Privacy Policy

1. Who the controller is and what this policy covers

The data controller (within the meaning of the Serbian Law on Personal Data Protection, "ZZPL", and the EU General Data Protection Regulation, "GDPR") is:

This policy applies to:

• the GigCal app — the web version at gigcal-api.alphasoft.dev and the iOS and Android apps (same product, same data);
• the marketing website gigcal.alphasoft.dev;
• the GigCal widget — the public availability calendar a band can embed on its own website;
• the .ics feed — a calendar link you can add to the calendar app on your phone or computer.

When a band (a "tenant" in the app) enters data about its members, clients or event organisers, the band decides what it enters and why. For that data the band is the controller and we process it on the band's behalf as a service provider. If you have a question about data a band has entered about you, please contact the band's management first; we will help if the band does not respond.

2. What data we process

We collect only what the app needs to work. There are no advertising identifiers, no third-party analytics and no data purchased from other sources.

2.1. Account data

• Email address (required) — used to sign in with a one-time code we email you, for account notices and as the account identifier.
• Name or nickname — how band members see you in the calendar and briefing.
• Profile picture (optional).
• Phone number (optional) — so band members can call you; not public unless you add it to your public profile yourself.
• Password (optional) — if you set one, we store only a cryptographic hash (scrypt), never the password itself.
• Email verification status, account creation time, trial and subscription status (for the individual plan).

2.2. Band data

When you create or join a band we process: band name and short address (slug), city, description, genres, event types, profile and cover image, band contact details (phone, public email, Instagram/YouTube/website links), the list of members with roles (e.g. drummer, singer, sound engineer), titles and status, invitations (invitee's email address), membership requests and their messages, the roles and custom fields the band defines, a record of management actions (who changed what — "audit log"), the band's trial/subscription status and billing email.

2.3. Band gigs (events)

For each gig the band enters what it needs: date, title, venue, city, address or location, times (crew call, setup done, soundcheck, band call, doors, start and end), dress code, gear notes, description, custom fields, the name and phone of the contact person / organiser, fee and currency, band expenses, gig status (confirmed, offer, cancelled), and per-member assignments: role, call time, duty, instructions, your response to an offer (accepted / declined / held) and the gig's change history.

The organiser's name and phone are third-party data entered by the band for its own purposes; the band is responsible for having a basis to do so. This data is never shown publicly (not on the widget, not in the Network).

2.4. Personal gigs and calendar blocks

For gigs outside a band we process date, title, venue, city, note, status and participants. If you invite an external musician who is not on GigCal, we store the name, email and/or phone you entered so the invitation can reach them. Personal calendar blocks (date, title, note) are visible only to you.

2.5. Earnings (private)

If you use the earnings log we store amount, currency, date, gig title and note. Only you can see your earnings — neither band management nor other members have access. Band management separately tracks the band's fee and expenses per gig (section 2.3).

2.6. Public musician profile (optional)

If you enable visibility in the Network, other users can see: display name, city, short bio, instruments, whether you sing, genres, event types, rate card per event type, profile and cover image, and the contact details you enter yourself (phone, public email, website, Instagram, YouTube). The same applies to a band's public profile. You can turn Network visibility off at any time in your profile or band settings.

2.7. Website widget

The widget shows a public calendar of the band's free and booked dates. By default it shows booking status only — no client name, venue or any gig detail. The band can configure what the widget shows and which websites may load it. The widget sets no cookies and does not track website visitors; we record only when the embed key was last used.

2.8. Device and notifications

If you allow push notifications we store the device push token (Expo), platform (iOS/Android/web), app version and the time the device last checked in. We also keep the history of notifications we sent you (title, body, sent and read time) so you can review them in the app.

2.9. Billing

For subscriptions we store payment requests: product (band / individual plan / widget add-on), period, amount and currency, any promo code and discount, payment reference, status and payment time, plus administrator notes. While payment is by bank transfer (including IPS QR code), we do not receive or store card or bank account details — the payment goes through your bank. See also section 6 on card payments.

2.10. Technical data and security

• Server logs: IP address, device/browser type (user agent), time and address of the request — for security, troubleshooting and abuse prevention.
• Sessions: hashes of sign-in tokens, device user agent, last-used time — so you can review and revoke sign-ins.
• One-time sign-in codes: we store only their hash, attempt count and expiry.
• .ics feed: a token in the link that identifies your membership; you can regenerate it in the app, which invalidates the old link.

3. Purposes and legal bases

We do not use your data for automated decision-making or profiling that produces legal effects concerning you.

4. Who sees your data inside the app

• Members of your band see your name, picture, role and (if you entered it) phone number, as well as the band's gigs and your responses to offers. Band management (owner/admin) additionally sees the band's fee and expenses per gig.
• Your earnings are visible only to you.
• Your public profile (if enabled) is visible to other GigCal users in the Network. Bands and musicians you contact see the messages you send them (gig invitations, membership requests).
• The widget shows only what the band configures as public — by default just booking status per date.
• Other bands do not see your gigs; for an offer, only whether you have a clash on that day is shown, without details.
• Our administrators access data only to the extent needed for support, payment activation and security, and are bound by confidentiality.

We do not sell your data and do not share it with advertisers.

