Privacy Policy

BandUp is a platform that brings a band's rehearsal and stage workflow into one
place. This policy explains which of your personal data we process, why we
process it, and what rights you have over it.

We have tried to keep this readable. If anything is unclear, write to us at
info@bandup.io.

1. Who we are

BandUp is a product of UBIG Teknoloji A.Ş. In this policy, "we", "us", "BandUp"
and "the Company" all refer to UBIG Teknoloji A.Ş., which is the data
controller.

2. What this policy covers

This policy applies to all BandUp services: the bandup.io website, the BandUp
web application, the iOS and Android mobile apps, the Apple Watch app, and the
websites bands publish with BandUp (band sites). Processing that concerns
visitors of band sites is described in 4.10.

Third-party services you connect to BandUp — for example Google, Facebook or
Apple when you use social sign-in — are governed by their own privacy policies.

3. Two kinds of data: band data and platform data

Data in BandUp falls into two categories. The distinction matters because it
determines how you exercise your rights.

Band data. Everything you put into a workspace: songs, lyrics and chords,
notes, setlists, calendar events, availability blocks, the tech rider and the
files you upload. Control over this data belongs to the band — its owner and
admins can access, edit and delete it. BandUp hosts and processes it on the
band's behalf.

Platform data. What we collect to run your account, deliver the service and
keep it secure: your account details, session records, preferences, billing
records and technical logs. We are the controller for this data.

When you leave a band or a band is deleted, the content you contributed stays
with — or is deleted along with — that band. The platform data tied to your
account follows the retention rules in this policy.

4. What we process

4.1 Account and profile

• Email address and password (we store only an irreversible hash — we never see
  your actual password)

• First and last name (asked during onboarding, not at sign-up; a single name is
  valid)

• Profile photo (optional)

• Instruments you play (optional)

• Country code — determined at sign-up from your IP address using a database
  that runs locally on our own server, with no data leaving it (see section
  6, "processing that never leaves our servers")

• Language, theme and notification preferences

• If you use social sign-in: the name, email and profile photo returned by the
  provider, plus your provider account identifier

4.2 Band content

Song titles, artists, key and tempo information, lyrics and chords, personal
and band notes, stage setup lists, setlists, calendar events, availability
blocks, date polls and their comments, tech rider content, and files you
upload (sheet music, PDFs, images).

If your band sets up a band site, its content is added to this: the band
profile (logo, introduction, the answers given during setup), the line-up shown
on the site, contact details (the contact person's name, email address and
phone), gallery photos, social media and music links, the page text, and the
conversation with the site assistant together with the images attached to it.

4.3 Subscription and payment

Plan and subscription status, billing period, invoice history, and transaction
records received from our payment provider.

We never see or store your card details. Payments are taken by Paddle acting
as our Merchant of Record; your card details go directly to Paddle. BandUp has
no in-app purchases — all payments are made on the web.

4.4 Location

Location data is processed only in the Listings section and only with your
permission.

• When posting a listing: if you allow location sharing, your coordinates are
  stored rounded to 2 decimal places (roughly 1.1 km). Your exact
  coordinates are never written. If you decline, your listing is placed at the
  centre of the city you selected — posting is never blocked.

• When browsing listings: your device location is used only to sort results
  nearest-first and to compute the distance badge, again rounded, and it is
  not stored. Without permission, results are sorted newest-first and no
  functionality is disabled.

Every listing requires a country and city, which you enter yourself.

4.5 Device, session and security

• Session records: sign-in time, IP address, browser/device information and the
  country derived from it. You can see these under Settings → Active Devices and
  revoke any session.

• Push notification device tokens and platform (iOS/Android/web)

• Consent records: the permissions you grant or withdraw, with a timestamp, IP
  address and browser information (we keep these to meet our legal burden of
  proof)

• Policy acceptance records: which version you accepted and when

4.6 Listings and messaging

Your listing content, images attached to listings, the messages you send and
receive, reports, blocks and moderation records.

Listings are independent of workspaces: when posting, you can present
yourself as an individual or as a band you belong to. On listings posted under a
band's name, the other party sees the band's name rather than yours.

4.7 Technical logs

Error records, crash reports, performance measurements and server access logs.
These exist to keep the service running and to diagnose faults.

4.8 Usage analytics and session replays

We use Microsoft Clarity to understand how the product is used. Clarity
records which pages and screens you open, where you click or tap, how far you
scroll, your browser and device details, the app version, and the approximate
location (country/city) derived from your IP address; a session replay is built
from those interactions.

Text you type into form fields is masked and your passwords are never recorded.
When you are signed in, your user identifier is sent to Clarity so that recordings
can be matched to your account. This data is processed by Microsoft Corporation,
is not used for advertising, and may be transferred outside the European Union.

On the web, Clarity runs only if you consent to analytics cookies, and stops when
you withdraw that consent. For the mobile apps you can request deletion of your
recordings at info@bandup.io.

4.9 Cookies

See the Cookie Policy.

4.10 Visitors of band sites

Band sites use no cookies and carry no analytics or advertising tools.

• Counting visits. To show a band how many visitors its site gets, we derive
  an irreversible digest from your IP address and browser details that is
  specific to that day and that site. It is used only to count a visitor who
  returns on the same day once, and it is deleted automatically at the end of
  the day. Your IP address and browser details are not stored; the only thing we
  keep is the site's daily total of visits and unique visitors.

• Services your browser connects to directly. The page's fonts load from
  Google Fonts and its animation library from jsDelivr; if the band added a
  video, YouTube's cookie-free player (youtube-nocookie.com) is used. While these
  load, your IP address and browser details reach those services.

• Custom domains. When a band site is published on the band's own domain,
  the request is routed through Cloudflare.

4.11 AI features

Some features send your content to an AI provider to carry out your request.
They run only when you start them.

• Scan a sheet. When you take or upload photos of a sheet (up to 5), the
  photos are sent to Anthropic to read the lyrics and chords. Your name,
  email or band details are not sent with them. The photos are deleted right
  after they are read; the text that was read is stored nowhere unless you save
  it to the song. Word (.docx) files are read on our server without being sent
  to AI.

• Band site. While a band's site is built, and while you talk to the site
  assistant, the band's name, genres, the answers given during setup, the logo,
  the page text, the messages written to the assistant and the images attached
  to them are sent to Anthropic. Members' names, photos, contact details and
  show dates are not sent to AI; they are added to the site when the page is
  shown.

• Band site images. The images on a site are generated by Google (Gemini
  API) from a text made of an image description written for the site's design
  and the band's genres. Generated images are marked as AI-generated.

4.12 Calendar connection

• Google Calendar. When you connect it, BandUp can reach only the separate
  calendar it creates in your Google account; it cannot see your other
  calendars. For the connection we store your Google account's email address,
  the ID of the calendar created and an encrypted refresh token. Your bands'
  events are written to that calendar: event type, band name, event note,
  location, date and time. You choose which bands and which event types are
  included, and you can disconnect at any time.

• Calendar subscription link (ICS). You can create a personal subscription
  link for apps such as Apple Calendar or Outlook. Anyone who has that link can
  see the same event details (see section 7); you can revoke the link at any
  time.

5. Why we process it, and our legal bases

You can withdraw consent at any time for anything based on it. Withdrawal
does not affect the lawfulness of processing carried out beforehand.

We do not carry out automated decision-making. We do not make decisions about
you based solely on automated processing that produce legal effects or similarly
significantly affect you. We do not profile you or score you based on your
behaviour.

For users in Türkiye, a separate disclosure notice prepared under Law No. 6698
also applies: KVKK Aydınlatma Metni.

6. Who we share it with

We do not sell your data. We do not share it with third parties for
advertising.

Your data is shared only in these situations:

• With other members of your band. When you join a workspace, your name,
  profile photo, instruments and the content you contribute become visible to
  its members.

• With our service providers (subprocessors). We have a data processing
  agreement with each of them, and each may access only the data needed to
  provide its own service:

  • Railway — hosting, application servers and database (European Union)

  • Cloudflare — content delivery, file storage (R2) and routing of band
    sites (custom domains included)

  • Paddle — payment, invoicing and subscription management (Merchant of
    Record; card details go to Paddle, never to us)

  • Resend — transactional email (verification, invitations, password reset)

  • Google (Firebase Cloud Messaging) — push notification delivery

  • Google, Apple, Facebook — sign-in, and only if you choose to use social
    sign-in

  • Better Stack — error tracking and technical logs

  • Microsoft (Clarity) — usage analytics and session replays

  • Anthropic — reading sheets with AI and writing band site text (see 4.11)

  • Google (Gemini API) — generating band site images (see 4.11)

  • Google (Google Calendar) — only if you connect your calendar, writing
    your events to it (see 4.12)

  • Google Fonts, jsDelivr — loading fonts and the animation library into a
    band site visitor's browser (see 4.10)

• With the other party in Listings. When you message a listing, your name and
  profile photo — or the band's name if you are writing on a band's behalf —
  become visible to them.

