Privacy Policy
Last updated: 22 October 2026
This English version is a convenience translation. Only the German version is legally binding: German original.
1. Controller
The controller responsible for the processing of personal data on this website and in the BSTAGE platform is:
BSTAGE UG (haftungsbeschränkt) in formationUnterer Ahlenbergweg 39a, 58313 Herdecke
Email: contact@bstage.studio
Under § 38 BDSG (German Federal Data Protection Act), we are not obliged to appoint a data protection officer. We answer questions about data protection at contact@bstage.studio.
2. At a glance
- This website sets no cookies, uses no tracking and no analytics services.
- The website’s fonts are hosted on our own server. No request is sent to Google when you visit.
- In the platform, we only use cookies and storage that are necessary for it to function.
- We do not sell data and do not use it for advertising.
3. Visiting this website
When you access this website, our hosting provider processes, as is technically necessary, your IP address, the date and time of access, the address accessed, the amount of data transferred, and your browser and operating system. Without this data, the site cannot be delivered or protected against attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable provision of the website.
Hosting: The website and the platform run on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (see section 13). The database is located in the EU; uploaded files are located in data centres in Western Europe. Every night we back up the database and the uploaded files to storage at Cloudflare located in the EU. Each database backup is deleted after 30 days, the backup copy of a file no later than 30 days after the file was deleted.
Contact form and email
If you write to us via the contact form or by email, we process your name, your email address, your topic, your message and – if you provide it – your company in order to answer your enquiry. The form sets no cookies and does not embed any third-party services to fend off spam.
The message is passed via Cloudflare to our email delivery service Resend and delivered to our mailbox. The mailbox is hosted by Mailbux (CloudWish LLC), according to the provider on servers in the EU (see section 13).
Legal basis: Art. 6(1)(b) GDPR if your enquiry concerns or initiates a contract with us, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries.
Retention period: We delete your enquiry six months after the last message in that exchange, so that follow-up questions remain possible. If it leads to a contract, we retain it as a business letter (Geschäftsbrief) for six years (§ 257 HGB (German Commercial Code), § 147 AO (German Fiscal Code)).
4. Registration and sign-in
To use the platform, you create an account. In doing so, we process your name, your email address, your password – stored exclusively as a cryptographic hash – and the workspace you choose (event, agency or artist). You may voluntarily store billing and bank details in your account. We store the language you choose for the website and the platform in your account, so that emails and the interface appear in that language.
When you sign in, a session is created. With it, we store your IP address and your browser’s identifier, so that you can recognise and end sessions on other devices and so that misuse is noticed. Repeated sign-in attempts are counted and limited per IP address for a short time.
If you activate two-factor authentication, we store the secret key material and your recovery codes in protected form.
When you accept the Terms and Conditions (Allgemeine Geschäftsbedingungen, AGB), we store in your account which version you accepted and when. This is our proof that the Terms and Conditions apply to your account.
Legal basis: Art. 6(1)(b) GDPR for the account and the session, Art. 6(1)(f) GDPR for the security measures and the proof of acceptance.
Beta application and invitation codes
As long as BSTAGE is in beta, you briefly apply after registering, before we approve your account. In doing so, we process your name or that of your company, your role (event, agency or artist), your city, voluntarily your website and links to your social channels, and your text on why you want to take part. We also store when you applied, when and by whom on our team a decision was made (approval or waiting list), an internal note on the decision and the origin of the approval (application, invitation code, invitation by a beta tester or existing account). For beta testers, we store the reserved benefits (free period and discount).
Purpose: selecting beta testers and managing their benefits. Legal basis: Art. 6(1)(b) GDPR (initiation and performance of the contract of use during the beta phase, Terms § 5a). Recipients: only the BSTAGE team; for a new application, an internal email goes to our mailbox (sent via Resend, see section 9), stored at Cloudflare (see section 13). We do not send you the internal note by email; you receive it like all other details with your data access request (export in your account).
