Privacy policy

BandQuill is operated by Peak Simplicity Limited, a company registered in England and Wales under company number [Company number], whose registered office is at [Registered office address] (“BandQuill”, “we”, “us”). BandQuill is a trading name of Peak Simplicity Limited.

For personal data you give us to run our own business — your account details, billing information and messages you send us — we are the controller. For the content bands store in BandQuill about other people (for example contacts, deps and crew details), the band owner is the controller and we act as their processor.

We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number]. You can contact us about privacy at privacy@bandquill.com.

• Account data: your name, email address, password (stored only as a secure hash), and optional phone number, instruments and bio.
• Band content: information you and your bandmates add — gigs, venues, contacts, setlists, songs, files, messages, availability and stage plots.
• Financial data: gig fees, expenses, pay splits and invoices you record. Card payments for subscriptions are handled by our payment provider, Stripe; we never see or store your full card number.
• Usage and device data: log data such as IP address, browser type, pages visited and timestamps, used for security and to keep the service running.
• Communications: messages you send via our contact form or support emails.

We do not intentionally collect special category data. Please don’t store health, religious or similar sensitive information about people in BandQuill unless you have a lawful basis to do so.

• To provide the service — creating your account, letting you join bands, showing you gigs and sending notifications you’ve asked for. Lawful basis: performance of a contract.
• To take payment and manage subscriptions. Lawful basis: contract; legal obligation (tax and accounting records).
• To keep BandQuill secure, prevent fraud and abuse, and fix problems. Lawful basis: legitimate interests.
• To improve the product using aggregated, de-identified usage information. Lawful basis: legitimate interests.
• To send product news — only if you opt in, and you can unsubscribe at any time. Lawful basis: consent.
• To reply to enquiries sent through our website. Lawful basis: legitimate interests.

We do not sell your personal data and we do not use it for third-party advertising.

Other members of your bands. What bandmates, deps and crew can see is controlled by the band owner’s permission settings.

The public, only where a band chooses to publish it — for example an EPK page, public gigs or a shared gig sheet link.

Service providers who process data on our behalf under written contracts, including: [hosting provider], [database provider], Stripe (payments), Resend (transactional email) and [analytics / error monitoring provider, if any].

Authorities or advisers where required by law, or to protect our rights, users or the public.

If BandQuill is involved in a merger or acquisition, data may transfer to the new owner, who will be bound by this policy.

We aim to host data in the UK or European Economic Area. Where a provider processes data outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. [List any non-UK processing locations here.]

We keep account and band data for as long as your account or band is active. If a band is deleted, its content is removed from live systems within [30] days and from backups within [90] days.

Billing records are kept for six years to meet HMRC requirements. Security logs are kept for up to [12] months. Contact form messages are kept for up to [24] months.

Under UK GDPR you have the right to: access your personal data; have it corrected; have it erased; restrict or object to processing; data portability; and withdraw consent at any time where we rely on consent.

You can download a copy of your personal data and delete your account yourself at any time from your account settings in BandQuill, and band owners can download all of their band’s data from band settings. For anything else, or to exercise your other rights, email privacy@bandquill.com. We’ll respond within one month. If your request concerns content a band holds about you, we may refer you to that band’s owner, as they are the controller.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to resolve your concern first.

We use a strictly necessary cookie to keep you signed in, and local storage so the app can work offline. These don’t require consent under PECR. [If you add analytics or marketing cookies, describe them here and add a consent banner.]

We use encryption in transit (HTTPS), hashed passwords, role-based access controls and regular backups. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the ICO where required.

BandQuill is not intended for children under 13. Band owners who add members aged 13–17 are responsible for obtaining any parental consent required.

We’ll post any changes on this page and update the date above. If changes are significant, we’ll let you know by email or in the app. Questions? Contact us.