Band Maker Pro Privacy Policy

Version dated 2 September 2026

1. Data controller

The data controller is Serge Louis ROBOLY, sole proprietor and publisher of Band Maker Pro.

Contact for matters relating to personal data: contact@bandmakerpro.com.

Address and identification details: see the Legal Notice.

2. Data processed

Depending on the features used, Band Maker Pro may process:

• account data: internal identifier, username, email address, hashed password, language and preferences;
• profile data: biography, photograph, city, region, country, instruments, musical styles, experience and equipment;
• relationship data: contacts, requests, group memberships and roles;
• content: private or group messages, events, availability, repertoires, setlists, songs and chord charts;
• subscription data: plan, status, dates, Stripe technical identifiers and the history required to manage the Early Supporter offer;
• technical data: login and activity dates, IP address or security logs when collected, device, operating system, push notification token and technical incidents;
• support requests and requests to exercise data protection rights.

Band Maker Pro does not store complete payment card details, which are processed by Stripe.

3. Purposes and legal bases

Data is processed in order to:

• create and administer the account, provide the features and perform the contract;
• manage subscriptions, payments, renewals, cancellations and access, on the basis of the contract and legal obligations;
• provide the messaging, group, calendar and contribution features requested by the user, on the basis of the contract;
• ensure security, prevent fraud, diagnose incidents and defend Band Maker Pro's rights, on the basis of legitimate interests and legal obligations;
• send the functional notifications selected by the user, on the basis of the performance of the service or consent where consent is required;
• comply with accounting, tax, judicial and regulatory obligations.

No data is sold. In the version of the service described by this policy, Band Maker Pro does not use data for third-party behavioural advertising.

4. Mandatory information

Fields identified as mandatory are required to create the account, process payment or provide the relevant feature. Without this information, the requested service may not function. Optional profile information may be left blank or removed.

5. Recipients and service providers

Data is accessible to the publisher of Band Maker Pro and, strictly to the extent necessary, to the following service providers:

• o2switch, for hosting the website, APIs and databases;
• Stripe, for payments and subscription management;
• Expo and Apple or Google notification services when push notifications are enabled;
• Apple and Google for distribution of the application and associated technical services;
• public authorities or professional advisers where required by law or for the defence of a legal right.

Where data is processed outside the European Economic Area, Band Maker Pro relies on the applicable transfer mechanisms and safeguards offered by its service providers, subject to contractual verification before final publication.

6. Visibility between users

Information made public or shared by the user may be visible to the relevant members, depending on the settings and features used: public profile, group membership, messages, events, repertoires or contributions.

The email address, password, Stripe identifiers and push notification token are not intended to be made public.

7. Retention periods

Account and profile data is retained for as long as the account is in use. If the account is deleted, this data is deleted or anonymised within a reasonable period, except where a legal obligation, evidentiary requirement or a specific rule applicable to community contributions requires otherwise.

Accounting records and billing information subject to a legal retention obligation may be retained for ten years. Contractual evidence and information required to manage a dispute may be archived for the applicable limitation period.

Technical and security logs are intended to be retained for a rolling period of between six months and one year, unless a specific reason justifies longer retention.

Messages, events, groups and other content are retained for as long as necessary to provide the corresponding features. They may be deleted by the user where the relevant feature permits this, or when the account is deleted, subject to content or independent copies retained by other users under the conditions described in Article 8.

Data relating to an inactive account may be retained for as long as the account remains open, so that its holder can regain access to their space. Band Maker Pro may introduce the deletion of accounts that have remained inactive for an extended period after giving prior notice to their holders and allowing the announced period to expire.

Technical backups are retained only for the cycles required to secure and restore the service, after which they are replaced or deleted in accordance with the hosting provider's procedures. They are not used to restore deleted data to the live service, except where required for security purposes or by law.

8. Account deletion and contributions

The user may request deletion of their account. Information directly linked to their identity is deleted or anonymised, subject to legal obligations.

When a chord chart published in the Songbook has been added to another user's favourites, Band Maker Pro creates an independent copy associated with that other user's account. Deletion of the original chord chart or of its author's account therefore does not result in the deletion of that copy.

After the original author's account is deleted, copies still present in other users' favourites are disassociated from that account. The author's username is replaced with the wording “Deleted user”, so that the author can no longer be identified through their former account.

If the holder of the copy modifies it, the modified version is associated with their own account and username. A request relating to a specific contribution or persistent attribution may be sent to contact@bandmakerpro.com.

9. Notifications

The user may enable or disable push notifications and the notifications offered in their settings. Disabling them may result in the deletion or invalidation of the push token associated with the device.

Communications strictly necessary for the contract, security, payment or cancellation may be sent regardless of promotional communication preferences.

10. Data subject rights

Under the conditions provided for by the GDPR and the French Data Protection Act, users may exercise their rights of access, rectification, erasure, restriction, objection and portability, and may withdraw their consent.

Requests may be sent to contact@bandmakerpro.com. Proof of identity may be requested only where necessary to prevent disclosure to a third party.

Users may lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.

11. Minors

Band Maker Pro is not intended for children under the age of 15. In France, where processing offered directly to a child under 15 is based on consent, the joint consent of the child and the holder of parental responsibility may be required. General rules governing legal capacity continue to apply.

12. Security

Band Maker Pro implements technical and organisational measures proportionate to the risks, including access restrictions, encryption of data in transit, password protection, verification of payment events and logging necessary for security.

As no system can provide absolute security, any confirmed incident is handled in accordance with the applicable obligations, including notification of the affected individuals or the CNIL where required.

13. Cookies and tracking technologies

Band Maker Pro uses cookies or storage technologies that are strictly necessary for sessions, authentication, security, language preferences and requested features.

In the version of the service described by this policy, Band Maker Pro does not use advertising trackers or audience measurement trackers that are not strictly necessary.

The application uses the technical services of Expo, Apple and Google, particularly for its distribution and, where enabled by the user, for push notifications. Stripe is involved when payment and subscription features are used. These service providers may process identifiers or technical information in accordance with their own policies and the user's settings.

If Band Maker Pro subsequently adds a tracking technology that is not strictly necessary, it will be described and, where required by law, subject to the user's prior consent.

14. Changes to this policy

This policy may be updated to reflect changes to the service or applicable regulations. Users will be informed of material changes where required.

Translations are provided to facilitate understanding. In the event of any discrepancy, the French version shall prevail, subject to any applicable mandatory provisions.