Privacy Policy

The controller within the meaning of Art. 4(7) GDPR is:

This policy covers bandosapp.com (website, public band pages and free tools) and app.bandosapp.com (the Band OS app). We have not appointed a data protection officer because none is legally required for our size; privacy questions go to the email address above.

Band OS is free to use for now, and we may add pricing later. No payment data is collected today. If we introduce pricing, we will update this policy before collecting any payment data and tell you in advance (see our Terms).

Please do not put health or other sensitive information in free-text fields. The optional reason on an unavailability (vacation) entry is visible to your whole band, so write “away”, not a medical reason. We do not ask for or need special categories of data (Art. 9 GDPR).

We do not use advertising or analytics trackers, we do not sell personal data, and we make no decisions about you by automated means or profiling (Art. 22 GDPR). Band OS contains no AI features that process your data.

• From you: when you request an account, fill in your profile, upload content, or use a form.
• From your band, owners and admins can invite you and enter your name or email. If you received an invitation you did not expect, email us and we will remove the entry.
• From Google: if you sign in with Google, we receive your name, email address and profile photo.

If you add other people’s personal data (for example bandmates’ emails), you are responsible for being allowed to do so, see our Terms.

We use the service providers below as processors (Art. 28 GDPR) under data processing agreements. They may only process data on our instructions. We do not share data for advertising.

Other recipients: the members of your band (what you share in a band is visible according to your band’s permissions), public visitors (only what a band publishes on its public page), and authorities where we are legally obliged to disclose data.

Some providers above process data in the USA or the United Kingdom. Such transfers rely on an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework for certified providers, or the decision for the United Kingdom) or on the EU Standard Contractual Clauses (Art. 44 ff. GDPR). You can request a copy of the safeguards by emailing us.

• Account and band data: for as long as your account or band exists. When you ask us to delete your account, or a band is deleted, we remove the data within 30 days unless the law requires us to keep it.
• Invitations: invitation links expire after 7 days; unused invitations can be revoked by band admins at any time.
• Fan page sign-ups: until the fan or the band asks for removal.
• Contact-form messages: until your enquiry is answered, and for up to 12 months afterwards for record-keeping.
• Server and hosting logs: only for the short period our hosting providers keep them for security and operation.
• Backups: copies held by our database provider are overwritten on its normal backup cycle after deletion.

Under the GDPR you have the right to:

• access the data we hold about you and receive a copy (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17) and restriction of processing (Art. 18);
• data portability: receive your data in a commonly used format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time with effect for the future (Art. 7(3)), for example to be removed from a band’s fan list.

To use any of these rights, email musik.espresso@gmail.com. We will answer within one month (Art. 12(3)). Today these requests are handled by us manually; we may ask you to confirm your identity first. You can already edit your profile and delete much of your own content inside the app.

You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in the EU member state where you live or work, or where the alleged infringement took place.

Band OS does not set tracking or advertising cookies. It only stores the small amount of data in your browser that is needed to keep you signed in and to remember your own settings. Details are in our Cookies & local storage notice.

Some features load content from other companies, which then receive your IP address and browser details directly:

• Videos on a band’s public page are embedded from YouTube using the privacy-enhanced domain (youtube-nocookie.com), only when a band has added a video.
• Song attachments that a band links from Google Docs, Sheets or Drive are shown through Google’s preview.
• Album art chosen from Pexels is loaded from Pexels’ servers.
• Optional lyric fonts. Our own website fonts are hosted by us, so a first-time visitor sends nothing to Google Fonts. If you choose additional lyric languages or fonts in your display settings (for example Tamil, Devanagari or Arabic), the matching font is loaded from Google Fonts whenever you use Band OS, and Google then receives your IP address.
• Links to Spotify, Apple Music, Instagram, Facebook and similar sites only transfer data if you click them; their own privacy policies then apply.

Connections to Band OS are encrypted (HTTPS). Access inside a band is controlled by roles and permissions, and sign-in is handled by Firebase Authentication. No system is perfectly secure; if a personal-data breach affects you, we will notify the authority and you as required by Art. 33 and 34 GDPR.

Band OS is for people aged 16 or over. We do not knowingly collect data from younger children. If you believe a child has signed up, email us and we will delete the account.

We will update this policy when our processing changes, for example before pricing and payment providers are introduced. The date at the top shows the latest version. For material changes we will inform registered users by email or in the app.

Questions or requests about your data: musik.espresso@gmail.com. Our full details are in the legal notice.