Privacy policy

1. Who is responsible

The controller for your personal data is [Company legal name], [Street and number], [Postcode] [City], [Country]. For privacy questions or requests, email [privacy@your-domain].

Our representative in the EU (Art. 27 GDPR): [EU representative name and address, if established outside the EU].

2. What we collect and why

Your account

• Data: name, username, email, phone number, password (stored only as a salted hash), and optionally a bio and your city, region and country. If you sign in with Google, Microsoft or Apple, we receive your name and email from them.
• Why: to create and run your account, show your profile to other users, and put helpers and posters in touch.
• Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).

Your location

• Data: the city you pick, stored with the coordinates of that city’s centre rounded to about 1 km. We never ask for or store your precise address or device location. Other users only ever see a rough distance band, never coordinates.
• Why: to show gigs and helpers near you.
• Legal basis: contract (Art. 6(1)(b)). Location is optional. Choose “Remote” to leave it out.

Listings, matches and ratings

• Data: skills and requests you post, matches you make, and ratings and comments you give or receive.
• Why: this is the service itself.
• Legal basis: contract (Art. 6(1)(b)).

Payments

• Data: Stripe handles payments. We never see or store your card details. We keep your Stripe customer ID and the date of your last payment.
• Legal basis: contract (Art. 6(1)(b)) and our legal duty to keep accounting records (Art. 6(1)(c)).

Technical data and security

• Data: IP address, browser user agent and request logs, kept by our hosting provider and with sign-in sessions.
• Why: to deliver the site, keep it secure, and prevent abuse (such as rate-limiting coupon attempts).
• Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f)).

Analytics (only with consent)

• Data: pages viewed, device and browser type, and approximate region, collected by Google Analytics 4.
• Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time on our cookie page. Without consent, Google Analytics doesn’t load.

3. Who we share data with

We don’t sell your personal data. We share it with other users only as the service requires. Your public profile and listings are visible to others. Your name and contact details are shown only to signed-in subscribers. We also use these service providers (processors) to run Giglee, under data processing agreements:

• Vercel Inc. (USA): website hosting and request logs.
• Neon Inc. (USA): database hosting.
• Stripe Payments Europe Ltd. (Ireland) / Stripe, Inc. (USA): payment processing. Stripe is an independent controller for some payment data.
• Google, Microsoft, Apple: only if you choose to sign in with them.
• Google Ireland Ltd.: Google Analytics, only with your consent.
• komoot GmbH (Germany), Photon geocoder: when you type in a location search box, your browser sends the search text and your IP address directly to Photon to suggest place names.

We may also disclose data when the law requires it, or to protect our users’ or our rights.

4. Transfers outside the EU

Some providers above are in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Email us for a copy of the safeguards.

5. How long we keep data

• Account, listings, matches and ratings: until you delete your account. Deletion takes effect immediately, apart from routine database backups, which roll over within 30 days.
• Payment records: as long as tax and accounting law requires (usually up to 10 years). Stripe keeps these.
• Sign-in sessions: up to 7 days. Coupon-attempt counters are deleted with your account.
• Cookies and local storage: see the durations on our cookie page.

6. Your rights

Under the GDPR you have the right to:

• Access your data and get a copy of it (Art. 15), and take it with you in a machine-readable format (Art. 20). Use Download my data under Profile → Privacy & data.
• Correct inaccurate data (Art. 16). Edit your profile at any time.
• Erase your data (Art. 17). Use Delete account under Profile → Privacy & data.
• Restrict processing (Art. 18) or object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time, as easily as you gave it (Art. 7(3)), on our cookie page or with “Cookie settings” in the footer.
• Complain to a data protection supervisory authority, especially in the EU country where you live or work, or where you think the breach happened (Art. 77). You can find your authority at edpb.europa.eu.

For anything you can’t do yourself in the app, email [privacy@your-domain]. We reply within one month.

7. Marketing emails

We only send marketing emails if you opt in, and every one includes a way to unsubscribe. Service emails about your account, matches and payments aren’t marketing.

8. Automated decisions

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22).

9. Children

Giglee isn’t intended for anyone under 16, and we don’t knowingly collect their data. If you think a child has created an account, contact us and we’ll delete it.

10. Changes

We’ll update the date at the top of this page when this policy changes. If a change is significant, we’ll tell signed-in users before it takes effect.