Invitation codes are created by our team; we only store a check value (hash) of the code, a label, the number of permitted and used redemptions and the expiry. If you register with a code, we store in your account which one. If you are invited as an artist without an account by an agency or promoter and take over the profile created for you, we match your email address with this invitation and store who invited you.
Storage period: We place applications that we do not approve on a waiting list. We store their details until your account is activated at the official launch and then delete them automatically; only the time of your application remains in your account. We store accepted applications and the approval details until your account is deleted.
5. Sign-in with Google
Instead of using a password, you can sign in with your Google account. Google then transmits your name, your email address, your profile picture and an account identifier to us. We store the access tokens in encrypted form. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible (see section 13).
While signed in, you can link a Google account to your account later, even one with a different email address than your BSTAGE account. The sign-in address of your BSTAGE account stays unchanged. We store the Google account’s address as part of the link and show it to you in your account. You can unlink it there at any time.
Legal basis: Art. 6(1)(b) GDPR. Use is voluntary; sign-in with email and password is always available.
6. Use of the platform
In the platform, we process the content that you and your partners create: profiles, events, timeslots, bookings with their offer history, contracts, invoices, expenses, availability, messages, posts in the Backstage feed, notifications and uploaded files. Files are kept in private storage and are delivered only to authorised persons after sign-in. Exceptions are the profile picture, media and images in posts of a public profile: they can be accessed without sign-in as long as the profile is public.
- Public profiles: You decide in the settings whether your profile and your availability are publicly visible. The server does not deliver hidden availability.
- Collaboration: Partners you invite to an event see its data. Guest access via link and password is valid for 14 days, can be revoked at any time and shows no financial data.
- Reports and moderation: If you report a profile or content, we store the report with its category and optional free text in order to review it.
- Admin actions: If our team bans an account or lifts a ban, sends a password reset link, grants or revokes an area, sets a plan or hides content, we log who did this, when, and to which account or profile. This makes interventions by the administration traceable and protects against their misuse.
- Logs: Operating the platform generates application logs with the time, the interface accessed, the IP address and error information. They serve troubleshooting and protection against misuse.
- Error alerts: If an error occurs during operation, we receive an email with the time, the type of error and a shortened error message. It contains no content of your requests, but may contain an internal identifier, for example that of a profile. It is sent via Resend to our mailbox at Mailbux, and we delete it after 30 days.
- Signature: For contracts, you can store an image of your signature. We store it with your name and insert it, together with your name and the time, into contracts that you sign. This is a simple electronic signature.
- Artist directory and roster: For artists, details that can be entered include the fee, the agency contact and, voluntarily, gender (male, female, diverse or not specified). Gender does not appear on public profile pages; signed-in users who search in the artist search receive it as well.
- Booking requests via public profiles: From an Event area, you can send a booking request via an artist’s public profile page. It goes, with your details about the event, your name, your telephone number, your message, your account’s email address and your company, to the artist or to their agency. To prevent misuse, we store a hash of your IP address and delete it after 24 hours.
- Word templates: If you store your own Word template, we convert the invoice or contract into a PDF with LibreOffice in a container at Cloudflare. The completed document is held there only during the conversion and is deleted afterwards.
- Images from external servers: Images embedded via an external address, for example in a profile or post, are loaded by your browser directly from there. In the process, the operator of that server learns your IP address and your browser’s identifier. We have no influence over this.
- Fonts: The website and the platform load their fonts locally from our own servers. No connection to Google Fonts is made.
Legal basis: Art. 6(1)(b) GDPR for the contractual functions, Art. 6(1)(f) GDPR for logs, error alerts, moderation and protection against misuse of booking requests. Our legitimate interest is a secure and error-free platform.
7. Subscriptions and payment
If you book a paid plan, we process the payment via Stripe. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; a transfer to Stripe, Inc. in the USA is possible (see section 13).
For this purpose, Stripe processes your name, your email address, your billing address, where applicable your VAT identification number (Umsatzsteuer-Identifikationsnummer, USt-IdNr.), the details of the chosen payment method and the transaction data. We do not receive full card or account details; we see the plan, the amount, the payment status and the invoices.
