Privacy Policy

1. Who We Are

Band Social is a software-as-a-service platform for bands, artists, band managers, and music teams. It helps users manage social media scheduling and publishing across Facebook, Instagram, TikTok, and YouTube, create public band pages, electronic press kits, event calendars, photo galleries, and related operational data.

For the purposes of applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Lavinci Portugal Unip. Lda. is generally the controller of personal data collected directly from account users.

Where users upload, import, or enter personal data about third parties, such as band members, contacts, or other business contacts, the user may be the controller of that data and Band Social may act as a processor by hosting and processing that data on the user's behalf.

2. Scope of This Policy

This Privacy Policy applies to personal data processed when you:

• visit or use Band Social;
• create or manage an account;
• create or manage band profiles;
• connect social media accounts;
• create, schedule, and publish social media posts;
• upload media files such as images and videos;
• create and manage public band pages and press kits;
• manage events, photo galleries, and albums;
• contact us for support;
• subscribe, pay, cancel, or request a refund.

This policy does not apply to third-party websites or services that are not controlled by us.

3. Personal Data We Collect

Depending on how you use Band Social, we may collect and process the following categories of personal data.

Payments are processed through Stripe; we do not store full card numbers on our own systems.

4. How We Use Personal Data

We use personal data to:

• create and manage user accounts;
• authenticate users through email/password login or Google SSO;
• provide the Band Social platform and its features;
• store and manage band data, social media accounts, posts, media, events, and galleries;
• publish posts to connected social media platforms;
• host public band pages and electronic press kits;
• manage subscriptions, billing, refunds, and payment status;
• provide support and respond to requests;
• secure the platform and prevent fraud, abuse, spam, or unauthorized access;
• troubleshoot errors and improve reliability;
• comply with legal, tax, accounting, and regulatory obligations;
• enforce our Terms of Use.

5. Legal Bases for Processing

Where GDPR applies, we rely on one or more of the following legal bases:

• Contractual necessity: to provide the Service, manage accounts, process subscriptions, and deliver requested features.
• Legitimate interests: to secure, maintain, improve, and protect Band Social, prevent abuse, respond to support requests, and manage business operations.
• Legal obligation: to comply with applicable tax, accounting, consumer protection, data protection, and legal requirements.
• Consent: where we ask for specific consent, such as for optional communications or features that legally require consent.

6. Hosting, Database, and Service Providers

Band Social is hosted using cloud infrastructure providers.

We may also use selected third-party providers to operate the Service, including:

• cloud hosting and database infrastructure providers;
• Stripe for payment processing and subscription billing;
• social media platform APIs (Facebook, Instagram, TikTok, YouTube) for post publishing;
• cloud storage providers for media files;
• Google for authentication (SSO) and, where you consent, Google Analytics for website and app usage statistics;
• technical providers for security, monitoring, infrastructure, or support.

These providers may process personal data only as necessary to provide their services to us and are expected to protect personal data using appropriate technical and organizational measures.

7. International Data Transfers

Because Band Social uses cloud-based service providers, personal data may be processed or stored outside Portugal or the European Economic Area.

Where personal data is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place, such as contractual protections, standard contractual clauses where applicable, or reliance on providers that maintain appropriate data protection and security standards.

8. Cookies and Analytics

Essential cookies. Band Social sets cookies that are necessary for login, session management, authentication, security, and operation of the platform, including a cookie that records your cookie choices. These are required for the Service to work and are not used for tracking or advertising.

Analytics. We use Google Analytics 4, provided by Google, to understand how our website and app are used — for example which pages are visited, how visitors arrive, and the approximate country and device type. This helps us improve the product and our marketing pages. Google Analytics processes technical data such as browser and device information, referring page, and the pages you view. Google Analytics 4 does not log or store IP addresses; IP data is used only to derive approximate location and is then discarded.

We use analytics for aggregate, statistical purposes only. We do not use it to build advertising profiles, and Band Social serves no advertising.

