Privacy notice

What we collect

To run a band's bookings and pay, we hold:

• Your name, email address and phone number.
• Your postcode (or ZIP code, Eircode or postal code), used to work out travel distance and pay.
• Your country and the language you choose for the site, if you set one.
• Vehicle details, dietary notes and an emergency contact, if you add them.
• The gigs you play, what you are paid, and any expense or receipt you submit.
• Days you have told us you are not available.
• Where a sign-up came from (a link on a social post, a search engine), so we know what brings people here.

Beyond what the app itself shows you, we only measure how the site is used: always with Vercel's cookie-free counts, and with Google Analytics and Microsoft Clarity only if you accept them (see Cookies below). The only advertising data is our own count of which of our adverts, if any, brought you here (the ebm_src cookie below); nothing goes to an advertising network, and there is no sale of personal information to anyone. The free tools (the pay-split calculator and the invoice generator) and the demo band store nothing of yours unless you ask: what you type stays in your browser and is gone when you leave. If you ask the calculator to email you a result, we keep that email address and the figures you sent, with an unsubscribe link in every message, until you unsubscribe.

Who can see what

A bandmate sees your name, instrument, which bands you are in, and any social links you have added. Nothing more. A manager of a band you are in can see your full profile (contact details, vehicle, dietary notes, emergency contact) and what you are paid, because they are the ones who need to reach you or sort out a problem. A manager never sees another manager's own cut of a booking unless they hold that role themselves.

A client of a band sees only the quote, invoice or booking agreement the band sent them, on a page that needs its own link. Nobody outside your own band's managers and members ever sees your data through the app.

Where it is stored

Event Band Manager is run from the United Kingdom. Your data is stored with Supabase, hosted in London, and the app itself runs from the same region on Vercel. We do not run our own servers: we use established providers who secure the infrastructure, and we control what goes in and out of it.

The site is open to bands anywhere, so you may be reading this from outside the UK. Wherever you are, your data is held in London and reaches you from there, and we apply UK GDPR to everyone: the same rules about what we may collect, how long we keep it and what you can ask us to do with it, whichever country you live in. If your own country gives you rights on top of those, we are not taking them away.

Cookies

The first time you visit, a bar at the foot of the page asks one question: may we use analytics cookies? Accept all turns on Google Analytics and Microsoft Clarity; Essential only leaves them off. Nothing from either service is loaded until you press Accept all, and the site works exactly the same whichever you choose.

Essential cookies, set whatever you choose

These make the site work. None follows you to other sites and none sends anything to an advertising network.

• Signing in: the login cookies that keep you signed in (set by Supabase for this site).
• ebm_lang: the language you picked.
• A setting or two while you are signed in: which band an agency is looking at, and an owner's "view as".
• ebm_offline: that you switched the app to work offline.
• gm_demo_started: that you opened the demo, so the tour carries on where you left it.
• ebm_play: that you opened the site from the Google Play app.
• gm_calc_seed: a band you worked out in the free calculator, carried into a new band if you create one.
• gm_stage_seed: a stage plot you built in the free stage plot maker, kept for 7 days and carried into a new band if you create one. The plot you are working on is kept in your browser's own storage as gm_stage_draft, on your device only, until you press Start again or create the band.
• ebm_consent: your answer to the cookie question, kept for 12 months.
• ebm_src: which link, advert or site brought you here, kept for 30 days so that a sign-up can be counted against it, then cleared when you sign up. The advert's own click id is kept with it only if you press Accept all.

Analytics cookies, only if you press Accept all

• Google Analytics (_ga and _ga_followed by the site's id, kept for up to 12 months) counts visits and which pages are used, on the public site and inside the app. Google is told the page's address with anything private taken out (no email address, no invoice or invite link), your browser and device type, and a rough location worked out from your connection. Inside the app it sees only which area you are in, never a name, a gig or a figure. No advertising features, no Google signals, and nothing that links the visits to your account.
• Microsoft Clarity (_clck, kept for up to a year, and _clsk, kept for a day) shows how the public pages are used: where people click and scroll, as heatmaps and replays of a visit, with what you type hidden. It runs on the public pages only and never inside the app, where your pay and your band's details are, nor on a client's invoice or quote, an invitation, or the sign-in and sign-up pages.

Changing your mind

Your answer is kept for 12 months, and then the bar asks again. To change it sooner, use Cookies at the foot of any public page, or Settings → Your data once you are signed in. Choosing Essential only after Accept all deletes this site's Google Analytics and Clarity cookies from your browser and reloads the page without them.

The other companies involved

Each of these does one job for the app, and each gets only what that job needs:

• Supabase holds the database and your login, in London.
• Vercel runs the site. Its Web Analytics counts page views so we can see which parts of the site are used, and its Speed Insights measures how quickly pages load: neither sets a cookie or builds a profile, and the numbers are not linked to your account.
• Stripe takes the payment if you subscribe. Your card details go straight to Stripe and never touch this site. We never see, hold or store a card number. Stripe tells us only whether a subscription is running, what it covers and when it renews. Stripe's own notice is at stripe.com/privacy.
• Resend delivers the email the site sends: invoices, quotes, invitations and notifications. It gets the recipient's address and the message itself, and nothing else about you.
• Google works out driving distances: the app sends it two postcodes at a time and nothing else. If you choose to sign in with Google, Apple or Microsoft, that provider confirms your email address to us and we store nothing else from it. If a band connects a Google Sheet or a shared calendar, gig dates and times pass through Google to make that work, never your pay figures or contact details.
• Google (Google Analytics) and Microsoft(Clarity) measure how the site is used, only if you press Accept all on the cookie bar. What each sees is set out under Cookies above.
• If you turn on push notifications, your device's own notification service (run by Apple, Google or Mozilla) delivers them. We send it a message; we do not hand it your data to keep.

When you delete your account

You can close your own account at any time under Settings → Your data. When you do:

• Your name becomes "Former member" and every personal field is cleared: email, phone, postcode, address, date of birth, vehicle, dietary notes, emergency contact and social links.
• Your login is deleted, your places in bands and any management appointment are ended that day, and your notifications, notification settings, saved devices, unaccepted invitations and subscription details are removed.
• Statements, statement lines, expenses and the audit history stay. Those are the band's financial records of what it paid and to whom, and it is required to keep them: under UK GDPR we rely on the legal-obligation basis for that. They will simply no longer have your details attached.
• A band you created, run on your own and are the only member of is deleted along with your account, including the files stored for it. Every other band keeps its records exactly as they are.
• If you are the only person running a band that still has other people in it, the app asks you to hand that band on first (invite a manager, name a member to run it, or leave the band) so nobody is left locked out of their own gigs and pay.

Take a copy first if you want one: Download my data, on the same card, gives you everything of yours as a single file.

How long we keep it

We keep gig and pay records for as long as the band needs them for its own accounting. If you leave a band, your profile stays (so past gigs and statements still make sense) but a manager can remove your contact details on request. Files attached to a gig are removed a while after the gig has passed.

Your rights

You can see and correct most of your own details under Settings at any time, take a copy of everything that is yours with Download my data, and close your account yourself with Delete my account, both on the Your data card. For the one thing you cannot change yourself (your email address) ask a manager, or contact us.

Under UK GDPR you can also ask us what we hold about you, ask for it to be corrected or erased, object to how it is used, and complain to the Information Commissioner's Office (ico.org.uk) if you think we have got something wrong. The band you play in decides what goes into its own records; we keep the system that holds them.

Questions

Ask a manager of your band in the first instance, or write to us. Changes to this notice are dated at the top; anything that changes what you can rely on is flagged in the app, not just quietly updated here.