Privacy Policy

Who is responsible

SpotMyDJ is operated by the business identified under "Business information" at the bottom of this page. That business decides why and how your personal information is used for the SpotMyDJ service.

What we collect

Depending on how you use SpotMyDJ, we handle:

• Account information: your email address and password (managed by our authentication provider), or the basic profile details Google or Facebook share with us if you choose to sign in with them, plus your display name.
• Customer information: event details you enter (event type, date and time, city and venue, number of guests, budget, equipment notes and other notes), the free-text description you write about your event, your saved event searches and the DJ matches generated for them, enquiries, messages, offers, reviews and cancellation reasons.
• DJ information: your public profile (artist name, biography, location, experience, equipment, genres, pricing, travel preferences, availability, social and video links), photos and other media you upload, offers, messages, replies to reviews, and your payout account status.
• Booking and payment records: bookings, payment status and amounts, refund and dispute status, payout records and review notes, and the Stripe identifiers needed to match these records to Stripe.
• Technical and security information: short-lived request counters used for abuse protection (using hashed identifiers, see below), and ordinary server and hosting logs.

Payments and Stripe

Payments are taken on pages hosted by Stripe. You enter your card or other payment details with Stripe, not on SpotMyDJ. SpotMyDJ does not receive or store your full card number or security code. We store the booking's payment status, amount, refund and dispute status and Stripe reference identifiers.

DJs receive payouts through Stripe Connect. During payout setup, Stripe collects identity, business and bank account information directly from the DJ under Stripe's own terms and privacy policy. SpotMyDJ stores the connected account reference, country and readiness status, not the DJ's bank account details.

AI event analysis

When you describe your event in free text, the description is sent to OpenAI, a third-party AI service, to turn it into structured event details such as date, location and style. This can happen before you log in. Please do not include sensitive personal information in the description.

The AI output is used only to pre-fill and rank suggestions. It does not decide prices, payments, refunds or bookings. How long OpenAI keeps submitted data depends on OpenAI's own terms and account settings. SpotMyDJ does not set any option to limit this and has not verified the exact retention period for the beta.

Why we use your information

• To provide the service: accounts, DJ search and matching, enquiries, messages, offers, bookings, reviews.
• To take payments, issue refunds, handle disputes and pay out DJs.
• To send service emails such as new enquiry, message, offer and booking notifications, and account emails such as password reset.
• To keep the service secure, prevent abuse and limit automated use.
• To provide support and to resolve payment, cancellation and payout problems, including manual review by SpotMyDJ operators.
• To meet legal, accounting and dispute-handling obligations.

Legal bases for processing

Where data protection law such as the GDPR applies, we rely on the following bases. This is our current understanding of the product and should be confirmed by legal review.

Contract / providing the service: accounts, enquiries, offers, bookings, payments, refunds and DJ payouts, and support for those bookings.

Legal obligation: keeping financial, payment and accounting records where the law requires it.

Legitimate interests: keeping the service secure, preventing fraud and abuse, rate-limiting automated use, handling disputes and improving reliability, balanced against your rights.

Consent: where you choose to sign in with Google or Facebook, or where we ask for consent for something specific. We do not currently rely on consent for analytics or advertising because we do not use them.

Free-text event descriptions are processed to provide the matching feature you ask for. Please do not include sensitive personal information (such as health, religion or political views) in them.

Who we share information with

We do not sell personal information. We share it as needed with:

• The other party to a booking: DJs you contact receive your display name, the event details and messages you send. Customers can see DJ public profiles and offers.
• Supabase, which provides our database, authentication and file storage.
• Vercel, which hosts the website and runs scheduled jobs.
• Stripe, for payments, refunds, disputes and DJ payouts (Stripe Connect).
• OpenAI, for event description analysis.
• Resend, which delivers transactional emails. Account emails such as password reset are sent through our authentication provider.
• Google or Facebook, only if you choose to sign in with them.
• YouTube, Vimeo or TikTok, when a DJ profile shows a video link or preview. Your browser may contact these services to load a preview image.
• SpotMyDJ operators and support staff with administrator access, who can view booking, customer and payment information to resolve problems. Their financial actions are recorded in an audit log.
• Authorities, advisers or courts where we are required or permitted to disclose information.

Cookies and browser storage

SpotMyDJ currently uses only cookies and browser storage that are needed to run the service or remember your choices. We do not currently use analytics, advertising or tracking cookies or pixels. Whether any consent or notice requirements apply to the storage and third-party requests described here is a legal question that we have not yet had reviewed. If our use of cookies or similar technologies changes, we will update this page.

• Sign-in session cookies set by our authentication provider (strictly necessary to keep you logged in).
• A language preference cookie (spotmydj-locale), kept for up to one year.
• Session storage in your browser that temporarily keeps an unsaved event description while you log in. It is cleared when you close the tab.
• Stripe may set its own cookies on its hosted checkout and onboarding pages, and Google or Facebook may do so on their sign-in pages. Those are governed by their policies.
• When a DJ profile shows a video, your browser may request a preview image directly from YouTube, Vimeo or TikTok. Those services can then see your IP address and browser details and may set or read their own cookies under their own policies.

Security and rate limiting

To limit abuse of the event analysis feature, we count requests per user or network address. These identifiers are hashed before they reach our database, and old counters are removed after a short period. Access to financial and administrator tools is restricted to authorised accounts, and data transfers use encrypted connections. No system is completely secure.

How long we keep information

We do not currently apply fixed automatic deletion schedules to account, event, message or booking data, and we do not state fixed retention periods. We keep information while your account is active and for as long as needed to provide the service, resolve disputes, and meet legal, tax and accounting obligations. Payment, refund, payout and operator audit records may need to be kept after an account is closed. Temporary abuse-protection counters are removed after a short period.

Deleting your data

There is currently no self-service button to delete your account. DJs can remove their uploaded media in the profile dashboard. To ask for your account or personal information to be deleted, contact us using the details on the Support page. We will review the request and remove or anonymise what we can, but we may keep records that we must or need to retain, for example for payments, refunds, disputes and legal claims.

Your rights

Depending on where you live, you may have the right to access your personal information, correct it, have it deleted, restrict or object to certain processing, receive a copy in a portable format, and withdraw consent where processing relies on it. To use these rights, contact us. Requests are handled manually. You can also complain to the data protection authority in your country.

International processing

Some of the providers listed above may process information outside your country or outside the European Economic Area. Where that happens, transfers depend on the safeguards those providers maintain under their own terms and data processing documentation.

Changes to this policy

We may update this policy as the service changes. The date at the top shows when it was last updated.

Contact

For privacy questions or requests, use the contact details on the Support page and in the business information below.

Business information