Consent. Analytics storage is set to denied until you choose otherwise (Google Consent Mode). We ask for your consent the first time you visit, and no analytics cookies are set unless you accept. You can change or withdraw your choice at any time using the Cookie settings control, also available in the site footer. Where we rely on consent, withdrawing it is as easy as giving it.

Advertising. Band Social runs no advertising and loads no advertising or remarketing tags. Advertising storage — including ad personalisation and the sharing of ad-related user data — is permanently set to denied, so there is nothing for you to decide about it. If that ever changes, we will ask for separate consent before any advertising tag loads.

We do not use Meta Pixel, Hotjar, session-recording, or similar tracking tools. You can also block or delete cookies in your browser settings, or install Google's Analytics opt-out browser add-on. Google's handling of this data is described in the Google Privacy Policy.

If our use of cookies or analytics changes, we will update this Privacy Policy and, where required, request consent again.

9. Disclosure of Personal Data

We do not sell personal data.

We may share personal data with:

• service providers that help us operate Band Social;
• Stripe and payment-related providers;
• social media platforms where you connect accounts and publish content;
• authentication providers;
• professional advisers, such as accountants or legal advisers, where necessary;
• public authorities, courts, or regulators where required by law;
• another entity in connection with a merger, acquisition, restructuring, or sale of the business, subject to appropriate safeguards.

We may also disclose data where necessary to protect our rights, users, systems, security, or to investigate fraud, abuse, or unlawful activity.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this policy.

In general:

When data is no longer needed, we delete, anonymize, or securely retain it where legally required.

11. Security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• secure hosting infrastructure;
• access controls;
• authentication protections;
• HTTPS/TLS encryption in transit;
• role-based access where applicable;
• monitoring and logging for security and troubleshooting;
• limiting access to data to authorized personnel and providers who need it.

No online service can guarantee absolute security. You are responsible for protecting your login credentials and keeping your account secure.

12. Your Rights

Subject to applicable law, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing based on legitimate interests;
• request data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with a data protection authority.

In Portugal, the relevant supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

Two of these you can exercise yourself, immediately, without asking us: Settings → Account has Export my data (a machine-readable copy of your account and every band you belong to — access and portability) and Delete my account (erasure). For anything else, contact us at support@band.social.

We may need to verify your identity before fulfilling a request. Some requests may be limited where we need to retain data for legal, tax, accounting, security, fraud prevention, or contractual reasons.

13. Account and Data Deletion

You can delete your account yourself, at any time, from Settings → Account. Before it goes ahead you are shown exactly what will happen: which bands are deleted with the account, which ones carry on without you, and anything that has to be sorted out first. You can also delete an individual band, with everything in it, from that band's page. You may still write to support@band.social instead if you prefer.

Deleting your account removes your profile, your posts, your connected social accounts, and any band you are alone in — including that band's uploads, and cancelling its subscription. Deletion of the account data itself is immediate, not queued.

A band with other members in it is never deleted as a side effect of closing your account. If you own such a band, we ask you to transfer ownership to another member first (or remove them and delete the band deliberately), so that nobody loses a workspace they are still using. The same applies where a band that would outlive your account is billed to you: an owner needs to take the subscription over first.

Some data outlives the deletion, for reasons we cannot set aside: our payment provider retains invoices as financial records required by tax and accounting law, and encrypted backups age out on their own schedule. No further charges are made once a subscription is cancelled.

14. Children

Band Social is intended for professional, business, and music project management use. It is not directed at children.

We do not knowingly collect personal data from children. If you believe a child has provided personal data to Band Social, contact us at support@band.social so we can take appropriate action.

15. Automated Decision-Making

Band Social does not use automated decision-making that produces legal or similarly significant effects on users.

We may use limited automated checks for security, authentication, abuse prevention, or fraud prevention. These checks are used to protect the platform and users.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When changes are material, we will take reasonable steps to notify users, such as by email or through the platform.

The updated version will apply from the date it is posted or otherwise communicated.

17. Contact

For privacy questions or requests, contact: