Downbeat — Privacy Policy

Effective Date: April 29, 2026

Last Updated: April 29, 2026

1. Introduction

This Privacy Policy describes how Downbeat LLC ("Downbeat," "we," "us," or "our"), a Texas limited liability company located in Boerne, Texas, collects, uses, stores, and protects your personal information when you use the Downbeat tour management application ("Service").

We are committed to protecting your privacy. We do not sell your personal information. We do not use your data for advertising. We collect and process data only as necessary to provide and improve the Service.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

2a. Information You Provide Directly

When you create an account and use the Service, you may provide:

Account Information:

Name
Email address
Password (stored as a cryptographic hash; we never store or have access to your plaintext password)

Profile Information:

Phone number
Dietary restrictions and allergies (see "Sensitive / Special-Category Data" below)
Emergency contact (name, phone number, relationship) (see "Information About Other People" below)
Shirt size
Tour status (Active, Occasional, Inactive)

Sensitive / Special-Category Data:

Some profile fields you provide — particularly dietary restrictions, food allergies, and emergency-contact relationships — may reveal information about your health, religious practice, or personal relationships. Under GDPR Article 9 and CCPA's "sensitive personal information" category, this is treated with heightened protection. We collect it only because tour managers need it to make safe meal arrangements and reach the right person in an emergency. By entering this information, you consent to its use for those purposes and to its visibility to the team members on your artist roster. You may leave these fields blank, edit them, or clear them at any time in your profile settings.

Information About Other People (Indirect Collection):

The Service is designed for tour managers and crew leads who enter information about other people in the course of their work — for example: emergency contacts (relatives or friends of the user), venue and production staff, lodging hosts, drivers, flight passengers, and crew members invited via email. When you enter information about another person, you represent that you have the authority to do so and that you have informed them, where appropriate, that the information is being entered into a tour-management system. If you are an individual whose information has been entered into the Service by someone else and you have not signed up, you may contact us at curt@crew.downbeat.pro to request access, correction, or deletion of information about you.

Tour and Schedule Data:

Tour dates, venues, cities, and event schedules
Advancing information (venue contacts, production details, hospitality notes, parking, WiFi, lodging details)
Lodging information (hotel names, addresses, confirmation numbers, check-in/checkout times)
Flight information (flight numbers, passenger names, departure/arrival airports and times)
Drive event details (source/destination addresses, departure times)
Setlists and guest lists
Meal orders and menu attachments
Venue notes and debrief information
File attachments (stage plots, input lists, riders, menus, contracts)

Communications:

Emails you forward to the Service for processing (advance emails, flight confirmations, lodging confirmations, routing sheets)
Feedback and bug reports you submit
Urgent alerts and notifications you send through the Service

Payment and Subscription Information:

Subscription plan selection (e.g., Van, Bus, Multi-Bus) and billing interval (monthly or annual)
Subscription status, subscription identifiers, and Stripe customer identifiers stored in our database to manage your account
All payment processing is handled by Stripe, a PCI-compliant third-party payment processor. Payment method details (such as credit card numbers) are entered directly in Stripe's hosted checkout form and are never transmitted to, processed by, or stored on our servers.

Microphone (Voice Input):

The Service may access your device microphone, with your permission, to capture voice messages you send to Roadie, the in-app AI assistant. Audio is transmitted to OpenAI's Whisper API for transcription into text, and the resulting text is then processed by Anthropic's Claude API to generate Roadie's response. Raw audio is not stored on our servers after transcription is complete; only the transcribed text is retained as part of your Roadie conversation history. You may decline microphone permission and type messages to Roadie manually instead.

Camera (Photo Capture):

The Service may access your device camera, with your permission, when you choose to take a photo for upload to the Service. Photos are used for: (i) attaching documents (settlement checks, rooming lists, parking signs, venue documents) to Roadie or your tour records, and (ii) extracting structured data from photographed documents using AI. Photos you submit to Roadie or to AI extraction features are transmitted to Anthropic's Claude API for processing. Photos that you upload as document attachments are stored in our document storage. You may decline camera permission and use your device's photo library instead, or upload files via the web interface.

2b. Information Collected Automatically

When you use the Service, we automatically collect:

Authentication data: Login timestamps, session tokens, IP addresses, and device information necessary for account security and fraud prevention
Push notification tokens: Device tokens required to deliver push notifications, stored only while you have notifications enabled
Analytics data: Vercel Analytics and Vercel Speed Insights collect page-view counts, route information, performance metrics (Core Web Vitals), referrer URLs, IP address, user-agent string, and approximate geographic region. These services do not set tracking cookies and do not build a cross-site profile of you. They do, however, process IP and user-agent data to compute anonymized aggregates — under GDPR/ePrivacy this is processing of personal data with legitimate-interest basis. You may block this data collection by using a tracker-blocking browser extension; we do not currently offer an in-app opt-out toggle.

2c. Information from Third-Party Services

When you use certain features, we receive information from third-party services:

Google Maps Platform: Drive time estimates, venue location data, and place details (addresses, phone numbers, coordinates) based on addresses and locations you provide
AeroDataBox: Flight status information (departure/arrival times, delays, gate numbers, cancellations) based on flight numbers you enter
BandsInTown: Publicly available event listing data (dates, venues, times) for artists you connect through the Service

3. How We Use Your Information

We use your information for the following purposes:

(a) To provide the Service: Storing and displaying your tour schedules, advancing information, and logistics data. Sending notifications about schedule changes, flight updates, meal ordering deadlines, and other tour-related events. Processing forwarded emails and documents to extract and structure tour information. Calculating drive time estimates and tracking flight statuses.

(b) To maintain and secure the Service: Authenticating your identity. Detecting and preventing unauthorized access. Resolving technical issues and bugs.

(c) To improve the Service: Using anonymized, aggregated, and de-identified usage data (such as feature adoption patterns and general usage statistics) to improve functionality and user experience. This data does not identify you or any individual and does not include the content of your tour schedules, communications, or personal details.

(d) To communicate with you: Sending Service-related communications (account verification, password resets, security alerts). Sending notifications you have opted into (schedule changes, flight updates, meal reminders). Responding to your feedback and support requests.

4. Artificial Intelligence Processing

Certain features of the Service use artificial intelligence provided by Anthropic (Claude API) to process data you submit. Specifically:

What is processed by AI:

Emails you forward to the Service (advance emails, flight confirmations, lodging confirmations, routing sheets)
Text you paste into the Service for parsing (routing sheets, flight details)
Quick notes you enter for classification and extraction

How AI processing works:

Your submitted content is sent to Anthropic's Claude API for analysis and data extraction.
The AI identifies and extracts structured information (dates, times, venues, contacts, production details, flight information, lodging details) from unstructured text.
Extracted data is stored within the Service and associated with your tour dates.

Roadie AI Assistant:

The Service includes Roadie, a conversational AI assistant powered by Anthropic's Claude API. You may interact with Roadie via text messages and photo uploads (e.g., photos of rooming lists, parking signs, or venue information).
Text messages and photos you send to Roadie are transmitted to Anthropic's Claude API for processing. Photos are used solely to extract relevant information and are not retained by Anthropic beyond the duration of the API request.
Conversation history — including your messages, Roadie's responses, and actions taken on your behalf — is logged in our database for debugging, audit, and service improvement purposes.
Roadie only processes content you actively send. The assistant does not passively monitor your data or initiate processing without your interaction.

What Anthropic does with this data:

Anthropic's API terms state that data submitted through their API is not used to train their AI models.
Anthropic may retain API inputs and outputs for up to 30 days for trust-and-safety review (e.g., to detect abuse, malware, or policy violations). Inputs flagged for trust-and-safety review may be retained longer if needed for investigation. Anthropic does not use this data for advertising or model training.
For the most current information on Anthropic's data practices, see Anthropic's Privacy Policy at https://www.anthropic.com/privacy.

What OpenAI does with voice recordings:

We use OpenAI's Whisper API to transcribe voice messages you send to Roadie. Per OpenAI's API data policy, audio submitted through the API is not used to train OpenAI's models and is retained for up to 30 days for abuse-monitoring purposes before deletion.
See OpenAI's API data usage policy at https://openai.com/policies/api-data-usage-policies for current terms.

