Privacy policy

Downstage is currently in a small private beta with a handful of bands. This policy describes what we collect and why, in plain language — if anything here is unclear, email us at nelson.lopezchirinos@gmail.com and we'll clarify or fix it.

Depending on how you use Downstage, we hold:

• Account: your email address, used to sign you in.
• Artist/band profile: name, bio, location, musical styles, instruments, socials, and press kit — whatever you choose to fill in, shown to bands and promoters you work with.
• Cachet dossier (musicians only, and only if you fill it in): legal name, date and place of birth, social security number, "congés spectacles" number, family status, profession, phone, address, and banking details (IBAN/BIC, or bank name, account number, and routing/sort code for non-IBAN countries) — the administrative information French intermittent-du-spectacle payroll requires.
• Documents: whatever you upload to your vault — ID, residence permit, medical certificate, health insurance card, vehicle registration, passport, RIB. PDF, JPG, or PNG only, 10MB max per file.
• Band/tour data: dates, venues, call sheets, your response to each one, and songs/setlists if your band uses the music vault.

Your artist profile exists so bands and promoters can find and book you — that's processing necessary to provide the service you signed up for. The cachet dossier and documents exist because a band manager legally needs this information to pay a musician correctly under French intermittent-du-spectacle rules — that's a legal obligation, not something Downstage asks for out of general curiosity, only where the feature genuinely needs it. If you upload a medical certificate specifically, it's held under that same French social-security-law basis, not because we want health information for its own sake.

We built access around one rule: the more sensitive the data, the fewer people see it.

• Your name, location, instruments, and styles are visible to any signed-in user, so managers can find you when building a roster.
• Your fuller profile (bio, socials, press kit) is visible to managers of bands you're an active member of.
• Your cachet dossier and uploaded documents are visible only to managers of bands you're an active member of — never to bands you've merely been invited to, and never to anyone else on Downstage.
• Nothing is ever public or searchable outside Downstage.

This is enforced at the database level (row-level security), not just hidden in the app's interface.

Downstage runs on Supabase, hosted in the EU (Ireland). Documents live in private storage and are only ever accessed through short-lived, one-time links generated when you or your manager actually open them — never a permanent public URL.

We use a small number of service providers to run Downstage, and share only what each one needs to do its job:

• Supabase — database, file storage, and sign-in.
• Resend — sends invite and magic-link emails on our behalf.
• Google — only if you choose "Continue with Google" to sign in.
• Mapbox — powers the address-search boxes (venue and city fields). What you type is sent to Mapbox, live, to suggest matching addresses as you type. These fields always stay editable by hand if you'd rather not use search. Your home address on the cachet dossier is deliberately excluded from this — that field is manual-entry only, since it's more sensitive than a venue or city name.

We don't use analytics or advertising trackers, and we don't sell or share your data with anyone else.

We keep your data as long as your account exists. You can delete your account and everything tied to it at any time from Settings → Danger zone. If you manage a band with other active members, you'll need to remove them or transfer ownership first — that's so deleting your account can never silently take someone else's band history with it.

You can view and edit almost everything about your own data directly in the app. You can delete your account at any time (see above). For anything you can't do yourself — a copy of your data, a correction, a question — email nelson.lopezchirinos@gmail.com. If you're in France (or anywhere in the EU) and think we've gotten something wrong, you also have the right to lodge a complaint with your data protection authority — in France, that's the CNIL.

If this policy changes in a way that matters, we'll update the date at the top and let active users know directly rather than only quietly editing this page.