Privacy Policy

Who controls your data

setlistsite is operated by Homologa Tecnologia LTDA (CNPJ 50.152.480/0001-84), the data controller (“controlador”, LGPD Art. 5, VI) for the personal data described in this policy.

Contact us about anything in this policy, or to exercise the rights below, at privacy@setlistsite.com — this address also serves as our data protection contact point until a dedicated encarregado (DPO) is appointed.

What we collect

• Account data: the email address and password you sign up with (or, with Google sign-in, your Google account’s email and name), handled by Amazon Cognito.
• Site content: whatever a tenant enters to build their site — band/artist name, bio, show dates and venues, photos, video links, news and social links — and any photos uploaded to the media archive.
• Billing data: your subscription plan and payment status. Card and payment details are entered directly into Stripe’s own checkout; we never see or store them, only Stripe’s confirmation that a subscription is active.
• Usage and technical data: IP address, browser type and access timestamps recorded in ordinary server and CDN logs, and a handful of browser localStorage entries (session tokens, your language choice, which site you last worked on) that stay on your own device.
• Analytics and advertising data, only if you allow it (see “Cookies and local storage”): on this site and in the admin app, the pages you visit, how you arrived (for example, which ad or link), your browser and device type, approximate location derived from your IP address, and whether you started a free trial, collected by Google Analytics, Google Ads and the Meta Pixel.
• How you found us: the campaign tags in the link you arrived from (utm_source, utm_campaign and the like), the page you landed on and the website that linked to you, kept in a cookie on your device for 90 days and saved with your site if you create one. Only if you allow advertising cookies, also the ad click identifiers Google and Meta add to their links (gclid, gbraid, wbraid, fbclid) and Meta’s browser identifiers (_fbp, _fbc), saved with your site the same way.

How we use it

• To create and secure your account, and to let you sign in.
• To build, store and publish the website you create with us.
• To process payments and manage your subscription.
• To respond when you contact us, and to send service messages (e.g. billing or security notices).
• During a free trial, to send its owner up to four emails about it (a welcome, a reminder halfway, one two days before it ends and one when it ends), each with a link to stop them. None is sent once the site has a subscription.
• To keep the service secure and diagnose problems.
• Only with your consent, to understand how people find and use setlistsite and to measure which of our ads bring people who sign up. With your advertising consent, when your trial starts, when your site first has a bio, a show and a photo, and when you first subscribe, our server also tells Meta (and, with your analytics consent, Google Analytics, for the subscription), sending your email address only as an irreversible hash, the IP address and browser you signed up (or later gave that consent) from, the identifiers described above and, for a subscription, the plan and its price.
• To comply with legal, tax and accounting obligations.

Legal bases for processing

Under LGPD Art. 7, we process your data to perform the contract you enter into by signing up (account and site data, billing), to comply with legal obligations (tax and accounting records), and, where nothing else applies, based on our legitimate interest in keeping the service secure and working (e.g. access logs) — always weighed against your rights and expectations.

Analytics and advertising cookies, and the events our server sends to Meta and Google, are based on your consent (Art. 7, I), asked for before any of them is set, and you can withdraw it at any time with “Cookie settings” at the bottom of this site or in the admin app’s account menu. The same consent covers the ad click and browser identifiers saved with your sites: withdrawing it while signed in to the admin app removes them from the sites you own and stops those events, and the admin app passes on a choice changed on this site the next time you open it. Which campaign or website brought you, without those identifiers, is based on our legitimate interest in knowing which of our campaigns work (Art. 7, IX): it is not shared with anyone and says nothing about you beyond the link you followed.

Who we share it with

We don’t sell personal data. We share it only with the service providers (“operadores”, LGPD Art. 5, VII) that run setlistsite on our behalf, each processing data only as needed to provide their service to us:

• Amazon Web Services (AWS) — hosting, storage and the Cognito sign-in service.
• Stripe — payment processing and subscription billing.
• Anthropic and OpenAI — only when you use the AI features: what you type into the writing assistant (about your band) is sent to write the draft, and the photos you choose for an AI show image, with your site’s colors and any directions you write for it, are sent to OpenAI to make its background. We send no account or payment details. These providers don’t use what they receive through their APIs to train their models, and keep it only for a limited time under their own policies.

Only if you allow analytics or advertising cookies, the data described above also reaches Google (Google Analytics, Google Ads) and Meta (the Meta Pixel and its Conversions API), which use it under their own privacy policies as well as to provide their services to us. Declining them does not limit anything you can do on setlistsite.

If a tenant’s published site is public, whatever that tenant chose to put on it (bio, shows, photos, social links) is, by design, visible to anyone who visits it — that is the point of the product, and is separate from the account data covered above.

International transfers

AWS, Stripe, the AI providers (when you use the assistant) and, if you allow their cookies, Google and Meta may process data on servers outside Brazil. Where that happens, we rely on the safeguards LGPD Art. 33 allows (such as those providers’ standard contractual clauses and their own compliance programs) to keep your data protected to the same standard.