Your control:

AI processing only occurs when you actively submit content (forwarding an email, pasting text, entering quick notes). The Service does not passively monitor or process your data with AI.
You may choose not to use AI-powered features and instead enter all information manually.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share your information only in the following circumstances:

5a. With Your Team Members

Tour information you create is shared with team members you invite to your artist roster, in accordance with the role-based access controls you configure:

Owners and Managers can view and edit all tour data for their artists.
Members can view tour data but have limited editing capabilities.
Tour status settings (Active, Occasional, Inactive) determine which dates and notifications each team member receives.

You control who has access to your tour data by managing your artist roster.

5b. With Third-Party Service Providers

We use the following third-party services to operate the Service. Each receives only the minimum data necessary for their function:

Provider	Purpose	Data Shared
Supabase (USA)	Database hosting, authentication, file storage	All User Data (encrypted at rest and in transit)
Vercel (USA)	Application hosting, analytics, speed insights, edge compute	Application requests and responses, IP, user-agent, performance metrics
Resend (USA)	Outbound and inbound email delivery	Email addresses, message bodies, forwarded email content
Anthropic (Claude API) (USA)	AI processing of emails, text, photos, and Roadie conversations	Content of forwarded emails, pasted text, quick notes, photos you submit, and Roadie chat messages
OpenAI (Whisper API) (USA)	Voice-to-text transcription for Roadie voice input	Audio recordings of voice messages you send to Roadie
Google Maps Platform (USA)	Drive time estimates, venue location lookup, Place details	Addresses and location names you provide
AeroDataBox (EU)	Flight status tracking	Flight numbers and dates
Stripe (USA)	Payment processing	Email address, name, subscription plan selection; payment method details are entered directly in Stripe's hosted form and never pass through our servers
Firebase Cloud Messaging (Google) (USA)	Push notification delivery (Android)	Device push tokens
Apple Push Notification Service (APNs) (USA)	Push notification delivery (iOS / Web Push on Safari)	Device push tokens
Mozilla autopush / Microsoft WNS	Push notification delivery (Web Push on Firefox/Edge)	Browser-generated push subscriptions
Sign in with Apple (USA)	Optional account creation and sign-in	Apple-issued identity token; email if you choose to share it
Sign in with Google (USA)	Optional account creation and sign-in	Google-issued identity token; email; profile name
BandsInTown (USA)	Event listing sync	Artist IDs (public data; no personal information sent)
Open-Meteo / weather provider	Weather forecasts and severe-weather alerts	Latitude/longitude of your tour dates

We may update this list from time to time. The current list is also published at downbeat.pro/sub-processors.

We do not commit to advance notice when we add or change sub-processors. If you are a B2B customer subject to GDPR Article 28 sub-processor flow-down requirements and need a different commitment, contact us at curt@crew.downbeat.pro before subscribing.

5c. As Required by Law

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

5d. In Connection with a Business Transfer

If Downbeat is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any changes to this Privacy Policy.

6. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including:

Encryption in transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
Encryption at rest: Your data is encrypted at rest in our database (provided by Supabase).
Authentication: User authentication is handled by Supabase Auth with secure password hashing, session management, and token refresh.
Row-Level Security: Database access is enforced through row-level security policies that restrict data access based on user identity and role.
Access control: Role-based permissions ensure that users can only access data appropriate to their role within an artist's roster.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of a security vulnerability or suspect unauthorized access to your account, please contact us immediately at curt@crew.downbeat.pro.

Breach notification. If we determine that an unauthorized acquisition of your unencrypted personal information has occurred, we will notify you and the appropriate regulatory authorities without undue delay, in accordance with applicable law (including GDPR Article 33/34, the Texas Identity Theft Enforcement and Protection Act, and other state breach-notification statutes).

7. Data Retention

Active accounts: We retain your data for as long as your account is active and as needed to provide the Service.
Deleted accounts: When you delete your account, we will delete your personal data within 30 days, except where retention is required by law or necessary for legitimate business purposes (such as resolving disputes or enforcing our Terms).
Forwarded emails: Email content processed by AI is not stored after extraction. Only the structured data extracted from emails is retained within the Service.
Notifications: Read notifications are automatically purged after 30 days. Date-linked notifications expire at the end of the associated show day.
Backups: Deleted data may persist in encrypted backups for up to 90 days before being permanently removed.

