Privacy notice

Who is responsible

The controller for your personal data is [company name, organisation number, address]. You can reach us at [privacy contact email]. When an organization uses Artisocia to handle bookings from its own customers, that organization is the controller for its customers' booking data, and we process it on its behalf.

What we keep

• Your account: email address, name, password (stored only as a hash), two-step verification keys (encrypted) and passkeys.
• Your settings: language, time zone and date and time formats.
• What you create and share: messages, events and answers, polls, files, song documents, comments, and your groups and roles.
• Security records: an audit log of sensitive actions such as role changes and account deletion, and short-lived rate-limit counters keyed by IP address.
• Support: emails you send to support, and our replies.
• The pilot list: if you ask to join the pilot on our home page, the name, city and email address you give, whether you are a band, a venue or neither, and when you confirmed and were invited.

Why we keep it

• To provide the service you signed up for (contract): your account, calendars, chat, files and sharing.
• To keep the service secure and prevent abuse (legitimate interest): rate limits, audit log and two-step verification.
• To send you the emails the service needs (contract): confirmations, invitations, reminders and the notifications you choose.
• To invite you to the pilot when you ask us to (your request, before a contract): we only use the pilot list to contact you about the pilot.
• We do not sell your data, show ads or use tracking or analytics cookies.

Who helps us

• Hetzner Online GmbH (Germany) runs our servers, file storage and backups in Helsinki, Finland (EU).
• Resend, Inc. (USA) sends and receives our email. It stores email metadata and delivery logs in the USA, under a data processing agreement with the EU Standard Contractual Clauses.

How long we keep it

• Your account: until you delete it. Deleting gives you 30 days to change your mind; after that your account and personal data are removed.
• The pilot list: an unconfirmed request for 7 days, an invited one for 30 days after the invite, and never longer than a year. It is removed as soon as you create an account. Ask us and we remove it at once.
• What you posted in shared groups (such as messages and events) stays for the others, shown as from "Deleted user".
• Notifications: 180 days. Support emails: 12 months after the case is closed.
• The audit log keeps its entries after deletion, without your name or account.
• Backups: about four weeks, after which deleted data is gone from them too.

Your rights

You can see, correct and download your data, ask us to delete it, object to or restrict how we use it, and take it elsewhere. Download a copy under Settings → Account → Download your data, and delete your account under Settings → Account. For anything else, write to [privacy contact email]. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).

Cookies

We only use cookies the service needs to work: one that keeps you signed in, one that is used during two-step sign-in, and one that remembers a password you entered for a shared link. Fonts and all other files are served from our own servers.