Privacy Policy

2.1 Information You Provide to Us

We collect information that you voluntarily provide when you:

• Create an Account: Name, email address, password, role (Artist/Venue/Admin)
• Complete Your Profile: Stage name, bio, location, genres, pricing, availability, social media links, media uploads
• Post Gigs: Gig details, dates, locations, payment information, requirements, media
• Apply for Gigs: Application details, custom pricing, portfolio materials
• Communicate: Messages sent through our platform, support requests
• Make Payments: Payment method information, billing address, transaction details
• Sign Contracts: Digital signatures, contract terms, agreement details

Platform messages are private between the parties to a booking. PlugVerse staff may access a booking's messages only when a dispute, suspected fraud or abuse, safety concern, or valid legal request requires it, every such access is logged, and messages are never used for advertising or sold to third parties. See Terms of Service Section 10.4 for details.

2.2 Information Automatically Collected

When you use our Service, we automatically collect certain information, including:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent, click patterns, search queries
• Location Data: General location information (city, state) based on IP address or provided location
• Cookies and Tracking Technologies: See Section 7 for details
• Log Files: Access times, error logs, system activity
• Analytics and Recommendation Data: To improve our recommendation system and provide personalized experiences, we collect anonymized data about:
  • Search behavior (filters applied, results viewed, items clicked)
  • Profile engagement (time spent viewing profiles, media clicks, setlist interactions)
  • Booking patterns (application sources, conversion rates, booking success)
  Note: This data is stored anonymously using user IDs only (no personally identifiable information), is automatically deleted after 90 days, and is used solely to improve our matching algorithms to help you find better matches. You can request deletion of this data at any time by contacting us.

2.3 Information from Third Parties

We may receive information about you from third-party services:

• Authentication Providers: If you sign in using OAuth (Google, etc.), we receive basic profile information
• Payment Processors: Stripe and other payment processors provide transaction and payment method information
• Social Media: If you connect social media accounts, we may access public profile information

3.1 Service Provision

• Create and manage your account
• Facilitate connections between Artists and Venues
• Process payments and transactions
• Generate and manage contracts
• Enable messaging and communication
• Provide customer support

3.2 Platform Improvement

• Analyze usage patterns to improve our Service
• Develop new features and functionality
• Personalize your experience
• Provide recommendations and suggestions

3.3 Communication

• Send service-related notifications (gig applications, messages, payments)
• Send marketing communications (with your consent, which you can opt out of)
• Respond to your inquiries and support requests
• Send important updates about our Service or policies

3.4 Legal and Safety

• Comply with legal obligations
• Enforce our Terms of Service
• Detect and prevent fraud, abuse, or illegal activity
• Protect the rights and safety of our users and third parties
• Respond to legal requests and court orders

4.1 With Other Users

Your profile information, gig postings, and public content are visible to other users of the platform as intended by the Service's functionality.

4.2 With Service Providers

We share information with third-party service providers who perform services on our behalf:

• Payment Processors: Stripe and other payment processors to process transactions
• Cloud Storage: Supabase, Azure Blob Storage for data storage and media hosting
• Analytics: PostHog, Inc.: product analytics, session tracking, feature usage telemetry. PostHog Privacy Policy
• Email Services: Providers that send emails on our behalf
• Hosting: Vercel and other hosting providers

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests, such as:

• Court orders or subpoenas
• Government investigations
• Legal proceedings
• To protect our rights or the rights of others

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4.5 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

5.1 Data Storage

Your information is stored on secure servers provided by our service providers, including Supabase and Azure. Data may be stored in various locations, including the United States and other countries where our service providers operate.

5.2 Security Measures

We implement appropriate technical and organizational measures to protect your information:

• Encryption of data in transit (SSL/TLS)
• Encryption of sensitive data at rest
• Secure authentication and access controls
• Regular security assessments and updates
• Limited access to personal information on a need-to-know basis

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5.3 Data Retention

We retain your information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we immediately anonymize your personal identifiable information (name, email, phone, profile media), while retaining certain financial and legal records for seven (7) years as required by law.

Why 7 Years? This retention period is legally mandated by:

• IRS tax compliance requirements
• Sarbanes-Oxley Act (SOX) financial record retention
• North Carolina statute of limitations for contracts
• Payment processor (Stripe) fraud prevention requirements

Records retained for 7 years include: contracts, payment transactions, tax forms (1099, W-9), and dispute records. These are retained in anonymized form (linked to a deleted user ID, not your personal information) and are only accessible for legal and compliance purposes.

For complete details on what data is retained vs. deleted, retention periods by data type, and your rights, please see our detailed Data Retention Policy.

6.1 Access and Portability

You have the right to access and receive a copy of your personal information. To download a machine-readable JSON archive of your PlugVerse data, including your profile, applications, contracts, payments, reviews, messages, and tickets, go to Account Settings → Your Data → Download my data. For privacy protection, this export is rate-limited to one request per seven days.

6.2 Correction

You can update or correct your personal information through your account settings or by contacting us.

6.3 Deletion

You can request deletion of your account and personal information, subject to legal retention requirements.

6.4 Opt-Out

You can opt out of marketing communications by using the unsubscribe link in emails or adjusting your notification preferences in account settings.

6.5 California Privacy Rights (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request information about categories and specific pieces of personal information collected
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: We do not sell personal information in the traditional sense
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights

How to Exercise Your Rights: California residents may submit requests by emailing privacy@plugverse.app or calling (980) 272-1831. We will verify your identity before processing your request and respond within 45 days.

6.6 European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the rights listed above.

Legal Basis for Processing: We process your personal data on the following legal bases:

• Account creation and service delivery: Performance of contract (Art. 6(1)(b))
• Platform analytics and product improvement: Legitimate interests (Art. 6(1)(f))
• Marketing communications: Consent (Art. 6(1)(a)). You may withdraw consent at any time
• Legal compliance and tax/financial record retention: Legal obligation (Art. 6(1)(c))
• Fraud prevention and platform security: Legitimate interests (Art. 6(1)(f))

You have the right to object to processing based on legitimate interests (Art. 21) and the right not to be subject to solely automated decision-making that produces significant legal effects (Art. 22). Our Reliability Scoring system uses automated processes that may affect artist visibility and platform access. You may contact privacy@plugverse.app to request human review of any automated Reliability Score decision.

To exercise any of these rights, please contact us at privacy@plugverse.app.

7.1 Types of Cookies

We use cookies and similar tracking technologies to:

• Essential Cookies: Required for the Service to function (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with our Service
• Advertising Cookies: Used to deliver relevant advertisements (if applicable)

7.2 Managing Cookies

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of the Service.