How long we keep it

We keep your account data for as long as your account exists, and a site’s data for as long as the site exists. A site whose free trial or subscription has ended is not deleted automatically: it stays, unpublished changes and all, until its owner deletes it or asks us to. A site published during its free trial is taken offline when the trial ends without a subscription; its content is kept, and publishing after subscribing puts it back. When you delete a site or your account (see below), its data is removed at once, with these exceptions:

• Billing records (invoices and payments) are kept by Stripe, and by us, for as long as tax and accounting law requires — in Brazil, generally five years.
• Server logs, which can include your IP address and your account or site identifier, are deleted automatically after 30 days.
• How a site’s owner found us, and when it was built and first subscribed, stays with the site; the ad click and browser identifiers, IP address and browser saved with it are removed if the site passes to another owner.
• A file uploaded in the minutes before a site was deleted, or a change that was already being saved, can still arrive just after the deletion; anything that does is deleted automatically within about two hours.
• Our database keeps point-in-time backups for 35 days, so a deleted record can remain in them until they roll off; they are used only to recover from a failure, never to bring deleted data back.
• When you delete your account, its random identifier (not your email) is kept for a few hours, so sign-in sessions opened before the deletion can’t be used in the meantime.
• Copies of a published site held by our content delivery network are dropped as part of the deletion (a deletion only completes once that has been requested), and stop being served everywhere within a few minutes; copies kept by others (search engines, visitors, anyone who downloaded a press kit file) are outside our control.

Deleting your site or your account

You don’t need to ask us: both can be done yourself, at any time, in the admin app. Both are permanent and can’t be undone.

• Deleting a site (its owner, on the site’s Account page) takes the website offline (within a few minutes everywhere, see above) and deletes everything in it right away, for everyone with access: its pages, shows, photos and the whole photo library, press kit files and links (which stop working immediately), who has access and pending invitations, and every stored copy of its files, backups included. Its subscription is cancelled at once, with no refund for the rest of the period, and Stripe deletes the card and contact details it kept for it. Its address becomes free for anyone to use an hour later.
• Deleting your account (Account settings, in the menu with your email) deletes your sign-in and profile. What happens to each site you have access to is shown before you confirm: a site nobody else uses is deleted as described above; a site you own that others still use passes to the member with the highest role (among equals, whoever has had access longest), and its subscription is cancelled so you are never charged again; any other site simply loses you as a member.
• An invitation someone else sent to your email address belongs to their site: it expires after 7 days unless they cancel it sooner.

If you can’t sign in any more, or want something deleted that isn’t covered here, write to privacy@setlistsite.com.

Your rights under the LGPD

Under LGPD Art. 18, you can ask us, free of charge, to:

• Confirm whether we process your data, and give you access to it.
• Correct incomplete, inaccurate or outdated data.
• Anonymize, block or delete unnecessary or excessive data, or data processed without a valid legal basis.
• Give you a portable copy of your data.
• Tell you which public and private entities we’ve shared your data with.
• Let you refuse consent and tell you what happens if you do.
• Revoke a consent you previously gave.
• Review a fully automated decision that affects you, if we ever make one (we don’t today).

Send a request to privacy@setlistsite.com; we’ll respond within the timeframe the LGPD requires. You can also file a complaint with Brazil’s data protection authority, the ANPD (Autoridade Nacional de Proteção de Dados), at gov.br/anpd.

Cookies and local storage

The admin app uses your browser’s localStorage to keep you signed in, remember your language and which site you’re editing, and remember whether you left the live-preview panel open. This data stays on your device and is never read by anyone but the app itself. One essential cookie, setlistsite_consent, remembers the choice below for 180 days, and setlistsite_attribution remembers for 90 days how you found us (see “What we collect”); it holds ad click identifiers only if you allow advertising cookies.

This site and the admin app ask before setting any cookie from Google or Meta, in two categories you can accept or refuse separately:

• Analytics — Google Analytics (cookies named _ga and _ga_*): which pages are visited and how people arrive.
• Advertising — the Meta Pixel (_fbp, _fbc) and Google Ads (_gcl_*): which ads bring people who sign up.

None of them is set until you choose, refusing is as easy as accepting, and “Cookie settings” (at the bottom of this site, and in the admin app’s account menu) changes your choice at any time; withdrawing a consent deletes those cookies. The cookies are set on setlistsite.com, so the browser also sends them to band sites at its addresses, but band sites carry none of these tags and read none of them: a band’s visitors are never tracked by us.

Children’s privacy

setlistsite is intended for bands, artists and their teams, not for children. We don’t knowingly collect personal data from children, and don’t currently verify age at sign-up.

Security

Data is encrypted in transit (HTTPS) and access to it is limited by role and by the isolation between tenants built into the platform. No system is perfectly secure, but we design and review the service with this in mind.

Changes to this policy

We’ll update the date at the top of this page whenever this policy changes, and post the new version here. If a change is significant, we’ll make reasonable efforts to let account holders know directly.