8. Your Rights and Choices

8a. Access and Portability

You have the right to access your personal data. Most of your data is visible directly within the Service (profile, tour dates, schedules, advancing information). You may request a copy of your data by contacting us at curt@crew.downbeat.pro.

8b. Correction

You can update your personal information at any time through the Service (profile settings, tour data editing).

8c. Deletion

You may delete your account at any time through the Service or by contacting us at curt@crew.downbeat.pro. Account deletion will remove your personal data in accordance with Section 7.

8d. Notifications

You can control push notification delivery through your device settings and through notification preferences within the Service. Disabling push notifications will not affect in-app notifications.

8e. AI Processing

You may choose not to use AI-powered features (email forwarding, text parsing, quick notes classification). All tour data can be entered manually.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

9a. Notice at Collection

The following table summarizes the categories of personal information we collect, the sources, the business purposes, the categories of third parties with whom we share, and the retention period for each category.

CCPA Category	Examples	Source	Business Purpose	Shared With	Retention
Identifiers	Name, email, phone, IP address, device identifiers	You; auth providers	Provide and secure the Service	Supabase, Vercel, Resend, push providers	Life of account + 90 days backup
Customer records	Profile, emergency contact, dietary info	You	Provide the Service	Supabase, team members on your roster	Life of account + 90 days backup
Commercial information	Subscription plan, billing history	You; Stripe	Billing, fraud prevention, tax records	Stripe	Life of account + as required by tax/financial law
Internet/network activity	Page views, performance metrics, route info	Automatic	Operate, secure, and improve the Service	Vercel	12 months
Geolocation (approximate)	City/region from IP; venue/tour-date latitude-longitude you enter	Automatic; you	Drive-time estimates, weather alerts, regional analytics	Google Maps, weather provider	Life of associated tour data
Audio/visual	Photos and voice messages you submit	You	AI extraction, document storage, transcription	Anthropic, OpenAI, Supabase	Photos: until you delete; voice transcripts: with chat history; raw audio: not retained on our servers
Professional/employment information	Tour role, crew assignments	You	Provide the Service	Team members on your roster	Life of account
Sensitive personal information	Dietary/allergy info, login credentials	You	Provide the Service; authenticate	Supabase, team members	Life of account
Inferences	None	—	—	—	—

9b. Your CCPA Rights

Right to know: You may request the categories and specific pieces of personal information we have collected about you.
Right to delete: You may request deletion of your personal information, subject to certain exceptions.
Right to correct: You may request correction of inaccurate personal information.
Right to limit use of sensitive personal information: You may request that we limit our use of sensitive personal information to purposes necessary to provide the Service.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
No sale of personal information: We do not sell your personal information as defined by the CCPA/CPRA.
No sharing for cross-context behavioral advertising: We do not share your personal information for cross-context behavioral advertising.

To exercise these rights, contact us at curt@crew.downbeat.pro. We will verify your identity before fulfilling your request.

10. Children's Privacy

The Service is intended for general use by tour professionals of any age. Touring crews and performing companies sometimes include minors (e.g., young performers, dependents traveling with the tour), and minors may also use the Service directly as crew members.

We do not knowingly collect personal information from children under the age of 13 in the United States (in compliance with the Children's Online Privacy Protection Act, "COPPA"), and we do not knowingly process the personal data of children under the age of 16 in the European Economic Area or United Kingdom without verifiable parental consent.

If you are a parent or legal guardian and you believe a child's personal information has been provided to the Service — whether by the child directly or by a third party such as a tour manager or family member — you may request deletion at any time by emailing curt@crew.downbeat.pro from a verifiable email address. We will verify your identity and your relationship to the child, then delete the child's personal information from the Service within 30 days. We will also notify any tour manager or account holder under whose account the data was entered, so that they do not re-enter it.

If you are a tour manager or account holder entering information about a minor: you represent that you have the legal authority to do so (e.g., parental consent, guardian status, or employer-of-record relationship), and you agree to delete that information promptly upon request from the minor's parent or legal guardian.

11. International Users — GDPR / UK GDPR

The Service is hosted in the United States. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States and other jurisdictions where our sub-processors operate (see Section 5b). By using the Service, you consent to these transfers.

