Privacy Policy

Hedliner (“Hedliner,” “we,” “us,” or “our”) operates the Hedliner platform (the “Service”), a marketplace that connects live-music venues, bands, and booking agents. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

1. Information We Collect

Account information. When you create an account we collect your name, email address, profile photo (if you provide one via Google sign-in), and the role you select (Venue, Band, or Booking Agent).

Profile and listing information. Information you choose to add about your venue, band, or roster — including location, genre, capacity, deal terms, photos, and links.

Bookings and communications. Slots posted, applications, offers, messages, and reviews sent through the Service.

Authentication data. If you sign in with Google we receive your verified email address, name, profile picture, and a stable Google account ID (we do not receive your password). If you sign in with a magic link we collect the email address you provide.

Usage data. Standard log information such as IP address, browser type, pages viewed, and timestamps. We use Vercel Analytics and Speed Insights for aggregated, privacy-friendly usage metrics.

Cookies. We use first-party cookies necessary to keep you signed in (NextAuth session cookies). We do not use third-party advertising cookies.

2. How We Use Information

• To create and operate your account and authenticate you.
• To provide, maintain, and improve the Service.
• To facilitate bookings, applications, offers, messages, and reviews.
• To send transactional emails (magic-link sign-in, booking notifications, account changes). We do not send marketing email without your consent.
• To detect, prevent, and address fraud, abuse, or security issues.
• To comply with legal obligations.

3. Google User Data

When you choose “Sign in with Google” we request the basic openid, email, and profile scopes only. We use this information solely to create and authenticate your Hedliner account. We do not request access to Gmail, Drive, Calendar, or any other Google service, and we do not transfer your Google user data to third parties except as necessary to provide and improve user-facing features of the Service, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you. Hedliner’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Share Information

We share information with other Hedliner users as needed to operate the marketplace — for example, the venue you apply to will see your band profile and contact email. We also share information with service providers who process data on our behalf:

• Vercel — hosting, analytics, and infrastructure.
• Neon — managed PostgreSQL database.
• Upstash — Redis for rate limiting and caching.
• Resend — transactional email delivery.
• Google — sign-in and Maps services.

We do not sell personal information.

5. Data Retention

We keep account information for as long as your account is active. You can request deletion at any time by emailing privacy@hedliner.com. We may retain limited records as required to comply with legal obligations or resolve disputes.

6. Security

We use industry-standard safeguards including TLS encryption in transit, encrypted database storage, and least-privilege access controls. No system is perfectly secure; please use a strong, unique password where applicable and enable 2FA on your linked Google account.

7. Your Rights

Depending on where you live (e.g., California, EEA, UK) you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise these rights, email privacy@hedliner.com.

8. Children

Hedliner is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children.

9. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced via in-app notice or email. The “Last updated” date at the top reflects the most recent revision.

10. Contact

Questions about this policy? Email privacy@hedliner.com.