Privacy Notice
Last updated: 23 July 2026
1. Who we are
BandOps is operated by Timothy Richard O'Neill, a sole trader based in the United Kingdom, trading as "BandOps". For the personal data described in this notice, we act as the data controller.
Contact: hello@bandboss.live.
2. What we collect and why
- Account data — name, email, password hash, band name. Used to create and secure your account and workspace. Legal basis: contract performance.
- Workspace content — songs, setlists, gigs, files, contacts, releases and other data you or your bandmates add. Used to provide the service. Legal basis: contract performance.
- Support messages — anything you send us by email or in-app. Used to help you. Legal basis: legitimate interests (running a support function).
- Usage & telemetry — pages visited, feature use, error logs, approximate location from IP, device / browser info. Used to keep the service reliable, prevent abuse, and improve BandOps. Legal basis: legitimate interests.
- Marketing — if you sign up for updates or leave your email in the "get an invite" flow. Legal basis: consent (you can unsubscribe any time).
Payment information (card details, billing address, tax IDs) is collected directly by Paddle, our Merchant of Record — we never see or store card numbers.
3. Who we share data with
- Paddle (Merchant of Record) — for taking payments, managing subscriptions, invoicing, tax and refund handling.
- Service providers / subprocessors — hosting and database (Lovable Cloud / Supabase), AI providers used for setlist suggestions, poster generation, release planning and advisor chat, and email delivery. They only process data on our behalf and under contract.
- Your bandmates — when you invite them into a band workspace, they can see the content in that workspace.
- Professional advisers — legal, accounting, or similar where reasonably needed.
- Authorities — where we're required to disclose data by law.
We do not sell your personal data.
4. International transfers
Some of our providers are outside the UK / EEA (for example US-based AI or hosting services). Where that happens we rely on appropriate safeguards such as UK / EU Standard Contractual Clauses or adequacy decisions.
5. Retention
We keep account and workspace data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, subject to backups and any legal retention obligations (for example, tax records held by Paddle).
6. Security
We use appropriate technical and organisational measures to protect personal data — including encryption in transit, row-level access controls on the database, and least-privilege access to production systems. No system is 100% secure, but we take this seriously.
7. Your rights
Depending on where you live, you may have rights to:
- access the personal data we hold about you;
- ask us to correct it if it's wrong;
- ask us to delete it;
- restrict or object to certain processing;
- receive a portable copy of the data you gave us;
- withdraw consent where we relied on it;
- complain to a supervisory authority (in the UK, the ICO at ico.org.uk).
To exercise any of these, email hello@bandboss.live. We aim to respond within one month.
8. Cookies
We use a small number of essential cookies and localStorage entries to keep you signed in and remember your workspace. We don't use advertising cookies. Any analytics we add later will be described here.
9. Changes
We'll update this notice when things change and revise the "last updated" date at the top. Material changes will be highlighted in-app or by email.