11a. Lawful Basis for Processing (GDPR Article 6)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our lawful bases for processing your personal data are:

Performance of a contract (Art. 6(1)(b)): Most processing — account creation, tour-data storage, billing, notifications you opted in to, AI features you actively invoke — is necessary to provide the Service you requested.
Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, performance analytics, abuse detection, and product improvement, balanced against your privacy interests.
Consent (Art. 6(1)(a)): Push notifications, microphone/camera access, optional marketing emails, and any future cookie or tracking technologies that require it. You may withdraw consent at any time.
Legal obligation (Art. 6(1)(c)): Tax, accounting, fraud-investigation, and breach-notification obligations.
Explicit consent for sensitive data (Art. 9(2)(a)): Dietary, allergy, and emergency-contact information you choose to enter.

11b. International Data Transfers

Personal data of EEA/UK users is transferred to the United States. We rely on the EU Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum with sub-processors that have not self-certified to the EU-US Data Privacy Framework. Where a sub-processor has self-certified to the DPF, we rely on the DPF as the adequacy mechanism.

You may request a copy of the relevant transfer mechanism by emailing curt@crew.downbeat.pro.

11c. Your GDPR Rights

If you are an EEA, UK, or Swiss data subject, you have the following rights under GDPR / UK GDPR:

Right of access (Art. 15) — request a copy of your personal data
Right to rectification (Art. 16) — correct inaccurate data
Right to erasure / "right to be forgotten" (Art. 17) — request deletion
Right to restriction (Art. 18) — restrict processing
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
Right to object (Art. 21) — object to processing based on legitimate interests
Right to withdraw consent (Art. 7(3)) — at any time, where processing is based on consent
Right not to be subject to automated decision-making (Art. 22) — we do not currently make legal or similarly significant decisions about you using automated processing alone

To exercise any of these rights, email curt@crew.downbeat.pro. We will respond within one month.

11d. Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority. A list of EU/EEA authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. UK residents may complain to the Information Commissioner's Office at https://ico.org.uk.

11e. EU/UK Representative

We have not appointed an Article 27 representative. If you are an EEA or UK data subject and prefer to direct inquiries to a representative, please contact us at curt@crew.downbeat.pro and we will work with you to address your concerns.

12. Cookies and Local Storage

See our Cookie and Storage Policy (Section 13) for details on how we use cookies, local storage, and similar technologies.

13. Cookie and Storage Policy

What We Use

Authentication Cookies/Tokens:

We use cookies and/or local storage to maintain your authenticated session. These are essential for the Service to function — without them, you would need to log in on every page visit. These are first-party only (set by downbeat.pro) and are not used for tracking or advertising.

Service Worker and Offline Cache:

If you enable notifications or use the Service offline, a service worker may cache application files and tour data on your device. This cached data is stored locally on your device and is not transmitted to third parties. Cached data is used solely to provide offline access and deliver push notifications.

Push Notification Tokens:

When you enable push notifications, your browser generates a unique token that is stored on our servers to deliver notifications to your device. This token does not contain personal information and is deleted when you disable notifications or delete your account.

What We Do NOT Use

Third-party tracking cookies
Advertising cookies or pixels
Social media tracking pixels
Cross-site tracking of any kind

Vercel Analytics

Vercel Analytics and Vercel Speed Insights do not set tracking cookies. They do, however, process IP addresses, user-agent strings, and referrer URLs to compute aggregated metrics (page views, performance, traffic sources). Vercel anonymizes these aggregates and does not build a cross-site profile of you. Under GDPR/ePrivacy, this is processing of personal data with a legitimate-interest basis. You may block this by using a tracker-blocking browser extension.

Managing Storage

You can clear cookies and local storage through your browser settings. Note that clearing authentication cookies will require you to log in again. Disabling cookies entirely may prevent the Service from functioning correctly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy. The "Last Updated" date at the top of this policy indicates when it was last revised.

15. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your data is handled, please contact us at:

Downbeat LLC

Email: curt@crew.downbeat.pro

Boerne, Texas

This Privacy Policy is effective as of the date stated above and applies to all users of the Downbeat Service.