1. Controller and scope

VibeX is the controller for personal data used to provide BandSet unless another notice says otherwise. Contact: admin@vibexofficial.com. This notice applies to the website, installed web app and related administrator services.

Band leaders also decide which member details and band content they add to a workspace. Leaders must have an appropriate basis for sharing another person's information.

2. Data we process

• Account and profile data: name, email, account identifiers, role, language, plan and legal-acceptance record.
• Band data: memberships, invitations, instruments, songs, chord sheets, notes, setlists, requests, chat, event details and attendance responses.
• Billing data: plan, subscription status, Paddle or legacy Stripe customer/subscription identifiers, invoice totals, tax, currency and refund status. BandSet does not receive full payment-card details. Necessary financial records may be retained after account deletion for applicable accounting, tax and dispute obligations; access is restricted.
• Device and technical data: session data, push token, browser/app information, IP and security or diagnostic logs generated by infrastructure providers.
• App activity: administrators can see observed sign-in sessions, last visible connected activity, email verification status, approximate country derived from infrastructure geolocation, existing account-created bands, songs, setlists and gigs, and aggregate visits to named features. Authorised support staff can view individual account diagnostics for support. This helps identify setup difficulties and service problems. Visits are recorded from the version introducing this feature, not reconstructed for earlier use. This feature does not store raw IP addresses, precise location, passwords, searches, complete page URLs or private message or song content. Country may be inaccurate, particularly with VPNs. Online status and visit counts do not measure reading, playing time or successful use of every button. Activity records are retained for up to 90 days under the scheduled cleanup and removed with the account.
• Support action history: authorised administrators and support staff can inspect a per-account timeline of reported page or tool openings and successfully saved creations, edits, movements, deletions and restorations. Records contain timestamps, account and item identifiers, band context, short item titles, changed field names, and limited operational before/after values such as tempo, key, position or status. Bulk operations are grouped and detail samples are limited. The log does not copy message bodies, song content, notes, passwords, payment card data, searches or full URLs. Page visits are client-reported diagnostics, not proof that a person read a page; offline actions appear only when successfully saved to the server, using server time. This history starts when enabled, is restricted to support purposes, retained for up to 90 days under scheduled cleanup, and removed when the account is deleted.
• Support data: bug reports, requests, correspondence and moderation records.
• Entry credits: the chosen public name, or first name and last initial, plus the workspace band name and contribution time may be shown to people who can access that song. Global-library credits are shared with global-library readers. Changes to your credit preference apply to future contributions; contact us to request correction of an existing credit.

3. Purposes and legal bases

• Perform the contract: create accounts, synchronise bands, process requests, provide plans and support.
• Legitimate interests: secure the service, prevent fraud and abuse, diagnose failures, enforce rules and improve reliability, balanced against user rights.
• Legal obligations and claims: tax/accounting records, valid authority requests, dispute handling and protection of legal rights.
• Consent where required: optional browser push notifications or another clearly optional feature. Consent can be withdrawn through device or account settings.

4. Providers and transfers

BandSet uses service providers such as Supabase for database and authentication, Paddle for enabled purchases (or Stripe for legacy subscriptions), OneSignal for optional push notifications, hosting providers such as Vercel, and Google/Gemini only when an AI-assisted feature is invoked. Providers process data under their own terms and data-protection commitments.

When subscription analytics is enabled, RevenueCat receives an account identifier and purchase references and processes related subscription data supplied by the payment provider. This integration does not send song lyrics or band chat messages. Account deletion queues removal of the analytics profile, subject to processing time and applicable retention obligations; it does not itself cancel a payment-provider contract.

Data may be processed outside your country. Where required, BandSet relies on an adequacy decision, contractual safeguards or another lawful transfer mechanism.

5. Retention

Account and workspace data is generally kept while the account or band workspace is active. Users and leaders can remove many items earlier. Short-lived requests and offline caches may be deleted automatically according to product settings.

After deletion, limited backups, billing records, security logs, acceptance records and dispute evidence may remain only for the period required by law, provider backup cycles, fraud prevention or legal claims, then be deleted or anonymised.

6. Your rights

• Request access to, correction of or deletion of your personal data.
• Request restriction, portability, or object to processing where the law provides those rights.
• Withdraw optional consent without affecting earlier lawful processing.
• Complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection or another competent supervisory authority.
• A request may require identity verification. BandSet will respond within the period required by applicable law and explain any lawful refusal or limitation.

7. Storage, security and children

BandSet uses access controls, row-level database rules, encrypted transport and administrative safeguards. No online service can promise absolute security, so users must protect passwords and report suspected compromise promptly.

BandSet is not directed to children who cannot legally consent to an online service in their country. A parent or guardian should contact BandSet if a child provided personal data without proper authorisation.

8. Local device storage and updates

The app uses browser or device storage for authentication, language, theme, pending checkout, offline gig packs and cached band data. Clearing site data or uninstalling the app removes local copies but does not automatically delete server data.

This notice may be updated when processing changes. Material updates will be highlighted and renewed acknowledgement may be requested. Contact admin@vibexofficial.com for privacy questions or to exercise a right.