Privacy Policy

• Registration and contact data (e.g. name, email, phone) provided when creating an account, joining the waitlist, or contacting support.
• Authentication data from third-party providers (Apple, Google, Facebook, Spotify) when you use social login -- we collect only the identifier, name, and public email.
• Music preferences and interest profile (selected genres, followed artists and venues).
• Usage data (e.g. clicks, visited pages, searches, language, device, operating system, and browser).
• Approximate location data (city or region), when permitted, to recommend nearby events.
• Push notification tokens for sending alerts about events and updates.
• Optional integration data (e.g. Spotify, Apple Music) when you authorize connection for personalized recommendations.

• Operate and improve music event discovery.
• Personalize event recommendations based on music taste, location, and followed artists.
• Send relevant push notifications (new event from followed artist, upcoming show reminder).
• Respond to requests, communications, and support contacts.
• Measure platform usage, performance, and security.
• Prevent fraud, abuse, and misuse of the service.
• Generate aggregate and anonymized statistics about the music scene.
• Comply with legal and regulatory obligations.

We process data under the legal bases provided in LGPD Art. 7, including:

• Contract performance or pre-contractual steps (Art. 7, V) -- to operate your account and provide the service.
• Legitimate interests (Art. 7, IX) -- to improve the platform, personalize recommendations, and prevent fraud, always respecting data subjects' rights and expectations.
• Legal or regulatory obligation (Art. 7, II) -- to meet tax, judicial, or competent authority requirements.
• Consent (Art. 7, I) -- when required, such as for optional integrations (Spotify, Apple Music) and marketing communications.

We use technologies to measure and improve the platform experience:

• Google Analytics 4 (GA4) -- traffic and usage behavior analysis. Data is processed by Google LLC and may include anonymized identifiers, visited pages, and interaction events.
• Firebase Analytics and Firebase Performance -- app usage metrics and technical performance.
• Browser localStorage -- stores local preferences such as theme (light/dark) and selected language. Contains no personal data.
• We do not use advertising cookies or third-party tracking for targeted marketing.

We may share data with infrastructure, analytics, authentication, and security providers for compatible purposes. We do not sell personal data.

• Google LLC (Firebase, Cloud Functions, Analytics) -- infrastructure, storage, and metrics.
• Apple, Google, Facebook, Spotify -- authentication via social login, as authorized by the user.
• Transactional email providers -- for service communications.

Our main data subprocessors:

• Google LLC (United States) -- Firebase (Firestore, Authentication, Cloud Functions, Hosting), Google Analytics 4. Transfer mechanism: Standard Contractual Clauses (SCCs) and Data Privacy Framework certification.
• New relevant subprocessors will be added to this list as contracted.

Data is retained for as long as needed for the purposes described here. Reference periods:

• Account data -- while account is active, plus 6 months after deletion for operational and legal purposes.
• Analytics data (GA4/Firebase) -- up to 26 months (Google Analytics default setting).
• Waitlist data -- until product launch or a maximum of 24 months, whichever comes first.
• Data for legal obligations -- up to 5 years after relationship ends, per applicable Brazilian law.

Our infrastructure providers, notably Google LLC, may process data outside Brazil, including in the United States. In such cases, we adopt appropriate safeguards per LGPD Art. 33, including Standard Contractual Clauses and verification of the recipient's security standards.

Under the LGPD, you may exercise the following rights:

• Confirmation of processing and access to your data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Data portability to another service provider.
• Information on data sharing with third parties.
• Consent withdrawal where processing is based on consent.
• Filing a complaint with the National Data Protection Authority (ANPD).

bandz is intended for users aged 16 and above. Users between 16 and 18 should use the service with their legal guardian's awareness, per the Brazilian Child and Adolescent Statute (ECA) and the LGPD.

We do not knowingly collect data from children under 13. If we identify data collected from a child without proper consent, we will delete it immediately.

bandz uses algorithms to recommend events, artists, and venues based on music preferences, location, and usage behavior. These recommendations aim to improve the discovery experience and do not produce legal effects or significantly affect the data subject.

You may request human review of any automated decision you consider inappropriate by contacting us.

We adopt reasonable technical and organizational safeguards against unauthorized access, loss, leakage, destruction, or alteration, including:

• Encrypted communication via HTTPS/TLS across the entire platform.
• Firebase Security Rules for data access control in Firestore.
• Secure authentication tokens with appropriate expiration.
• Principle of least privilege for infrastructure access.
• No system is fully invulnerable. In case of a security incident that may cause relevant risk or harm to data subjects, bandz will notify the National Data Protection Authority (ANPD) and affected data subjects within a reasonable timeframe, per LGPD Art. 48, informing the nature of affected data, risks involved, and measures taken.

Per LGPD Art. 41, the channel for communications regarding personal data processing and exercise of data subject rights is:

• Email: privacy@bandz.app
• Response time: up to 15 business days, per applicable law.

This Policy is governed by the laws of the Federative Republic of Brazil, particularly the General Data Protection Law (Law 13,709/2018) and the Consumer Protection Code (Law 8,078/1990).

The courts of Campinas, State of Sao Paulo, are elected for dispute resolution, without prejudice to the consumer's domicile forum when applicable.

This Policy may be updated to reflect product, operational, or legal changes. The current version is always available on this page with its update date.

Material changes will be communicated via in-app notification or email when available.