Band on the Run — Privacy Policy

1. Introduction

This Privacy Policy explains what information Band on the Run ("we," "us," "our") collects when you use our platform, how we use it, and the choices you have. By using Band on the Run, you agree to the practices described here.

2. Information We Collect

Account information. Email address, password (stored in hashed form by our authentication provider, never in plain text), and account type (Artist or Venue).

Profile information. Band or venue name, bio/description, genre tags, city/state, contact information, and any profile photos you upload.

Location information. City and state you provide for your profile, and general venue location data used to display listings on our interactive map.

Booking and payment information. Details of booking offers, negotiations, and confirmed bookings (dates, prices, set lengths). Payment card information is collected and stored directly by our payment processor, Stripe — we do not receive or store your full card number. We do receive and store transaction metadata (amounts, dates, status) needed to operate the Platform.

Messages. Content of messages sent between an Artist and Venue in connection with a specific booking.

Ratings and reviews. Star ratings and written reviews you submit about a completed booking.

Usage information. Basic technical information such as IP address, browser type, and pages visited, collected automatically through standard web server and hosting logs.

3. How We Use Your Information

We use the information we collect to:

• Operate the core features of the Platform (profiles, search, booking, messaging, payments, ratings)
• Facilitate payment processing between Artists and Venues via Stripe
• Communicate with you about your account, bookings, or Platform updates
• Maintain the security and integrity of the Platform
• Comply with legal obligations

We do not sell your personal information to third parties.

4. How We Share Information

• With other users, as part of normal Platform operation: your profile information is publicly visible (this is a marketplace — bands and venues need to be discoverable). Messages are visible only to the two parties on a given booking.
• With Stripe, to process payments and payouts. Stripe's use of your information is governed by Stripe's own privacy policy.
• With service providers who help us operate the Platform, including our hosting provider (Vercel) and our database/backend provider (Supabase). These providers process data on our behalf and are not permitted to use it for their own purposes.
• When required by law, such as in response to a valid subpoena or legal process.
• We do not share your information with third parties for their own marketing purposes.

5. Cookies & Similar Technologies

We use essential cookies necessary for you to stay logged in and for the Platform to function.

6. Data Retention

We retain your information for as long as your account is active, and for a reasonable period afterward as needed to comply with legal obligations (such as tax and payment records), resolve disputes, and enforce our agreements.

7. Your Rights & Choices

• You can review and update your profile information directly within the Platform at any time.
• You can delete your account and associated data at any time directly from your account settings. Deletion is self-service — no need to contact support to request it. If you have trouble accessing this feature, contact us at support@bandontherun.app and we'll assist directly.
• If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to request its deletion.

8. Children's Privacy

Band on the Run is not intended for use by anyone under 18. We do not knowingly collect information from children under 18. If we learn we have collected such information, we will delete it.

9. Data Security

We use industry-standard security practices to protect your information, including encrypted data storage and transmission and access controls on our backend systems. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Data Breach Notification

11. International Users

Band on the Run is currently intended for use within the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will note the "Last Updated" date at the top of this page, and for material changes, provide additional notice (such as an email or in-app notification).

13. Contact Us

Questions about this Privacy Policy can be directed to support@bandontherun.app.

*This document is a draft prepared for attorney review and is not a final, legally binding Privacy Policy until reviewed, revised, and approved by a licensed attorney.*