For fraud prevention and to fulfil its own legal obligations, for example to prevent money laundering, Stripe acts as an independent controller. Details are set out in Stripe’s privacy policy.
Legal basis: Art. 6(1)(b) GDPR for the payment, Art. 6(1)(c) GDPR for the retention of invoices and accounting records.
8. Third-party data in your workspace
If you process personal data of other people in BSTAGE – for example guest lists, staff and shifts, contact persons or drivers – you are the controller for this data. We process it on your behalf under Art. 28 GDPR. The basis is our data processing agreement (Vertrag zur Auftragsverarbeitung, AVV), which is concluded together with the Terms and Conditions.
Verification of VAT ID numbers for invoices
If you create an invoice in BSTAGE to another EU country without VAT (reverse charge), we verify your customer’s VAT identification number with the European Commission in the VAT Information Exchange System (VIES). For this purpose, we transmit their VAT ID number and your own VAT ID number. If the number is invalid, the invoice is not created. We store the result – valid or not verifiable, the time, the consultation number and the name under which the number is registered – with the invoice as proof; it is retained and deleted together with the invoice.
Legal basis: Art. 6(1)(b) GDPR for your own VAT ID number. For your customer’s details, we act on your behalf (Art. 28 GDPR); the verification serves as your proof that the invoice was permitted to be issued without VAT (Art. 6(1)(c) GDPR).
9. Emails
We send emails that are triggered by an action: confirmation of your email address, password reset, confirmation of a change of email address or of account deletion, invitations, messages about your beta application and your beta benefits, and notifications about requests, contracts and invoices. We do not send newsletters or advertising emails.
For sending, we use Resend, a service of Plus Five Five, Inc., San Francisco, USA. The recipient address, the subject and the content of the message are transmitted.
Legal basis: Art. 6(1)(b) GDPR.
10. Google Calendar
You can voluntarily connect an event’s posting plan to your Google Calendar. For this, we receive access to your calendar events (permission calendar.events) and your email address, and we create entries with title, date and time. We store the access token until you disconnect.
Legal basis: Art. 6(1)(a) GDPR. You can revoke the connection at any time in the settings or in your Google account.
11. Bug reports
If you report a bug from within the application, we store the title and description, the page accessed, your browser’s identifier, the window size, your profile and – if you attach one – a screenshot. If errors previously occurred in the browser, we attach their console messages; these may contain fragments of page content.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is an error-free platform.
Retention period: There is no statutory period for this. We delete bug reports, including any screenshot, and reports of content six months after we have finished dealing with them. This allows us to recognise whether a fixed bug reappears and to answer questions about a decision.
12. Cookies and local storage
This website sets no cookies. The platform stores only what is strictly necessary for the service you have requested. Under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), no consent is required for this.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Session cookie | Cookie | Keeps you signed in and protects the session | 30 days, deleted when you sign out |
sidebar_state | Cookie | Remembers whether the sidebar is expanded or collapsed | 7 days |
bstage_locale | Cookie | Remembers the language chosen for the website and the platform | 1 year |
theme | Local storage | Remembers the chosen colour scheme | until you delete it in your browser |
sidebar-width | Local storage | Remembers the width of the sidebar | until you delete it in your browser |
13. Recipients and transfers to third countries
We use the following service providers as processors under Art. 28 GDPR. Where data is transferred to the USA, we rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 for certified companies and, in addition, on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
| Service provider | Purpose | Registered office |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, logs, protection against attacks | USA; database in the EU, files in Western Europe |
| Plus Five Five, Inc. (Resend) | Sending transactional emails, delivery of contact enquiries | USA |
| CloudWish LLC (Mailbux) | Email mailboxes for enquiries to contact@bstage.studio and for error alerts | USA (Houston, Texas); servers, according to the provider, in Finland and Germany |
| Google Ireland Limited / Google LLC | Sign-in with Google, Google Calendar (optional) | Ireland / USA |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment processing for paid plans (see section 7) | Ireland / USA |
In addition, when an invoice with reverse charge is created, we transmit VAT ID numbers to the European Commission (VIES, Brussels) – see section 8. It is not a processor; it carries out the verification as a public body.
