Gigflow Privacy Policy
1. Introduction
Gigflow ("we", "us", or "our") is a gig management and tax tracking application for freelance musicians in the United Kingdom. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Gigflow is operated by Gigflow Ltd, registered in England and Wales. We are the data controller for the personal data processed through this application.
2. Data We Collect
Account Information: Name, email address, profile photo, and password (encrypted).
Gig Data: Dates, venues, fees, agencies, gig types, show types, and notes you enter about your performances.
Venue Information: Venue names, addresses, postcodes, and geographic coordinates for mileage calculations.
Agency Information: Agency names and commission structures you configure.
Financial Data: Payment records, expenses, receipt images, and bank details (account name, sort code, account number) you provide for invoicing purposes.
Location Data: Your home postcode for mileage calculations. We do not track your real-time location.
Usage Data: Basic analytics about how you use the application to help us improve our service.
3. How We Use Your Data
We process your personal data for the following purposes:
To provide the Gigflow service, including gig tracking, mileage calculations, invoicing, expense management, and tax reporting features.
To send invoices on your behalf when you use our invoicing feature.
To generate calendar feeds and shared calendars as configured by you.
To process subscription payments through our payment provider, Stripe.
To communicate with you about your account, service updates, and support requests.
4. Legal Basis for Processing
Contract: Processing necessary to provide the Gigflow service you have signed up for.
Legitimate Interests: Analytics and service improvement, fraud prevention, and security.
Consent: Where required, such as for optional marketing communications.
5. Data Storage and Security
Your data is stored on secure cloud infrastructure provided by Supabase, which uses Amazon Web Services (AWS) with servers located in the European Union.
We implement industry-standard security measures including:
Encryption of data in transit using TLS/SSL and encryption of data at rest.
Secure authentication with encrypted password storage.
Row-level security ensuring users can only access their own data.
Regular automated backups with point-in-time recovery capability.
Important: We do not store bank login credentials or payment card details. Subscription payments are processed securely by Stripe, and we do not have access to your full card information.
6. Data Sharing
We do not sell your personal data. We share data only with:
Supabase: Our database and authentication provider (EU data residency).
Stripe: For processing subscription payments.
Google Maps Platform: For venue address lookup and distance calculations (addresses only, not linked to your identity).
Email Service: For sending invoices on your behalf.
7. Data Retention
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain certain records for legal or tax purposes (up to 7 years for financial records as required by HMRC).
8. Your Rights
Under UK GDPR, you have the right to:
Access: Request a copy of your personal data.
Rectification: Correct inaccurate data.
Erasure: Request deletion of your data ("right to be forgotten").
Portability: Export your data in a machine-readable format.
Object: Object to processing based on legitimate interests.
To exercise any of these rights, please contact us at . We will respond within one month.
9. Cookies
Gigflow uses essential cookies required for authentication and application functionality. We may also use analytics cookies to understand how the service is used. You can manage cookie preferences in your browser settings.
10. Children's Privacy
Gigflow is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of Gigflow after changes constitutes acceptance of the updated policy.
12. Contact Us
For privacy-related queries or to exercise your rights:
Email: hello@gigflow.co.uk
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at if you believe your data protection rights have been violated.
