Privacy Policy

This policy explains what personal data Bandpit("we", "us") collects, why, and your rights over it. Bandpit is a web app that helps bands store songs, build setlists, play live in sync, and run a public band page. If you have questions, contact us at hello@bandpit.app.

Data we collect

• Account: your name and email, and either a hashed password or, if you use Google sign-in, the basic profile Google shares (name, email, avatar). We never see your Google password.
• Band content: the songs, lyrics, chords, tabs, setlists, gigs, links, and images you add.
• Payments: handled entirely by Stripe. We store your plan and Stripe customer/subscription identifiers, but never your card number.
• Technical: standard server logs (IP address, browser, timestamps) needed to run and secure the service, and the essential cookie that keeps you signed in.
• Feedback you choose to send us in the app.

How we use it

To provide and secure the service, process subscriptions, respond to you, and improve Bandpit. Our legal bases (GDPR) are performing our contract with you, our legitimate interest in running and improving the service, and your consent where it applies. We do not sell your data or use it for advertising.

Who processes it

We share data only with providers that help us run the service:

• MongoDB Atlas — database hosting (EU, Stockholm region).
• Vercel and Fly.io — application and real-time hosting.
• Stripe — payment processing.
• Google — only if you choose Google sign-in.

Where your data lives

Your data is stored in the EU (Stockholm). Some providers may process limited data elsewhere under appropriate safeguards.

Retention

We keep your data while your account is active. You can delete your account at any time from your account page, which removes your profile; bands where you are the only member are deleted with their content. Backups and logs age out on a rolling basis.

Your rights

Under the GDPR you can access, correct, export, or delete your data, and object to or restrict certain processing. Account deletion is available directly in the app. You also have the right to complain to your data protection authority (in Finland, the Office of the Data Protection Ombudsman / Tietosuojavaltuutettu). To exercise any right, contact hello@bandpit.app.

Public band pages

If a band enables its public page, the information it puts there (name, bio, links, gigs, images) is intentionally public. Don't put anything there you don't want the world to see.

Children

Bandpit is not intended for children under 16.

Changes

We'll update this page if our practices change and revise the date above.