5. Processors, third parties and data transfers

To provide the service we use the following processors, with whom we have data processing agreements:

Data is primarily stored on servers in the European Union. Transfers to providers outside Serbia and the EU (e.g. push delivery) happen only with appropriate safeguards — standard contractual clauses and/or an adequacy decision (Serbia recognises EU/EEA countries as providing an adequate level of protection). We disclose data to public authorities only where legally required.

6. When card payments are enabled (Paddle)

Subscriptions are currently paid by bank transfer (with an IPS QR code) and activated manually. When we introduce card payments, we will do so through Paddle:

Our order process is conducted by our online reseller Paddle.com Market Ltd. Paddle is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

This means that when you pay by card you enter your card details directly with Paddle, not with us; we never see or store your card number. Paddle is an independent controller for the data it collects to process payments, prevent fraud and issue invoices, under its own privacy policy (paddle.com/legal/privacy). From Paddle we receive payment confirmation, the buyer's email, country and invoice details so we can activate the subscription and keep records. This section takes effect from the moment card payment is available in the app.

7. How long we keep data

• Account data and content you entered: for as long as the account exists. After you delete the account, data is removed from the live database immediately and from backups within 30 days at the latest.
• Band data (gigs, expenses, roles, fields): for as long as the band exists. If you delete your account while the band continues, the gigs and data you entered into the shared calendar remain with the band, but your membership, assignments, responses and personal data are removed and the link to your account ends. A band is deleted by its management; deleting a band deletes all its gigs, memberships, widget keys and invitations.
• Earnings and personal gigs: deleted together with the account.
• Payment records and invoices: for the statutory period under Serbian accounting and tax regulations, also after account deletion.
• Server logs: up to 30 days, unless needed to investigate a security incident.
• Sessions and tokens: until expiry or revocation; expired tokens are purged periodically.
• Push tokens: until you disable notifications, sign out of the device, or the provider reports the token as invalid.
• Notification history and the band audit log: for as long as the account or band exists.

8. Deleting your account

You can delete your account yourself at any time:

1. In the app: Bands / Profile → Account → "Delete account". Confirm, and the account is deleted together with all personal data listed in section 7.
2. By email: send a request from the address the account is registered to, to [[EMAIL]]. We will process it within 30 days at the latest and confirm the deletion.

If you are the only administrator of a band, transfer management to another member or delete the band before deleting your account — otherwise we will contact you to resolve that first. Deleting your account does not cancel subscriptions the band has already paid for (they belong to the band); for refunds see the Refund Policy.

9. Your rights (Serbian DPA and GDPR)

Under the ZZPL, and for users in the European Union and European Economic Area also under the GDPR, you have the right:

• of access — to learn what data we process about you and obtain a copy;
• to rectification — most data you can edit yourself in the app (profile, band, gigs);
• to erasure ("right to be forgotten") — see section 8;
• to restriction of processing and to object to processing based on legitimate interest;
• to data portability — to receive your data in a machine-readable format (e.g. the .ics feed for gigs; on request an export of other data in JSON/CSV);
• to withdraw consent at any time (push notifications — in device or app settings; public profile — by turning visibility off), without affecting the lawfulness of processing before withdrawal;
• to lodge a complaint with a supervisory authority. In Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11120 Belgrade, poverenik.rs). Users in the EU/EEA may contact the supervisory authority in their own country.

Send requests to [[EMAIL]]. We respond without undue delay and within 30 days at the latest; to protect your account we may ask you to send the request from your registered email address or verify your identity in another way.

10. Children and age

GigCal is intended for people who are at least 16 years old. We do not knowingly collect data from younger persons. If we learn that an account was created by someone under 16, we will delete it. If you are a parent or guardian and believe a child has given us data, contact us at [[EMAIL]].

11. Cookies, local storage and tracking

• The marketing website (gigcal.alphasoft.dev) uses no cookies, no analytics and no third-party scripts. The only external resource is the Inter font from Google Fonts, for which your browser makes a standard font-file request to Google.
• The web app uses only the browser's local storage (localStorage) to keep your session (sign-in tokens), chosen theme and minor preferences. No third-party cookies, no tracking tools, no ads.
• The mobile app stores the session in the device's secure storage. It uses no advertising or third-party analytics SDKs.
• The widget sets no cookies on the band's website and does not track visitors.

12. Mobile app permissions

• Notifications — to receive briefings, offers and gig changes. Optional; the app works without it.
• Photos / camera — only when you choose a profile or band picture yourself. We access only the image you select.
• The app does not request location, contacts or microphone access. You can fill your phone's calendar via the .ics link, without granting calendar access.

13. Security

We apply technical and organisational measures appropriate to the risk: all traffic goes over HTTPS; passwords are stored as scrypt hashes with a unique salt; one-time sign-in codes have a limited number of attempts and a short validity; session tokens are rotated and can be revoked; access to band data is role-based (a member sees only what is intended for their role, finances are visible only to management); the widget loads only from approved domains; the database is backed up regularly and server access is restricted and key-protected. No system is absolutely secure — if a data breach occurs that may put your rights at risk, we will notify you and the competent authority within the statutory deadlines.

14. Changes to this policy

We may update this policy from time to time, e.g. when we introduce a new feature or a new processor (such as card payments). The date of the last change is shown at the top. We will notify you of significant changes in the app or by email before they take effect. Continuing to use the app afterwards means you have taken note of the updated policy.

15. Contact

For any privacy question, to exercise your rights or to report a problem:

See also the Terms of Use and the Refund Policy.