Privacy Policy

1. Data Controller

The data controller for your personal data is MonoClue Solutions SRL, a company registered in Romania (Sole Registration Code / CUI: RO39276061, Trade Register No. / Nr. Registrul Comerțului: J31/283/2018), with its registered office in Romania, operating the BandFlow platform.

Contact: privacy@bandflow.app

2. Personal Data We Collect

We collect the following categories of personal data:

Account data: Full name, email address, password (hashed), instruments played
Profile data: Band memberships, subscription status
Usage data: Events, songs, setlists, practice logs, and financial records you create
Payment data: Processed by Stripe — we do not store credit card numbers
Technical data: IP address, browser type, device information, access logs
Sign-up source: if you arrived through a tagged link (for example from a newsletter or a directory listing), the campaign name and the first page you visited are saved with your account when you register, so we can tell which channels bring people to BandFlow. Based on our legitimate interest in understanding where our users come from (Art. 6(1)(f) GDPR).
Online activity: when you use BandFlow (the start and end of each visit), whether through the website or the app, and an approximate location (country and city) worked out on our own server from your IP address. The IP address itself is not kept. This is kept for 90 days, is visible only to BandFlow administrators, and is based on our legitimate interest in running and improving the Service (Art. 6(1)(f) GDPR).

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data on the following legal bases:

Contract performance (Art. 6(1)(b)): To provide the Service, manage your account, and process subscriptions
Legitimate interest (Art. 6(1)(f)): To improve the Service, ensure security, and prevent fraud
Consent (Art. 6(1)(a)): For optional cookies and marketing communications (where applicable)
Legal obligation (Art. 6(1)(c)): To comply with tax, accounting, and other legal requirements under Romanian and EU law

4. How We Use Your Data

We use your personal data to:

Provide, maintain, and improve the Service
Process payments and manage subscriptions
Send service-related communications (e.g., account confirmations, security alerts)
Respond to your support requests
Comply with legal obligations

5. Data Sharing

We share your personal data only with:

Stripe: For payment processing (Stripe acts as an independent controller for payment data)
Umami (website analytics): counts which pages of our website are visited, the site you came from, your browser type and country, and which sign-up steps were reached. Umami sets no cookies and stores nothing on your device, keeps its data in the EU, and we do not send it your name or email address.
Hosting providers: Our servers are hosted within the EU/EEA to ensure GDPR compliance
Band members: If you join a band, other band members can see your name and shared content (events, setlists, songs)

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

6. User-Uploaded Content (Attachments)

The Service allows you to upload files (audio recordings, PDFs of chord charts or sheet music, photographs, video links and similar materials — collectively "Attachments") and to share them with bandmates, organizations or classes you belong to.

Our role with respect to Attachments. In relation to the contents of Attachments, MonoClue Solutions SRL acts as a technical hosting service provider within the meaning of Article 14 of the e-Commerce Directive (2000/31/EC) and Article 6 of the Digital Services Act (Regulation (EU) 2022/2065). We store Attachments on object storage on your behalf and serve them back to you and to the recipients you have explicitly shared them with. We do not listen to, watch, read, transcribe, scan, fingerprint against external databases, train models on, sell or otherwise use the contents of your Attachments for any purpose beyond providing the Service to you.

No active monitoring; no editorial control. We do not, and have no obligation to, actively monitor, pre-screen, review, vet, approve or rate Attachments before, during or after upload. We do not curate or recommend Attachments and we exercise no editorial control over their contents. No statement on this platform or in our marketing shall be read as implying that we review, approve, certify or warrant any Attachment. This is consistent with the absence of a general monitoring obligation set out in Article 8 of the Digital Services Act and the corresponding provisions of the e-Commerce Directive as transposed into Romanian law.

Automatic technical processing. To operate the Service, we perform a small set of purely technical, automated operations on Attachments at upload time. These operations are content-neutral and do not amount to inspection of the content:

Audio transcoding. Uploaded audio files are re-encoded to 192 kbps MP3 to reduce storage cost. The original audio is not retained.
Content hashing. We compute an SHA-256 hash of each upload solely for storage-quota accounting and for deduplication (so the same file uploaded twice does not consume your storage twice). The hash does not identify the content meaningfully on its own.
Format detection. We read the file's MIME type / extension to choose an appropriate preview component (PDF viewer, audio player, etc.).

Personal data inside Attachments — controller vs. processor. If you upload an Attachment that contains personal data of third parties (for example a photograph of bandmates, a roster spreadsheet of student email addresses, or a recording of an identifiable performance), you are the data controller for that personal data and MonoClue Solutions SRL is acting as your processor within the meaning of Article 28 GDPR. You are responsible for having a lawful basis to upload and share that personal data and for fulfilling any information notices required toward the data subjects. We will process such personal data only on documented instructions from you (i.e. the operations described above) and will assist you in responding to data-subject requests where reasonably practicable.

Your warranties. By uploading an Attachment you confirm, under the representations in Section 7 of our Terms and Conditions, that you own it or have all necessary licences, permissions and consents to upload and share it through the Service. MonoClue Solutions SRL is not responsible for verifying or monitoring the contents of Attachments and accepts no liability for User Content uploaded in breach of those representations.

Removal of unlawful content. If you believe an Attachment hosted on the Service infringes your rights or is otherwise unlawful, please follow the notice procedure in Section 10 of our Terms and Conditions by writing to legal@bandflow.app. We will act expeditiously to investigate and, where appropriate, remove or disable access to the reported content.

7. International Data Transfers

We primarily store and process data within the European Economic Area (EEA). If any data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.

8. Data Retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations (e.g., Romanian fiscal law requires retention of financial records for 10 years). You may request deletion of your account and associated data at any time, subject to legal retention requirements.

Under the GDPR, you have the following rights:

Access (Art. 15): Request a copy of your personal data
Rectification (Art. 16): Correct inaccurate or incomplete data
Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
Restriction (Art. 18): Request limitation of processing
Portability (Art. 20): Receive your data in a structured, machine-readable format
Objection (Art. 21): Object to processing based on legitimate interest
Withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at privacy@bandflow.app. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), hashed passwords, access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

11. Administrative Access

Authorized administrators may access your account view for the purposes of customer support and debugging. The following safeguards are in place:

All impersonation sessions are recorded in an audit log (administrator identity, target user, timestamp, IP address)
Sessions are strictly read-only — no data can be created, modified, or deleted during impersonation
Sessions are limited to a maximum duration of 1 hour
Audit logs are retained for 2 years

Legal basis: legitimate interest in providing effective customer support (Art. 6(1)(f) GDPR). You may request a copy of audit logs related to your account by contacting privacy@bandflow.app.

12. Children's Privacy

Our Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected such data, we will delete it promptly.

13. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

ANSPDCP — Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal
Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania
Website: www.dataprotection.ro

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top indicates when the latest changes were made.

15. Contact

For privacy-related inquiries, contact us at: privacy@bandflow.app