Within the platform, other users see data only to the extent that you share it or collaborate with them. Authorities receive data only where there is a legal obligation.
14. Retention period
We store personal data for as long as is necessary for the respective purpose and delete it afterwards. Where statutory retention obligations exist, we restrict the data from any other use until the period expires and then delete it. Retention periods under commercial and tax law begin at the end of the calendar year in which the document was created.
| Data | Retention period | Legal basis |
|---|---|---|
| Server and application logs | no more than 7 days | Art. 6(1)(f) GDPR |
| Session with IP address and browser identifier | until you sign out, no more than 30 days after last use | Art. 6(1)(b), (f) GDPR |
| Account and profile data | until the account is deleted | Art. 6(1)(b) GDPR |
| Accounts whose email address was never confirmed | 30 days after registration, including the area created at that time | Art. 6(1)(b), (f) GDPR |
| Beta application | waiting list and pending applications: until activation at the official launch; accepted: until the account is deleted | Art. 6(1)(b) GDPR |
| Content in workspaces (events, bookings, contracts, invoices, messages, files) | until you delete it. When you delete your account, it remains stored because business partners continue to work with it; after the end of the contract, we delete it within 30 days upon request to contact@bstage.studio, insofar as it is not also assigned to others. We delete messages in chats and booking histories three years after the last message in the respective thread | Art. 6(1)(b), (f) GDPR |
| Database backups | no more than 30 days | Art. 6(1)(f) GDPR, Art. 32 GDPR |
| Backup copies of uploaded files | as long as the file exists, no more than 30 days after it is deleted | Art. 6(1)(f) GDPR, Art. 32 GDPR |
| Error alert emails | 30 days | Art. 6(1)(f) GDPR |
| Log of admin actions | 365 days | Art. 6(1)(f) GDPR |
| Hash of the IP address for booking requests | 24 hours | Art. 6(1)(f) GDPR |
| Notifications in the platform | read notifications 90 days after reading, unread notifications 12 months after they are created; immediately if your profile is deleted together with your account | Art. 6(1)(b) GDPR |
| Guest access | 14 days, earlier if revoked | Art. 6(1)(b) GDPR |
| Connection to Google Calendar | until disconnected | Art. 6(1)(a) GDPR |
| Contact enquiries via form or email | 6 months after the last message; if the enquiry leads to a contract, 6 years as a business letter | Art. 6(1)(b), (f) GDPR; § 257 HGB, § 147 AO |
| Bug reports and reports of content | 6 months after they have been dealt with | Art. 6(1)(f) GDPR |
| Our invoices and accounting records for your subscription | 8 years | § 147 AO, § 257 HGB |
| Commercial and business letters, e.g. conclusion of the contract and cancellation of your subscription | 6 years | § 147 AO, § 257 HGB |
Invoices and contracts that you yourself create in BSTAGE for your business partners are your records. You are responsible for retaining them – export them before you delete them or your account.
15. Your rights
You have the following rights vis-à-vis us:
- access to the data stored about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR) – you can also delete your account yourself in the settings,
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdrawal of consent with effect for the future (Art. 7(3) GDPR).
Right to object under Art. 21 GDPR: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
To do so, contact contact@bstage.studio. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.
Providing your data is required for registration and use of the platform; without it, we cannot conclude a contract. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
16. Security
All connections are encrypted with TLS. We store passwords only as a hash, access tokens in encrypted form and files in private storage. The data of each workspace is kept separate from the others; the server checks permissions on every request. Two-factor authentication is available to all accounts. We back up the database and the uploaded files every night. We delete database backups after 30 days at the latest, and the backup copy of a file no later than 30 days after the file was deleted.
17. Changes
We adapt this privacy policy when the platform or the legal situation changes. The version published here at the relevant time applies.