Privacy Policy
Last updated 21 October 2026
This policy explains what personal information GigLink collects, why, who it is shared with, how long it is kept and the choices you have. It applies to the GigLink app (iPhone, Android and web) and the website giglink.live.
It is written to meet the New Zealand Privacy Act 2020 and the European Union and UK General Data Protection Regulation (GDPR), so the same protections apply wherever you are.
1. Who we are
GigLink is a New Zealand business ("GigLink", "we", "us"). We are responsible for your personal information (under the GDPR, we are the "controller").
Contact our privacy officer at privacy@giglink.live.
2. The short version
- We collect what you give us (your profile, gigs, messages, payments) and a little technical information to keep the app running and safe.
- Your profile is visible to other people signed in to GigLink. That is the point of the app: venues and artists need to find each other.
- Card and bank details go straight to our payment provider, Stripe. We never see or store them.
- Messages are stored encrypted. They are not end-to-end encrypted: we can read them when we need to, for example to deal with a report, prevent fraud or meet a legal obligation.
- We do not sell your information and we do not show advertising.
- You can see, correct and delete your information. Deleting your account is in Settings.
3. What we collect
Information you give us
| Information | Who | Why |
|---|---|---|
| Email address and password | Everyone | To create and secure your account. Passwords are stored only as a secure hash by our database provider. |
| Account type (venue or artist) | Everyone | To show you the right features. |
| Display name, bio, city, genres, profile and cover photos, other photos, a website or other link | Everyone (optional except name) | To build your public profile. |
| Venue street address, map location (worked out from the address), country, capacity | Venues | So artists can find gigs near them. The country decides the gig currency. |
| Spotify and SoundCloud links | Artists (optional) | To show your music on your profile. We look up the public name of the page and can verify you run it (see section 5). |
| Tour dates (city, dates, notes) | Artists (optional) | So venues can find artists passing through. |
| Gigs: title, description, date and times, fee, slot type, genres | Venues | To advertise the gig. |
| Applications, fee offers and booking agreement confirmations | Both | To arrange and record bookings. |
| Chat messages | Both | So venues and artists can talk. See section 6. |
| Reviews and ratings | Both, after a gig | To build trust between users. |
| Reports and blocks | Anyone | To keep people safe. |
| Messages to our support team (bug reports, feedback, questions), with your device type and app version | Anyone | To answer you and fix problems. |
| An email address at the website Google Maps lists for your venue, or a phone call from us to the number Google Maps lists | Venues who choose to verify | To check you run the venue (the optional "Verified" badge). |
| Your venue's Google Maps listing (Google's place ID, business name, website and whether it's open) | Venues who pick their address from the suggestions | To place you accurately on the map and show "On Google Maps". |
| Settings (notification choices, hide offensive language, light or dark mode) | Everyone | To remember your preferences. |
| Beta sign-up: email address, artist or venue, iPhone or Android, town or city | Anyone who signs up for the beta on giglink.live | To invite testers and tell you about the beta and launch. We also keep a scrambled (hashed) form of your IP address for one day, for a limit that stops spam sign-ups. |
Payment information
When you pay or set up payouts, you do it on Stripe's own secure pages. Stripe collects your card details, and for artists the identity and bank account details it needs to pay you. Stripe handles that information under its own privacy policy (stripe.com/privacy). We receive and keep the amounts, fees, currency, dates, payment status and Stripe's reference numbers, and whether an artist's payout account is ready.
Information collected automatically
- Notification token: if you allow notifications, an identifier for your device so we can send push notifications.
- Technical logs: our providers record technical information such as IP addresses, times and errors when the app talks to our servers. We use it only to run and protect the service.
- On your device: the app stores your login session securely (the iPhone Keychain or Android Keystore; on the web, your browser's storage) and a few settings, such as your appearance setting. We do not use advertising or tracking cookies.
We only use your device's location if you tap Use my location in the Gigs filters (and allow it). Your phone turns it into a town name, and the position is sent with that search to find gigs near you. It is not saved to your account. Otherwise, location-based search uses the city or address you type in.
4. Who can see what
- Signed-in GigLink users can see your profile: name, photos, bio, city, genres, links, reviews and rating, how many gigs you have been paid for through GigLink, any late cancellations, and your upcoming and recent booked gigs (date, title and who with, never the fee). For venues, this includes your street address, so artists know where the gig is.
- Gigs are visible to signed-in users.
- Chat messages, applications, fee offers and booking agreements are visible only to the venue and artist involved (and to GigLink, see section 6).
- People you have blocked, or who have blocked you, cannot see each other's content or contact each other.
- Signed-out visitors cannot see anything about you.
- If you share a gig using the Share button, the text you share goes wherever you send it.
