Privacy Policy

Last updated: 28 June 2026

This Privacy Policy explains what personal data Packdown collects, why we collect it, how we use it, and what rights you have. It applies to all users of the Packdown app, including musicians using the band product and agency staff using the Agency Workspace.

1. Who We Are

Packdown is a UK-based service. For the purposes of UK GDPR, Packdown is the data controller for personal data collected through the Service.

Contact: hello@packdown.co.uk

2. What Personal Data We Collect

Account data — when you register, we collect your name, email address, and a hashed password. We also store your account preferences, notification settings, and the date you accepted our Terms of Service.

Band and gig data — if you use Packdown as a musician or band admin, we store gig records (dates, venues, fees, timings, notes), band settings, member lists, earnings splits, mileage records, expense records, gear lists, and debrief responses. Some of this data is shared within your band; private fields such as personal expenses and private gig notes are visible only to you.

Agency Workspace data — if you use Packdown as an agency operator or workspace staff member, we store your workspace configuration, managed band roster, client records, venue records, enquiries, availability requests, holds, confirmed bookings, booking terms, acknowledgements, commercial records, and activity logs. This data is accessible to workspace staff according to their role and permissions.

Third-party contact data entered by agency users — when an agency inputs client contact details (name, email, phone) or venue contact details (name, email, phone) into the workspace, that personal data is stored in Packdown on the agency's behalf. The agency is the data controller for that data; Packdown processes it as a data processor. If you are a client or venue contact and wish to exercise your data rights, please contact the agency that entered your details directly.

Payment data — we use Stripe to process payments. We do not store your card details. Stripe handles all payment card data in accordance with their own privacy policy. We retain records of subscription status, billing dates, and payment events for account management purposes.

Usage and technical data — we collect standard technical data such as your device type, browser, IP address, and app usage patterns. This helps us maintain and improve the Service.

Push notification tokens — if you enable push notifications, we store a device token via OneSignal to deliver notifications. You can disable push notifications at any time in your device settings or app preferences.

Google Calendar data — if you use the optional Google Calendar import, Packdown temporarily accesses your calendar to read event titles and dates for import. We do not store your Google credentials or retain ongoing access to your Google Calendar after the import is complete.

3. Why We Use Your Data (Legal Basis)

To provide the Service — we process your account, band, gig, and workspace data because it is necessary to perform the contract between us. Legal basis: contract performance.

To process payments — we process billing data to fulfil payment obligations and comply with financial record-keeping requirements. Legal basis: contract performance and legal obligation.

To send notifications — we send email and push notifications about your gigs, bookings, band activity, and account events. You can manage notification preferences in the app. Legal basis: legitimate interests or consent where required by law.

To maintain security and prevent fraud — we monitor for suspicious activity and protect accounts from unauthorised access. Legal basis: legitimate interests.

To improve the Service — we use aggregated, anonymised usage data to understand how the app is used and to improve it. Legal basis: legitimate interests.

To comply with legal obligations — we may process data to comply with applicable law, respond to lawful requests, or enforce our Terms of Service. Legal basis: legal obligation.

4. Who We Share Your Data With

We do not sell your personal data. We share it only with the following service providers who help us deliver the Service:

• Supabase — our database and backend infrastructure provider. All app data is stored in Supabase.
• Stripe — payment processing. Stripe handles all payment card data and subscription billing.
• OneSignal — push notification delivery. We share your device notification token with OneSignal to send push notifications.
• Netlify — our hosting and serverless function provider. The app and its backend functions are hosted on Netlify.
• Google — only if you use the optional Google Calendar import feature.

All third-party processors are contractually required to process data only as instructed and to maintain appropriate security measures.

We may disclose personal data if required to do so by law, or to protect the rights, property, or safety of Packdown, its users, or others.

Data visible within your band or workspace: band admins can see your gig records, availability, and earnings splits within the band. If your band is managed by an agency, agency workspace staff can see your operational booking data as described in our Terms of Service. Private fields are never shared with other members or agency staff.

5. International Transfers

Some of our service providers — including Supabase, Stripe, OneSignal, and Netlify — may process data outside the United Kingdom or European Economic Area. Where this happens, we rely on standard contractual clauses or UK adequacy decisions to ensure your data receives equivalent protection to that required under UK GDPR.

6. How Long We Keep Your Data

• Active account: we keep your data for as long as your account is active and for up to 12 months after account deletion, unless you request earlier erasure.
• Band data: retained while the band exists and for up to 12 months after the band is deleted.
• Agency Workspace data: retained while the workspace subscription is active and for up to 12 months after the subscription ends.
• Payment records: retained for 7 years to comply with UK financial record-keeping obligations.
• Technical logs: typically retained for up to 90 days.

You may request earlier deletion of your personal data by contacting us at hello@packdown.co.uk. Requests are subject to any overriding legal obligations we have to retain the data.

7. Cookies and Local Storage

Packdown uses browser local storage and session storage to maintain your login session and remember app preferences such as your active band or theme. We do not use advertising cookies or third-party tracking cookies.

Our third-party providers such as Stripe and OneSignal may set their own cookies in accordance with their own privacy policies.

8. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — you can ask us for a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your personal data, subject to any legal obligations we have to retain it.
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — you can ask for your data in a structured, commonly used, machine-readable format.
• Right to object — you can object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds to continue.
• Right to withdraw consent — where processing is based on your consent (for example push notifications), you can withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@packdown.co.uk. We will respond within one month. We may ask you to verify your identity before processing your request.

9. Children

Packdown is not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

11. How to Complain

If you are unhappy with how we handle your personal data, please contact us first at hello@packdown.co.uk and we will do our best to resolve the issue.

You also have the right to lodge a complaint with the UK's data protection supervisory authority:

Information Commissioner's Office (ICO)
ico.org.uk · 0303 123 1113