Gigshot Ltd, 5th Floor, 167-169 Great Portland Street, London W1W 5PF, United Kingdom. Contact for all privacy matters: legal@gigshot.pro. This policy explains what personal data Gigshot processes, why, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (GDPR).

Profile data — name or artist name, handle, bio, city, social links, creator type and rate, profile details you choose to add. Your profile is public by design: the point of the platform is being found. Booking data — requests you send or receive: gig date, venue, package, status, and the connection history that powers booking-verified reviews. Messages — the text of message threads on your bookings. Messaging is text-only; messages are stored so both parties can read their threads. Membership status — only if you hold a paid membership, which is not offered at present: whether it is active, on trial, or past due, via Stripe. Gigshot Agency clients: see "Gigshot Agency clients" below. Gigshot never sees or stores your card number; payment details go directly to Stripe. Account basics — email address (for sign-in and recovery) and authentication data handled by our backend provider.

If you connect a calendar feed (Google, Outlook, Calendly, Apple via ICS) to show your availability, we store only the start time, end time, and an opaque event identifier of each busy block. Event titles, descriptions, locations, and attendees are discarded in memory before anything is written to the database — they never reach storage. Other users only ever see busy or free.

We measure how the site is used, so we can see which parts people actually use and where they get stuck. We do this in two separate ways, and they never meet. Visitors who are not signed in. When a page or a feature is used, your browser sends us a short message saying which screen it was (as a pattern like /profile/[id], never the address you are looking at), what kind of action it was, which screen you came from, and how many screens you have seen so far in this visit. Cloudflare, which serves this site, tells us the country and region your request came from — we never see or store your IP address. We add all of this straight into daily counters. There is no cookie, nothing is stored on your device, and nothing is read from it. There is no visitor number, no session number and no fingerprint — not on your device, not in the message, and not in our database. That means we count visits, not people: if you reload the page, that is a new visit to us, and we can never tell that two visits were the same person, on the same day or on different days. We can never connect anything you did before signing up to an account you create later, because there is nothing to connect it with. These counters are numbers about days, not about people, so we keep them indefinitely. We show a country or region figure only when at least five visits sit behind it. Members who are signed in. While you are signed in, the same actions are also recorded against your account — which screens you opened, which searches and taps you made, when you posted or responded, and when someone opened one of your links. We use this to run and improve the platform and to answer questions like "where do new members get stuck". These records carry your profile id, are kept for 90 days and then deleted automatically. A per-day summary of this activity, carrying your profile id, is kept for at most 400 days. Both are deleted immediately if you delete your account. They are visible only to us, never to other members, and every time one of us opens a single member's activity we record who looked and when. Links that leave Gigshot. When someone opens one of your links from your profile — your Instagram, SoundCloud, website or similar — we count that against your profile, so we can understand how links perform. We do not show you that count yet. We store the kind of link only (for example "instagram"), never the address, never your handle, and never who clicked unless they were signed in. That attribution is kept by week, for about 400 days, and is removed if you delete your account: the count survives as an anonymous total for that day, with your name taken off it. Share links. Links shared from Gigshot can carry a short referral code so we can tell which share brought someone in. That code is recorded when the link is opened. It identifies the share, never you. Objecting. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we send no measurement message at all — nothing about your visit is counted. That signal does not cover the signed-in records above; to object to those, or to ask what we hold, write to legal@gigshot.pro.

Contract performance (Art. 6(1)(b) GDPR) for providing the platform, bookings, messaging, and subscriptions. Legitimate interest (Art. 6(1)(f)) for service security and abuse prevention, and for measuring how the service is used (audience measurement), which we do without cookies, without storing anything on your device and without any identifier for a visitor. Consent (Art. 6(1)(a)) for the optional calendar sync, revocable at any time by disconnecting the feed (stored busy blocks are then deleted).

Application data is stored with Supabase in the eu-central region (Frankfurt, Germany) — EU data residency by default.

Processors, acting on our behalf under a data-processing agreement: Supabase (database, authentication, storage — Frankfurt, EU), Cloudflare (web hosting and content delivery) and Resend (e-mail delivery). Stripe processes invoicing and subscription data for us and is, for the payment itself, an independent controller under its own privacy policy. Our bank receives payment details when you pay an invoice by bank transfer. Where one of these providers processes data in the United States, the transfer from the UK and the EU rests on the provider's own safeguards (the UK International Data Transfer Addendum and the EU Standard Contractual Clauses). We do not sell your data, and we show no ads. The city/place picker runs entirely on a place dataset bundled into the app — it is matched locally on your device, so typing a city sends nothing to a third party. That dataset is derived from GeoNames (https://www.geonames.org/), licensed CC BY 4.0, plus hand-picked festival and venue locations from OpenStreetMap (https://www.openstreetmap.org/copyright), licensed ODbL; the attribution required by those licenses is shown in the app footer.

