Gigamie is run by Ellie Brigida, a sole proprietor in Massachusetts ("we", "us"). This policy explains what information we collect from the bandleaders who subscribe to the app and from the people who use each band's copy of the app, how we use it, who we share it with, and how we keep it safe.
Information we collect
- Subscribers (bandleaders): your name, email address, band name and the details you give us when we set up your app. When you pay, Stripe collects your card details. We receive only your name, email, band name, plan and payment status, never your full card number.
- Band app data: information your band puts into its own copy of the app, such as client names, contact details, event details, contracts and signatures, musician details, availability, set lists and song requests. We hold this on your band's behalf. Your band decides what goes in it and is responsible for its own notices to its clients and musicians.
- Sign-in and security records: admin email addresses, one-time sign-in codes (stored only in scrambled form), sign-in attempts, IP addresses and times of signatures and sign-ins, and a log of admin actions.
- Connected accounts: if a band connects Google or QuickBooks, the connection key that lets the app use those services. See "Connected services" below.
How we use it
- To set up, run, maintain, secure and support each band's app.
- To bill subscriptions and send receipts and account notices.
- To answer your questions and fix problems you report.
We do not sell personal information, we do not use it for advertising, and we do not look at a band's data except to host, maintain or support its app, when the band asks us to, or when the law requires it.
Who we share it with
We share information only with the service providers that run the app, and only as needed for that purpose:
- Stripe: subscription payments.
- Vercel: hosting of the app's web pages and servers.
- Supabase: the database for each band's app. Each band has its own separate database.
- Google: when a band connects its Google account, for its calendar and for sending its emails from its own Gmail address.
- Intuit (QuickBooks): when a band connects QuickBooks, to create and send its invoices.
- jsDelivr and cdnjs: some management pages load code libraries from these services, so they receive your IP address and browser type when a page opens. They do not receive anything you type into the app.
- Google Fonts: only when a band picks a custom font for its inquiry form, which then loads that font from Google, so Google receives the visitor's IP address and browser type. The app's own fonts are hosted with the app.
- Email delivery services (only if a band chooses one instead of its own Google account), such as Resend, Postmark or SendGrid: to deliver that band's emails.
We may also disclose information when required by law, to protect the safety of any person, or as part of a sale or transfer of the business, in which case this policy continues to apply.
How it is disclosed
Information is sent to these providers only over encrypted connections (HTTPS/TLS), through their official interfaces, and only the information each one needs.
How we keep it safe
- All connections to the app are encrypted (HTTPS, with HSTS).
- Each band's data is kept in its own separate database.
- Admins sign in with their own email address and a one-time code, and sign-in attempts are limited to block guessing.
- Sign-in sessions use secure, HttpOnly cookies, and requests are protected against cross-site attacks.
- Keys for connected Google and QuickBooks accounts are stored encrypted (AES-256-GCM).
- The app never stores card numbers, bank account numbers or tax ID numbers.
- Administrative access to the hosting and database accounts is limited to the owner and protected by the providers' own security controls.
Connected services
A band can connect QuickBooks Online. The app then uses bookkeeping access only, to create and send invoices. A band can disconnect QuickBooks at any time in its app's settings.
Google account data
A band can connect its own Google account. Its booking hosts (the people who take booking calls) can also connect their own Google accounts. Google shows each person the permissions on its sign-in page, and the app asks only for what its features use.
When a band connects its Google account, the app asks for:
| Permission | What the app does with it |
|---|---|
| Google Calendar events (see and add events) | Reads events on the calendar the band picks, to find booked gigs, write gig drafts and availability requests, and spot dates musicians marked as out. Adds signed gigs to that calendar. It never edits or deletes events the band made. |
| Your list of calendars (read only) | Shows the band its calendars so it can pick which one the app uses. |
| Calendar details (read only) | Reads the chosen calendar's time zone, so gig times are right. |
| Gmail: send email on your behalf | Sends the band's own emails from the app, such as gig details, contracts, booking confirmations and sign-in links, from the band's Gmail address. |
| Email address | Shows which Google account is connected. |
The app does not read, search, label or delete any email. It can only send.
When a booking host connects a Google account, the app asks for calendar access only, and no Gmail access:
| Permission | What the app does with it |
|---|---|
| Busy times on your calendars | Checks when the host is busy, so the band's booking page only offers open times. The app sees busy and free blocks, not event details. |
| Google Calendar events (see and add events) | Adds each booked call to the host's calendar with a Google Meet link, and moves or removes it when the client reschedules or cancels. |
| Your list of calendars (read only) | Lets the host pick which calendars count as busy and where new calls go. |
| Email address | Shows which Google account is connected. |
What the app keeps. The sign-in key Google gives the app is stored encrypted. Gig details read from the calendar (date, times, title, location and notes) are saved as part of the band's own gig records. For booked calls, the app keeps the calendar event ID and Meet link. Busy times are used to work out open times and are not saved.
Limited Use. Gigamie's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features above. It is never sold, never used for advertising, and never used to train AI models. It is shared only with the providers that run the app, as needed for these features, or when the law requires it. No person reads it, except with the band's permission, to fix a problem the band reports, for security, or when the law requires it.
Removing access. A band can click Disconnect under Google account in its app's settings, and can disconnect a booking host on the Bookings tab. The app then tells Google to cancel its access and deletes the stored sign-in key. Anyone can also remove the app's access at any time at myaccount.google.com/permissions.
How long we keep it
We keep a band's data, including what it brought in from Google, for as long as its subscription is active. When a subscription ends, we send the band an export of its data on request within 30 days, then delete its copy of the app and its database. Copies in our providers' automatic backups are removed on their own schedule, within 90 days after that. Billing records are kept as long as tax and accounting rules require.
When a band or booking host disconnects Google, the stored sign-in key is deleted right away. Gig records already saved stay in the band's app until the band deletes them or its copy is deleted.
Your choices and deletion
You can ask to see, correct, export or delete your information by emailing ellie.brigida.apps@gmail.com. A band can ask us to delete its whole copy of the app, including any Google data, at any time. We complete a deletion request within 90 days. If you are a client or musician of a band that uses the app, please contact that band first, since it controls its own data. We will help it respond.
Children
The app is not intended for children under 13 and we do not knowingly collect their information.
Changes
We may update this policy. The date at the top shows when it last changed, and we will tell subscribers about important changes by email.