Privacy Policy

Tom Froehlich

Email: contact@stagelist.pro

Postal address: see the legal notice.

This policy covers stagelist.pro, the artist pages on name.stagelist.pro and the artist pages on custom domains that stagelist hosts.

To create an account we need your email address and a password. The password is stored only as a hash by our authentication provider (Supabase). We use your email address to sign you in and to send you emails about your account.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

Everything you add to your page is public by design: your artist name, bio, profile picture, banner, links, uploaded files, dates, social profiles, genres and, if you enter one, your booking email address. You decide what you add and can change or remove it at any time in your dashboard. With the “Public profile” setting you can take the whole page offline.

Location. City and country are shown on your page and in the directory if you enter them. Your postal code is only used internally for geographic sorting. It is never shown on any page and is not available through our public interface.

Legal basis: Art. 6(1)(b) GDPR.

Public profiles are listed in the artist directory (stagelist.pro/discover) by default. You can turn this off at any time with the “Show in artist directory” setting.

Dates you add appear on stagelist.pro/events and on a page for that night, together with other artists who entered the same night, and on a page for the venue. These pages show only artists whose profile is public and listed in the directory.

Once a week we may present upcoming nights from these pages in a post on our own social media channels (Instagram). The post shows what the event pages show and names the artists, with their Instagram handle if they entered one on their page, so that they can share it. Artists who are not listed in the directory do not appear. If you do not want to be included, turn off the directory setting or write to us.

Legal basis: Art. 6(1)(b) GDPR, as these listings are part of the service; for the social media posts Art. 6(1)(f) GDPR (legitimate interest in presenting the events entered on stagelist).

Artists you like or save to a collection are stored with your account. Nobody else can see them, including the artists themselves.

Paid plans are sold through Lemon Squeezy, which acts as merchant of record. Lemon Squeezy collects and processes your payment details under its own privacy policy. We do not see your card or bank details. We receive a customer ID, the status of your subscription and its renewal date, so that we can unlock the features of your plan.

Legal basis: Art. 6(1)(b) GDPR.

With the Pro plan we register your domain in our own name with our registrar (Spaceship), so your personal data is not entered in the domain registration.

Your booking mailbox is hosted by Migadu (Switzerland). To set it up we pass your artist name and your account email address to Migadu, which sends you the access details. Emails you send and receive in this mailbox are stored by Migadu.

Legal basis: Art. 6(1)(b) GDPR.

Emails about your account, domain, subscription and password are sent through Resend. You receive them as long as you have an account.

Two emails are optional: a one-time reminder if your profile is incomplete, and a monthly summary of your page statistics (Starter and Pro). Each of them contains an unsubscribe link, and you can turn them off in your account settings. For these optional emails we keep a short send log (type of email, date, delivery status and the name of your page at that time), so that we can answer the question whether an email was sent. Entries are deleted after 12 months. When you delete your account, the page name is removed from the log, so that only type, date and status remain.

Legal basis: Art. 6(1)(b) GDPR for account emails, Art. 6(1)(f) GDPR (legitimate interest in helping you complete and use your page) for the optional emails.

If you report a profile, the page address and your message are sent to us by email. We also receive a short notice that a report came in, without its content (see Telegram in section 15). We do not store your IP address with the report.

Our pages are hosted by Vercel. When you open a page, Vercel processes technical access data such as your IP address, browser type and the time of the request in order to deliver the page and to protect it against abuse. To limit abuse of forms, our servers also keep IP addresses briefly in memory; they are not stored.

Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation).

We count page views and clicks on artist pages; artists on Starter and Pro can see these numbers in their dashboard. Only daily totals are stored (for example the number of page views per day). We do not store IP addresses, device data or any identifier, and we do not use cookies or fingerprinting for this.

We use the same method on our own pages (homepage, information and pricing pages, sign-up): we count how often a page was opened and how often certain elements were used, for example a button. Only daily totals are stored, never individual visits, so visitors cannot be recognised or followed across pages or visits. We do not use any third-party analytics service.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing statistics to artists and in understanding how our website is used).

We only use what is necessary for the service. In particular:

• login cookies of our authentication provider, which keep you signed in;
• sl_auth, which only decides whether a “Dashboard” or a “Log in” button is shown;
• cookie_consent, which remembers that you closed the cookie notice;
• local storage in your browser for interface states, for example a banner you closed or your position in a list.
• on artist pages, if you choose “Always load” for a player provider: that choice, stored only in your browser (see section 13).

We do not use tracking, advertising or analytics cookies. Legal basis: § 25(2) TDDDG and Art. 6(1)(f) GDPR.

Artists can embed players from YouTube, Spotify, SoundCloud and Mixcloud. Until you press play, the page shows a preview served by us, and the provider is not contacted. When you press play, the player is loaded from the provider, which receives your IP address and may set cookies or use browser storage under its own privacy policy. YouTube players are loaded through youtube-nocookie.com.

With “Always load” you can allow a provider’s players to load directly on that page in your browser. You can withdraw this at any time with “Stop” below any such player.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

When an artist adds a link, our server retrieves the title and preview image of that page. Preview images from sites that our image service cannot deliver are copied to our own storage right after the link is saved, so that visitors’ browsers do not contact the original site. If copying fails, the image is loaded from the original site until a daily job copies it; in that time, that site receives the IP address of visitors who open the page.

• Supabase: database, authentication and file storage, servers in the EU (Ireland). Supabase Inc. is based in the USA.
• Vercel: hosting and content delivery (USA).
• Resend: sending emails (USA).
• Migadu: booking mailboxes (Switzerland).
• Lemon Squeezy: payments, as merchant of record (USA).
• Spaceship: domain registration, in our name.
• Telegram: notifications to us about events such as new sign-ups, subscriptions, domains or reports (United Arab Emirates). They contain an account ID at most, never names, addresses or the content of a report. Our weekly social media post (section 4) also reaches us this way; it contains only what is public on the event pages.

Where data is transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework or on standard contractual clauses. Switzerland is covered by an adequacy decision of the European Commission. For the United Arab Emirates there is no adequacy decision; we therefore send Telegram only pseudonymous IDs and information that is already public.

We keep your data as long as your account exists. When you delete your account, your profile, links, dates, likes, collections and uploaded files are deleted. The email send log described in section 8 keeps type, date and status without your page name for up to 12 months. Data we have to keep for legal reasons is an exception. While a domain is still connected to your account, it can only be deleted after the subscription has ended and the domain has been released.

Under the GDPR you have the right to access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on Art. 6(1)(f). To exercise these rights, write to contact@stagelist.pro.

You also have the right to lodge a complaint with a data protection supervisory authority.