Privacy Policy

Effective Date: January 14, 2026
Last Updated: January 14, 2026

Introduction

VBM Presents LLC ("we," "us," or "our") operates an invite-only artist portfolio and booking management platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services.

We are committed to transparency and user privacy. Unlike many platforms, we do not engage in surveillance capitalism, sell your data, or use tracking technologies for advertising purposes.

Who This Policy Applies To

This policy applies to:

• Artists: Individuals who have been invited to create accounts and profiles on our platform
• Visitors: Members of the public who view artist profiles on our website

Information We Collect

Information You Provide Directly

When you create an account as an invited artist, we collect:

• Email address (required) - Used for account authentication, magic link login, booking confirmations, and essential communications
• Display name (required) - The name or stage name you choose to be identified by; this does not need to be your legal name
• Password - Stored as a cryptographic hash (bcrypt) and never in plaintext
• Profile information (optional) - Biography, social media links, portfolio links, photos, and other promotional content you choose to publish
• Phone number (optional) - Only collected if you opt in to SMS notifications via Twilio

Information Collected Automatically

Authentication Data (Temporary):

• JWT tokens stored in your browser's sessionStorage (not cookies)
• Magic link tokens with 15-minute expiration, deleted after use
• Refresh tokens stored in sessionStorage

Communication Data:

• Messages exchanged through our chat system between artists and booking managers
• Timestamps of messages

Account Activity:

• Last login timestamp
• Account creation date

Server Logs (Security Only):

• Our web server (nginx) logs IP addresses, request paths, and timestamps for security monitoring and abuse prevention
• These logs are automatically rotated daily and permanently deleted after 14 days
• This data is used exclusively for security purposes (preventing attacks, identifying abuse) and is never shared with third parties

Information We Do NOT Collect

We do not collect or track:

• Browsing behavior or page views
• Click tracking or scroll depth
• User analytics or engagement metrics
• Cookies for tracking purposes
• Device fingerprinting
• Session recordings
• Geographic location beyond what is inherent in IP addresses temporarily logged for security

How We Use Your Information

We use your personal information for the following purposes:

1. Account Management - Creating, maintaining, and authenticating your account
2. Service Delivery - Enabling you to manage your profile, calendar, and bookings
3. Communication - Sending booking confirmations, magic links, and service-related notifications
4. Payment Processing - Processing payments for services through Stripe (when implemented)
5. Security - Preventing fraud, abuse, and unauthorized access
6. Legal Compliance - Fulfilling legal obligations and responding to lawful requests

We do not use your information for:

• Advertising or marketing to third parties
• Behavioral profiling or tracking
• Training AI models or machine learning systems
• Selling or renting to data brokers

Third-Party Services

We use the following third-party services that may process your personal information:

Cloudflare

Purpose: Security, DDoS protection, and preventing automated scraping (including AI bots)
Data Processed: IP addresses, connection metadata
Privacy Policy: https://www.cloudflare.com/privacypolicy/

Fastmail

Purpose: Email delivery for magic links, booking confirmations, and essential communications
Data Processed: Email addresses, message content
Privacy Policy: https://www.fastmail.com/about/privacy/

Twilio (Optional)

Purpose: SMS notifications for users who opt in
Data Processed: Phone numbers, message content
Privacy Policy: https://www.twilio.com/legal/privacy
Note: You will only be contacted via SMS if you explicitly opt in to this feature.

Stripe (When Implemented)

Purpose: Payment processing for services
Data Processed: Payment information, billing address, transaction history, IP address (for fraud prevention)
Privacy Policy: https://stripe.com/privacy
Note: We never see or store your complete payment card details. Stripe handles all payment data in compliance with PCI-DSS standards.

Public Information

Artist profiles are publicly accessible on our website. Any information you include in your profile (display name, biography, photos, social links) is visible to anyone who visits your profile page, regardless of whether they have an account.

You have full control over what information appears on your public profile. We recommend only including information you are comfortable sharing publicly for promotional purposes.

Public visitors to artist profiles are not tracked, and we do not collect analytics on profile views.

Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties.

We may disclose your information only in the following circumstances:

1. With Your Consent - When you explicitly authorize us to share information
2. Service Providers - With third-party services listed above that assist in operating our platform
3. Legal Requirements - When required by law, court order, or government regulation
4. Safety and Security - To protect against fraud, abuse, or threats to safety
5. Business Transfers - In the event of a merger, acquisition, or sale of assets (with notification to affected users)

Your Rights

You have the following rights regarding your personal information:

Right to Access

You may request a copy of all personal information we hold about you. We will provide this in a machine-readable format (JSON).

How to Exercise: Use the "Download My Data" feature in your account settings, or contact us at [contact email].

Right to Rectification

You may correct or update inaccurate or incomplete personal information.

How to Exercise: Edit your profile directly through your account settings.

Right to Erasure

You may request deletion of your account and all associated personal information. This is a permanent, irreversible action.

What Gets Deleted:

• User account and login credentials
• Profile information and photos
• Chat history
• Blog posts and content you created
• Calendar bookings and permissions
• All associated data

How to Exercise: Request account deletion through your account settings. You will receive a confirmation form to verify this is intentional. Upon confirmation, we will process your deletion request and notify you when complete. This typically occurs within 7 business days.

Right to Data Portability

You may receive your personal information in a structured, commonly used, machine-readable format.

How to Exercise: Use the "Download My Data" feature, which provides your data in JSON format.

Right to Object

You may object to processing of your personal information for specific purposes.

How to Exercise: Contact us at [contact email] with details of your objection.

Right to Withdraw Consent

Where processing is based on consent (e.g., SMS notifications), you may withdraw consent at any time.

How to Exercise: Opt out through your account settings or contact us.

Data Retention

We retain your personal information as follows:

• Account Data: Retained until you request account deletion
• Server Logs: Automatically deleted after 14 days
• Magic Link Tokens: Deleted immediately after use or after 15-minute expiration
• Chat Messages: Retained until account deletion
• Deleted Accounts: Hard deleted immediately upon processing your deletion request; no data is retained

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: Passwords are hashed using bcrypt; communications use HTTPS/TLS encryption
• Access Controls: Administrative access is restricted and monitored
• Authentication: JWT-based authentication with short-lived tokens
• Server Security: Rate limiting, fail2ban protection, custom SSH ports, regular security updates
• No Tracking: Minimal data collection reduces exposure risk

While we take security seriously, no system is completely secure. We cannot guarantee absolute security of your information.

International Data Transfers

Our servers are located in [specify location]. If you access our services from outside this jurisdiction, your information may be transferred to, stored, and processed in this location.

By using our services, you consent to this transfer. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable laws.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a minor, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending email notification to active users
• Displaying a prominent notice on our platform

Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

VBM Presents LLC
Email: [contact email]
[Physical mailing address if required by jurisdiction]

Your Legal Rights Summary

Under GDPR (EU), CCPA (California), and similar privacy laws, you have the right to:

• Know what personal information we collect and how we use it
• Access your personal information
• Correct inaccurate information
• Delete your personal information
• Object to certain processing activities
• Receive your data in a portable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

We respond to all verified requests within 30 days unless a longer period is permitted by law.