If you are a client of Gigshot Agency, or the person or company who pays for one, we keep the billing details (name, company, address, e-mail, VAT number, purchase-order reference) and every invoice we issue. Invoices are accounting records: we keep every issued invoice for six years after the end of the financial year it belongs to, also after an account is deleted. An issued invoice keeps the payer's billing details as they were when it was issued, and each line keeps the show it is for: the venue or event, the city and the date. Invoice lines also keep the name of the artist whose show it is, except lines made before mid-October 2026. When one payer pays for several artists, the artist's name is also printed on each line. Stripe keeps its own copy of every invoice we send through it. Who a set of billing details belongs to is fixed when we set them up. If you pay for yourself and delete your Gigshot account, we delete your billing contact details (address, e-mail, VAT number, purchase-order reference) and the copies held on draft invoices. This holds even if your billing details also paid for other artists. We keep your billing name or company. Our payment processor, Stripe, keeps its own customer record for you until we remove it there by hand, which we do after you delete your account. If a company or manager pays for you, those billing details are theirs and stay when you delete your account, and your shows already on their invoices stay on them with your name. If you are the named contact for a company or manager that pays, and you delete your Gigshot account, we remove you as their contact and delete your e-mail from their billing details, from their draft invoices and from our record of coverage sheets sent to that address. A coverage sheet sent earlier to a different address keeps that address. You can also ask us to remove you as their contact without deleting your account (legal@gigshot.pro): we then remove you as their contact and delete your e-mail from their billing details and from their draft invoices. Coverage sheets already sent keep the address they were sent to, as our record of what we sent. We change the e-mail on their Stripe customer record by hand. The company's name, address and VAT number stay for its invoices.

Gigshot Agency is a service of Gigshot Ltd, which is the controller of these details. When Gigshot Agency looks for local crew for a client's show, we may find you through a public profile, for example a public Instagram profile, and a public business contact. About a person we may contact we keep only public professional details: their public handle or profile link, a public business contact, the city they work from, what they shoot, a public example of their work, and our own notes about their work. We never keep a private contact or a follower list. We use them to offer you paid work at a client's shows. While we look for crew for an artist, we may share your name, your public handle and the city you work from with that artist and their management, so they can choose who to book. If you take a booking, your name and handle go to the artist's management, who booked you. If we book you outside Gigshot, the record of that booking (your name and the show) is kept with the invoice for the show, for accounting. The legal basis is our legitimate interest in finding professionals for paid work. We keep these details for up to 18 months after we last contacted you or updated your record, unless you join Gigshot. You can object, see what we hold or ask to be removed at any time: write to legal@gigshot.pro or reply to our message and say so. We delete the details, and you will not be added again: we keep a one-way code made from your handle or profile link on our do-not-contact list, never the handle itself. We do the same when someone we hold no record of asks us not to contact them. You can complain to the Information Commissioner's Office (ico.org.uk).

A profile Gigshot staff set up for an artist or venue holds only public professional details until it is claimed. When someone acts for a profile, we record who did what and when, and show it to the profile's owner; the record is deleted with the profile.

The app and website use local storage only to keep you signed in (session) and to remember which message threads you have read (read-state). No advertising or cross-site tracking cookies are used.

Profile, booking, and message data are kept while your account exists. You can delete your account yourself in the app (profile → account settings): after you confirm via the emailed link, a 30-day grace period runs — signing back in cancels the deletion — and then your personal data is deleted or anonymized, including uploaded photos, except where retention is legally required (e.g. invoicing records for subscriptions). Usage counters that contain no identifier of any kind are anonymous statistics and are kept indefinitely; they contain nothing that could be traced back to you.

You have the right to access, rectify, delete, and receive a copy of your personal data, to restrict or object to processing, and to withdraw consent at any time. Contact legal@gigshot.pro — we respond within one month. You also have the right to lodge a complaint with a supervisory authority: for the operator this is the Information Commissioner's Office (ICO), United Kingdom, and you may also contact the authority of your own country of residence. Our representative in the EU (Art. 27 GDPR): Richard-Razor Mediavilla, c/o Mediavilla Ltd, Start Up Centre Gozo, 9, Office No. 11, Triq L-Gharb, Gharb, Ghawdex GRB 1102, Malta, legal@gigshot.pro.