Privacy Policy
Last updated: 14 October 2026
1. Who we are
LemmeGIG is run by Radoslav Mihov, an individual based in Sofia, Bulgaria. For anything about your data, email support@lemmegig.com.
Under the GDPR, we are the controller of the personal data described below.
LemmeGIG is in public beta: it's free, it works, and it's still being built. This policy describes what the app does today and is updated before anything it describes changes.
2. What we collect, and why
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Your email address (from logging in with an emailed code) | Your account and logging in | Contract |
| Your name and, if you add it, your phone number | Shown to the members of the artists (bands) you belong to, so they know who's who and can reach you | Contract |
| Artist profile: name, bio, genre, city, band contact (name, email, phone), links | Shown to the artist's members; members can copy it to send to venues | Contract |
| Your content: songs, lyrics, chords, private notes, setlists, gigs, rehearsals, venues (name and city), tags | The service itself | Contract |
| Membership and lineup: who is in which artist, access level, instruments/parts, your Coming / Maybe / Can't answers | Running the roster and lineup features | Contract |
| Settings: language, last artist you opened, calendar colours, whether you've seen the intro tour | So the app remembers them across devices | Contract |
| Invite and guest links: who created them and when | Joining an artist; sharing a setlist or event with someone outside the band | Contract |
| Technical logs: time, the address of the request, the result, error details. Not your content. Your IP address is used only for rate limiting, in memory, and isn't stored by our API | Security, abuse prevention, fixing bugs | Legitimate interest |
| Backups of all of the above | Getting your data back after a failure | Legitimate interest |
What we don't do: no advertising, no tracking or analytics, no selling or renting of data, no AI processing of your content, no payment data (there are no payments).
Who sees what: your content is visible to the members of the artist it belongs to, according to their access level. Private notes are visible only to you. A guest link shows the shared setlist or event (songs, date and time, and for a gig the venue's name and city, never an address) to anyone who has the link, until it's cancelled.
3. Services we use (processors)
Each one only gets what it needs:
| Service | What for | Where |
|---|---|---|
| Auth0 (Okta, Inc.) | Login: your email address and login codes | Auth0's EU region. Okta is a US company; transfers are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Contabo GmbH | The server that runs the app and its database | Germany |
| Brevo (Sendinblue SAS) | Sending the login-code emails | France / EU |
| Hostinger | The websites (lemmegig.app, lemmegig.com) | France / EU |
| Titan (email service provided through Hostinger) | The support mailbox: emails you send to support@lemmegig.com | United States. Transfers are covered by Standard Contractual Clauses in Hostinger's data processing agreement |
| BorgBase (Peakford Ltd) | Encrypted backups (encrypted before they leave our server; BorgBase can't read them) | Malta / EU |
We share data with no one else, except when the law requires it (for example, a valid court order).
4. How long we keep it
- Your account and content: as long as your account exists.
- A deleted artist: restorable by its owner for 30 days, then deleted for good.
- Your account: deleted on request (see §5) within 30 days.
- Backups: encrypted; daily for a week, weekly for a month, monthly for 6 months, then removed. Deleted data can stay in older backups until they expire. Backups are only used to recover from a failure, never to bring back something you deleted.
- Technical logs: rotated automatically, kept for a few weeks at most.
5. Your rights
You can ask us to see your data (access), correct it, delete it (erasure), send you a copy in an open, machine-readable format (portability: your songs as ChordPro, everything else as JSON), restrict or object to processing.
Email support@lemmegig.com from the address you log in with. We answer within one month. In-app account deletion and export are planned; until then, these requests are handled by hand.
You can also complain to the data-protection authority: in Bulgaria, the Commission for Personal Data Protection (КЗЛД, cpdp.bg), or the authority where you live.
6. Storage on your device
The app keeps on your device only what it needs to work:
- your login (Auth0 tokens in the browser's storage), so you stay logged in;
- a copy of the app and data you've opened (for speed and offline use);
- small preferences such as light/dark mode.
Auth0's login page uses its own strictly necessary cookies for the login itself. There are no advertising, analytics or tracking cookies, on the app or on the website, so there's no cookie banner.
7. Age
LemmeGIG is for people aged 16 and over. If you think someone younger has an account, tell us and we'll delete it.
8. Songs you didn't write
Chords and lyrics of other people's songs are your responsibility. See the Terms, §5, for how copyright complaints are handled.
9. Changes
When this policy changes in a way that matters, we tell users in the app and/or by email before the change takes effect. The date at the top shows the latest version.
10. Contact
Radoslav Mihov, Sofia, Bulgaria · support@lemmegig.com