Privacy Policy

ENSEVIO · Effective date: 26 October 2026 · Last updated: 26 October 2026

This policy explains the processing of personal data when using ensevio.eu and app.ensevio.eu. ENSEVIO is a collaboration platform for bands, covering concerts, tasks, members, setlists, finances, documents, directories and electronic press kits (EPKs).

Closed beta: ENSEVIO is currently provided free of charge to invited testers. This policy applies during the beta as well.

1. Who is responsible for your data

• Operator and controller of account and service-operation data: Jakub Janků (individual, ENSEVIO project)
• Privacy contact: support@ensevio.eu

The operator determines the purposes and means of processing data necessary for user accounts, service security and operation. Where bands upload information about other individuals, such as venue contacts, musicians or guest performers, they may determine the purposes of that processing themselves. The relevant controller/processor responsibilities, and a data processing agreement where required, must reflect the actual use of the service.

2. Data we process

Accounts and memberships. When signing in with Google, we may receive an account identifier, name, email address and profile picture to the extent provided by Google and needed for authentication. We also process band memberships, assigned roles and permissions.

User-provided content. Concert details, tasks, schedules, setlists, venues, vehicles, contacts, finance entries, reimbursements, documents and EPK materials. Some content may contain personal data relating to third parties entered by users.

Public content. If an authorized member enables publication, selected band profile details, EPKs, public concert information, social links and registered-band directory entries may be accessible without signing in. Private workspace data is not automatically published. Public content may be indexed by search engines.

Technical data. Connection and security information such as IP addresses, request times, error reports and service logs. The website may store language and light/dark theme preferences in the browser; sign-in may use technically necessary tokens or similar technologies.

3. Purposes and legal bases

• Providing accounts and the service: account access, band collaboration, data synchronization and roles, generally based on performance of a contract or pre-contract steps at the user's request (GDPR Article 6(1)(b)).
• Security and abuse prevention: logs, troubleshooting and incident handling, based on our legitimate interest in secure operation (GDPR Article 6(1)(f)) or a legal obligation where applicable.
• Meeting legal obligations and responding to lawful requests: GDPR Article 6(1)(c) when a specific obligation applies.
• Optional publication and integrations: initiated by an authorized band member under the applicable legal basis. Users must have the necessary rights to disclose information relating to others. Where processing requires consent, consent may be withdrawn.

4. Google sign-in and Google Calendar

Google OAuth is used for sign-in. Google Calendar is optional. If you grant the `https://www.googleapis.com/auth/calendar.app.created` scope, ENSEVIO may create a dedicated secondary calendar and create, read, update and delete band-related events in that calendar. Synchronization goes from ENSEVIO to its app-created calendar. This scope does not itself provide access to your primary personal calendar or unrelated existing calendars.

We process connection identifiers, the ID of the app-created calendar, synchronized event details and authorization tokens as needed for this feature. In the current implementation, sensitive refresh tokens are encrypted on the server side and are not sent to the browser. No Calendar synchronization occurs if the optional connection has not been set up.

You can revoke Google's access in your Google Account security settings, or contact the operator to request disconnection and removal of stored authorization credentials. Revocation does not necessarily delete events previously created in your Google Calendar.

We do not sell Google API data, use it for targeted advertising or use it to train artificial intelligence models. Our use of information obtained through Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

5. Sharing and service providers

• Supabase: database, authentication and uploaded-file storage.
• Cloudflare: website hosting, application infrastructure and related network/security services.
• Google: sign-in and optional Google Calendar integration.
• Other infrastructure providers: only if actually enabled and only to the extent necessary under appropriate contractual arrangements.
• Authorized band members and the public: according to workspace permissions and explicit public visibility settings.

We do not sell personal data. Where services involve transfers outside the European Economic Area, the appropriate GDPR transfer mechanism applies, such as an adequacy decision or Standard Contractual Clauses. Actual storage locations and sub-processors depend on provider arrangements and configuration.

6. Retention

Account and band data are retained while the service is actively used and, after that, only as necessary to close accounts, handle valid requests and meet applicable legal duties. Technical logs are retained for security and diagnosis in line with each provider's configuration. Deleted live data may remain temporarily in existing backup copies until those copies are safely retired. For more information about the retention of specific data categories, contact support@ensevio.eu.

7. Security

Private workspace access is subject to authentication and band-member roles. Communication uses HTTPS, and the database employs rules intended to restrict access by band membership. No online service is risk-free, and we take appropriate action when security incidents are identified.

8. Your rights

Depending on the GDPR and the circumstances, you may request access, rectification, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent where applicable. Contact the operator using the address in section 1. We respond within GDPR time limits, normally within one month.

You also have the right to complain to the Czech Office for Personal Data Protection (www.uoou.gov.cz) or another competent data protection authority. Certain information provided and controlled by a band may need to be addressed with that band's responsible contact.

9. Cookies and browser storage

The current public ENSEVIO website uses browser storage for language and theme preferences, not for advertising profiling. Essential authentication technologies may be required to provide secure access to the app. If optional analytics or marketing cookies are introduced, the necessary notices and consent mechanisms will be provided before they are used.

10. Changes to this policy

We will update this policy when our data processing materially changes and provide appropriate notice. The current version is available at https://ensevio.eu/en/privacy/.