Privacy Policy

Controller

Enrico Winter
76149 Karlsruhe, Laerchenweg 24
Email: servicedesk@gigi.band

What is stored

When creating an account

Data	Purpose	Retention
Email address	Login, reminders before the subscription expires	until account deletion
Password	Login	only as a one-way hash (bcrypt), never in plain text
Name	Displayed in the app	until account deletion
Language	Displaying the app in the chosen language	until account deletion

Band content

Band name, member list with name and instrument, songs with title, artist, key and lyrics, and the setlists built from them. You enter this data yourself. It is not analyzed, not shared, and not used for advertising.

Band members' access code

The six-digit band code is also stored only as a hash, never in plain text. It can therefore not be looked up, only reset.

Private notes of band members

Band members can add a private note to individual songs (e.g. performance cues for themselves). This stores a self-chosen display name (no ID name needed, no email) and the note text, limited to 500 characters. The note is only visible to whoever enters the same name again — not to other band members or the band admin. Notes are deleted once the associated band or account is deleted, or when the band admin removes that person from the member list.

Rights of band members. The band code is the same for all members — Gigi cannot technically determine beyond doubt who is behind a self-chosen note name. This does not change the fact that a note can contain personal data once it concerns an identifiable person. Anyone who requests access, correction or deletion of their own notes should contact servicedesk@gigi.band and make it plausible which band and which note is meant (e.g. band name and rough content). Any further identity verification is neither possible nor proportionate for this type of data.

Free trial month

To ensure an email address can only try Gigi for free once, we record that a trial month has already been granted for that address. We additionally store a hash of the IP address — not the address itself. The hash cannot be reversed into the address; it only serves to detect an unusually high number of trial months from the same connection. Nobody is blocked because of this.

Logins

To prevent more devices from being logged in at once than the subscription allows, a hash of the session identifier is stored with a timestamp for each login. These entries are deleted automatically after a short time.

Failed login attempts

To protect against password guessing, failed attempts are recorded with IP address and time and deleted after a short time.

Cookies and local storage

Gigi sets one technically necessary cookie for login. It serves no analytics and no advertising purpose. There are no third-party cookies and no tracking — which is why there is no cookie banner.

Gigi additionally stores in your browser: the chosen language, the stage mode settings (font size, tempo), the self-chosen name for private notes (see above), and a copy of your data in case the server is unreachable. This data never leaves your device and can be deleted at any time in your browser settings.

Disclosure to third parties

Recipient	Purpose	What
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany	Operating the website and database	all data listed above; data processing agreement in place
Paddle.com Market Ltd.	Sales and billing	email address and payment data; Paddle is its own controller

Your rights

Access to your stored data
Correction of inaccurate data
Erasure
Restriction of processing
Data portability
Objection to processing
Complaint to a supervisory authority

As a band admin, you can delete your account together with all associated bands yourself, permanently, at any time — at the bottom of "Band & member management". For anything else, contact servicedesk@gigi.band.

Encryption

The connection is encrypted throughout via HTTPS. Passwords and access codes are stored exclusively as hashes.