• Where legally required. In response to a lawful request from a competent
  authority. We review such requests for validity and, where legally permitted,
  inform you.

• In a corporate transaction. In a merger, acquisition or transfer of assets,
  your data may pass to the acquirer. You will be told in advance.

Processing that never leaves our servers. Deriving your country from your IP
address and parsing browser/device information are both done with a local
database and libraries running on our own server. Neither operation sends a
request to any external service.

7. When your data becomes publicly accessible

These features, when used on purpose, make content reachable without signing
in:

• Band sites. When a band's owner or admin publishes its site, the following
  become public: the band's name, logo and introduction; the first and last
  name, photo and instruments of the members shown in the line-up; the date,
  time and venue of upcoming shows (rehearsals and other events are not shown);
  contact details, gallery photos, social media and music links. At setup the
  band's members at that time are added to the line-up; the band's owner and
  admins change the line-up, contact details and gallery, and see who will
  appear before publishing. If you do not want to appear on the site, ask your
  band's admin to remove you from the line-up, or ask us at info@bandup.io.
  Band sites are listed by search engines unless the band turns this off in its
  settings.

• Calendar subscription link. Anyone who has an ICS link you created can see
  the events of the bands you chose (type, band name, note, location, date).
  Once you revoke the link it returns an empty calendar.

• Tech rider sharing. When a band admin turns sharing on, anyone with the
  generated link can view the rider — which includes band members' names,
  instruments and the owner's contact details. The page is excluded from search
  engines (noindex), but anyone holding the link can reach it. Sharing can be
  switched off at any time.

• Listings. A published listing can be viewed without signing in on our
  public listing pages. The owner's identity is hidden there; contacting them
  requires signing in.

8. International transfers

Your data is hosted within the European Union.

Some of our subprocessors are established outside the EU. For those transfers we
rely on the Standard Contractual Clauses approved by the European
Commission and, where applicable, the EU-U.S. Data Privacy Framework. For
transfers from Türkiye we sign the standard contract published by the
Turkish Data Protection Board under Article 9 of Law No. 6698 and notify the
Authority accordingly. The providers we use are listed in section 6.

9. How long we keep it

If you delete your account, you can restore it within the 30-day window by
signing in with the same credentials. After that, the account row is not deleted
but anonymised: your name, email and other identifiers are cleared. This is
because deleting the row outright would also remove your votes, polls and
comments inside bands, corrupting other members' data.

10. Security

Passwords are stored as irreversible hashes. All traffic is encrypted with TLS.
Session cookies are set with the HttpOnly, Secure and SameSite flags and
with the browser-enforced __Host- / __Secure- prefixes. Access is limited by
role-based authorisation, and every query is scoped to the relevant band.

No system is perfect. If a breach affects your personal data, we will notify the
competent authority within the statutory deadline and — where the risk is high —
notify you.

11. Your rights

Depending on where you are, you have the right to:

• Access your data and request a copy

• Have inaccurate or incomplete data corrected

• Request deletion of your data

• Request restriction of processing

• Receive your data in a structured format (portability)

• Object to processing based on legitimate interests

• Withdraw consent you have given

• Seek compensation for damage caused by unlawful processing

You can exercise many of these yourself: correct your profile in Settings, revoke
sessions, turn off marketing consent, and delete your account from Settings →
Account. Step-by-step instructions, including how to delete your account without
signing in, are on the Account deletion page. For anything
else, write to info@bandup.io; we respond within 30 days at the latest.

Users in the European Economic Area and the United Kingdom may lodge a
complaint with their local data protection authority.

Users in Türkiye may exercise the rights in Article 11 of Law No. 6698 by
writing to the address above or through the other methods the Law provides, and
may complain to the Personal Data Protection Board if unsatisfied with our
response.

California residents: we do not sell or share your personal information. You
may exercise your CCPA/CPRA rights to know, delete and correct through the
address above, and we will not treat you differently for doing so.

12. Age limit

BandUp is not for anyone under 16.

If we learn that we have unknowingly collected data from someone under 16, we
delete it. If you are aware of such a case, tell us at info@bandup.io.

13. Changes to this policy

When we update this policy we change the "Last updated" date on this page. For
material changes we notify you by email or in the app and, where necessary, ask
you to accept the new version.

14. Contact us

For any privacy question, request or complaint:

UBIG Teknoloji A.Ş.
Caferağa Mah. Moda Cad. No: 5, 34710 Kadıköy/Istanbul, Türkiye
info@bandup.io