Privacy policy

What we collect

• When you buy tickets:your email, your name if you give it, the name on each ticket, what you bought and when, and the share link that brought you, if any. We don't ask for your phone number or address.
• When you request a song:the song and artist. If you boost it, the amount, and your email if you give it for a receipt. Requests aren't stored with your name.
• If you have an account:your email, and for hosts the public name they choose. Hosts also give us their events' details, including the venue address, and the posters and sponsor logos they upload.
• If you follow artists: who you follow, so we can tell you about their gigs in the app.

Cookies and your device

• A sign-in cookie, if you sign in.
• A signed cookie holding a random ID, which we use to stop abuse such as spam requests.
• A cookie remembering your light or dark theme choice.
• On your device itself: a random ID for it, links to the tickets you bought so you can open them again, and song requests waiting to send when you're offline. The app may also keep recent pages and data on your device for up to a day, so it works with a poor connection.

We don't use analytics, advertising trackers or tracking pixels. We use your IP address briefly, in memory, to limit abuse; we don't store it in our database.

Payments

Card payments are processed by Stripe. Your card details go straight to Stripe: we never see or store your full card number. We give Stripe your email so it can send you a receipt. Organisers are paid through Stripe too.

Who sees your information

• The event's organisersees the name and email on your order, the names on your tickets and whether they've been checked in, so they can let you in and handle refunds. They can download this list.
• Whoever scans your ticket at the door sees the name on it.
• Everyone at a gig can see the song queue: each song, its artist and its boost total, but not who asked for it.
• Our service providers, who handle it for us: Stripe (payments), Supabase (our database and sign-in), Resend (our emails), Cloudinary (event images), Vercel (hosting, on servers in Singapore), Google (if you choose to sign in with Google, and the venue map on an event page, which loads from Google Maps) and Spotify (song search: it receives what you type in the search box). Some of them store information outside New Zealand.

We don't sell your information.

Emails

We only email you about things you've done: ticket confirmations, refund notices, sign-in codes and links, and password resets. Stripe sends payment receipts. We don't send newsletters or marketing emails.

How long we keep it

We keep your information as long as we need it to provide the service and to meet our legal obligations.

Your rights

You can ask to see the personal information we hold about you, and ask us to correct it or delete it. Email support@gigsay.com. If you're not happy with how we handle your information, you can complain to the Privacy Commissioner.

Changes and contact

We'll update this policy when what we do changes; the date at the top shows when it last did. Questions: support@gigsay.com, or see Contact.