5. How we use your information, and our legal reasons
| Use | Legal reason (GDPR) |
|---|---|
| Running your account, profiles, gigs, applications, chat, bookings, reviews and notifications | Performing our contract with you |
| Taking payments, holding them, paying artists, refunds, cancellations and no-show decisions | Performing our contract with you |
| Keeping payment and tax records | Legal obligation |
| Safety: rate limits, blocking card and bank numbers in chat, refusing slurs and spam, hiding gigs reported by several artists, reviewing reports, suspending accounts | Our legitimate interest in a safe, trustworthy service |
| Checking the website Google Maps lists for a venue (and when its domain was registered), and looking up the public names of Spotify and SoundCloud pages | Our legitimate interest in helping people trust who they are dealing with |
| Answering support messages and fixing bugs | Our legitimate interest in running the service |
| Beta sign-up emails | Your consent, given when you sign up (you can ask us to remove you at any time) |
| Push notifications | Your consent, given in your phone's settings (you can turn them off there or in GigLink's Settings) |
Automated decisions. Some protections run automatically: limits on how many gigs, applications and messages new accounts can send; refusing gig text that looks like an advert or contains slurs; blocking card and bank numbers in chat; and hiding a gig after reports from three established artists until we review it. Suspending an account is always a decision made by a person. If you think an automatic decision got it wrong, contact us and a person will look at it.
6. Messages
- Messages are encrypted in our database with a key that GigLink controls. This protects them if our database, a backup or an export were ever exposed.
- They are not end-to-end encrypted. GigLink can read them, and our systems check each message before storing it (for card and bank numbers, slurs and links from new accounts). We read messages only when needed: to deal with a report, investigate fraud or a payment dispute, or meet a legal obligation.
- If you delete a message, it disappears for both of you, but we keep a private copy for 30 days so that abuse cannot be sent and then deleted before it is reported.
- Notifications about a new message say only that you have a message, not what it says.
7. Who we share information with
We share information only as described here, and we never sell it.
- The other person in a booking: the venue and artist see each other's profile, messages and booking details.
- Service providers who run parts of GigLink for us, under contracts that limit what they can do with it:
| Provider | What they do | Where |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, photo storage, server functions | Sydney, Australia |
| Stripe | Payments, holding funds, artist payouts, identity checks for payouts | New Zealand, Australia, United States and other countries |
| Expo, Apple and Google | Delivering push notifications | United States and other countries |
| Cloudflare | Hosting the website and web app, network security, forwarding email sent to our giglink.live addresses | Worldwide |
| Resend | Sending GigLink's emails: sign-up confirmation, password reset, venue verification and beta list emails | United States |
| Google (Gmail) | Our email inbox, which receives your emails to us and alerts about reports and support requests | United States and other countries |
| Google (Places) | Suggesting addresses as a venue types, and checking the venue's Google Maps listing | United States |
| Apple and Google (on your device) | Turning a typed address into a map location, and your position into a town name | As set by your device |
- Spotify and SoundCloud: when an artist adds a link, we ask Spotify or SoundCloud for that page's public name (and, for verification, its public bio). Their music players load only when you tap them, and then Spotify or SoundCloud may collect information under their own policies.
- Domain registries: when a venue verifies by email, we look up when the website's domain was registered.
- Authorities and others when required: if the law requires it, to protect someone's safety, to prevent fraud, or to enforce our terms.
- A buyer of GigLink: if GigLink is sold or merged, your information may move to the new owner, who must keep this policy's protections.
8. Information sent overseas
Our database is in Australia and some of our providers are in the United States and elsewhere, so your information is processed outside New Zealand (and outside your own country). We use providers that protect information to a standard comparable to New Zealand and GDPR law, and rely on the standard contractual clauses in their data processing agreements for transfers out of the EU and UK.
9. How long we keep it
| Information | How long |
|---|---|
| Your account and profile | Until you delete your account |
| Gigs, applications, bookings, messages, reviews | Until the account they belong to is deleted (see below) |
| Private copies of deleted messages | 30 days |
| Notifications in the app | 30 days |
| Blocks | Until you unblock the person or delete your account |
| Reports and support messages | 2 years once dealt with, or longer if needed for a dispute or legal claim |
| Payment records | 7 years, as required for tax and accounting, even after an account is deleted (with your personal details removed) |
| Beta sign-ups | Until 6 months after the app launches publicly, or sooner if you ask us to remove you |
When you delete your account (Settings > Delete account), we delete your account and everything linked to it. If you have any payment history, we instead remove your personal details (name, email, photos, profile text) and keep the anonymised payment records, which we are required to keep.
10. Keeping it safe
We protect your information with encrypted connections, encrypted message storage, private photo storage (photos are shown through links that expire after an hour), secure login storage on your device, and database rules that stop people seeing what they should not. No system is perfectly secure. If a breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.
11. Your rights
You can:
- see the personal information we hold about you;
- correct it (most of it you can edit yourself in the app);
- delete it (Settings > Delete account), apart from records we must keep by law;
- get a copy in a portable format;
- object to, or ask us to restrict, how we use it;
- withdraw consent to notifications or beta emails at any time.
Email privacy@giglink.live. We will reply within 20 working days. We may need to confirm who you are first.
If you are not happy with our answer, you can complain to the New Zealand Privacy Commissioner (privacy.org.nz), or, if you are in the EU or UK, to your local data protection authority.
12. Age
GigLink is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you think someone under 18 has an account, contact us and we will delete it.
13. Changes
We may update this policy. If we change it in a way that matters, we will tell you in the app before the change takes effect, and the date at the top will change.
14. Contact
GigLink, New Zealand. Privacy questions: privacy@giglink.live. Anything else: support@giglink.live.