collect special categories of data (such as health or religion) and ask you not to store them in the app.
4. Data about other people that you store
When you save a promoter's or booker's name, email address or phone number, you decide what to store and why. For that data you are the controller and we are your processor: we only store and process it to run the app for you, under the data-processing terms in our Terms of use. Only keep contact details you need for booking, and remove them when you no longer need them.
5. Who else handles your data
We use a small number of service providers (“processors”) under written agreements that require them to protect your data:
| Provider | What for | Where |
|---|---|---|
| [Hosting & database - e.g. Google Cloud or Supabase] | Running the app and storing your data | EU [region] |
| [Login provider - e.g. Firebase Authentication / Supabase Auth] | Sign-in and password security | [region] |
| [Email service] | Sending reminders and account emails | [region] |
| OpenStreetMap (Nominatim) and map tile providers [e.g. CARTO] | Finding places and showing maps. They receive the place name you look up and your IP address, not your account data | [to confirm] |
| Websupport | Hosting this website and our email (support@pluginmusicbooking.com) | EU (Slovakia) |
When you ask the app to read a festival's website, our server fetches that public page for you; the website sees our server, not you. Links and emails you send open in your own browser or mail program, and what happens there is governed by those services.
If data is transferred outside the European Economic Area, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Your account data and your work: for as long as your account exists.
- After you delete your account: removed from the live database straight away, and from our backups within [35] days.
- Technical logs: [30] days.
- Invoices and payment records, if you have a paid plan: 7 years, because Dutch tax law requires it.
7. Security
Data is encrypted in transit (HTTPS) and at rest. Every user's data is separated at the database level, so one user can never read another user's data. Access by our staff is limited, logged, and only used to help you or to keep the service running. We will tell you and the Dutch Data Protection Authority about a data breach when the law requires it.
8. Cookies
We only use cookies and browser storage that are strictly necessary: to keep you signed in, remember your settings on this device and let the app work offline. We don't use advertising or tracking cookies. If we ever add analytics, we will ask for your consent first.
9. Your rights
You have the right to access, correct, delete and download your data (“data portability”), to object to processing based on legitimate interest, and to restrict processing. Most of this you can do yourself:
- Download your data: Settings → Data & privacy → Download all my data.
- Correct your data: edit it anywhere in the app, or in Settings → Profile.
- Delete your data: Settings → Data & privacy → Delete all my data (this also closes your account in the online version).
For anything else, email support@pluginmusicbooking.com. We answer within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own EU country.
10. Age
Plugin Music Booking is meant for people aged 16 and over.
11. Changes
If we change this policy in a way that matters, we tell you in the app or by email before the change takes effect. The date at the top shows the latest version.