Privacy Policy

GigArmy, the operator of gigarmy.co.uk based in the United Kingdom, is the data controller. For any privacy question or to use your rights, email hello@gigarmy.co.uk or use our contact form. We have not appointed a Data Protection Officer. If GigArmy is operated through a registered company, its name, number and registered office will be shown here.

• Account details — email address, password (stored securely hashed by our authentication provider), the role you choose (performer, venue or event organiser), and records of your acceptance of our terms.
• Performer profiles — stage or act name, act types, genres, base area (a town, not an address), travel distance, starting fee, bio, profile picture, performance videos and availability calendar.
• Venue and organiser profiles — venue name, type, area, the venue's public address, capacity, description, logo/profile picture, photo and video gallery, additional locations, and team members you invite (their email address and role).
• Events (Build My Event) — event name, occasion, date, area, guest numbers, budget lines, shortlists, notes and quote requests.
• Marketplace activity — gigs posted, applications, invitations, bookings (fee and agreed payment method label — never bank or card details), confirmations, cancellations and reasons, SOS requests and responses, What's On listing choices, favourites and reviews.
• Messages — GigChat conversations between users.
• Pre-booking contact protection records — when GigArmy stops a pre-booking message or field because it appears to contain contact details, we record your account identifier, your role, where it happened (for example GigChat or a quote reply), a link to that conversation or request, the type of detail detected (phone, email, link or social/messaging) and the time. The blocked text itself is not saved in this record.
• Safety records — reports you make or that are made about you, moderation decisions, warnings and suspensions.
• Notifications — in-app notifications, your notification preferences, email delivery records and opt-outs, and (in the phone app, if you allow it) a push notification device token.
• Founding 200, referrals and promotions — position, referral codes used, entitlement dates and promo code redemptions.
• Contact and mailing list — name, email, role, subject and message you send us (with a one-way hashed network address to prevent abuse); early-access/mailing list sign-ups (name, email, area, short description).
• Basic visit counts — daily aggregate totals of visits and pageviews only; nothing about you is stored. Used solely to improve the site under our legitimate interests; you can turn it off at any time. See the Cookie Policy.
• Detailed website analytics (only with your consent) — page visited, referring website, device type (mobile/tablet/desktop), country and two random identifiers created in your browser. No name, email, account or IP address is linked. See the Cookie Policy.
• Technical and security logs — limited request and error information kept by our hosting and database providers.

Under UK GDPR Article 6 we rely on:

• Contract (Art. 6(1)(b)) — to create and run your account, show your profile, match gigs by area, act type and availability, handle applications, bookings, SOS cover, GigChat, calendars, Build My Event, reviews, posters and service notifications.
• Legitimate interests (Art. 6(1)(f)) — keeping GigArmy secure, preventing fraud and abuse, moderating content and handling reports, fair Spotlight rotation, improving the service, reminding people who started signing up to finish their profile, sending SOS alert emails to matched performers who have SOS alerts switched on, and pre-booking contact protection (described below). You can object at any time (see section 9).
• Legal obligation (Art. 6(1)(c)) — keeping records we are required to keep, responding to lawful requests and to your data protection requests.
• Consent (Art. 6(1)(a)) — optional website analytics storage, the early-access mailing list, and phone push notifications. You can withdraw consent at any time without affecting anything done before.

Pre-booking contact protection. Before a booking is confirmed, GigArmy automatically checks the text you submit in pre-booking messages and fields (GigChat before a confirmed booking, Get Quotes requests and quote replies, gig applications and invitations, Build My Event quote requests and replies, and changes to performer bios, venue descriptions, photo captions, video titles and display names) for phone numbers, email addresses, web links and social or messaging handles, and stops those being sent. The check happens at the moment you send; we do not scan past messages. Our purpose is to operate and protect the marketplace and enforce our pre-booking platform rules (see the Terms). We rely on our legitimate interests in running a fair, trusted marketplace where introductions made on GigArmy are arranged through GigArmy, members are protected from unsolicited contact before a booking is agreed, and misuse can be spotted. We think this is proportionate because it applies only before confirmation, contact details can be shared freely once a booking is confirmed, and only the type of detail is recorded, never the blocked text. Only the GigArmy founder/admin team can see these records, as counts by type and a list of members with repeated attempts. You can object to this processing (see section 9).

Agreeing to our Terms is not the same as consenting to data processing: we do not rely on consent for running the service you signed up for.

Published profiles (name, act or venue type, general area, travel distance, fee guide, description, pictures, reviews) can be seen by other users and, for public pages, by visitors and search engines. Some details, like galleries, are only shown to signed-in members. Email addresses and phone numbers are never published.

Public features show a general area only. A venue's full address is shared with the other party to a confirmed booking where needed for the gig. A booking only appears on What's On if one of the parties chooses to list it. Share Gig posters contain only public booking information, and you decide whether to share them.

We use trusted service providers (processors) who act only on our instructions:

• application hosting and content delivery;
• managed database, authentication and file storage (Lovable Cloud, built on Supabase);
• transactional email delivery (Resend);
• web font delivery (Google Fonts) — your browser requests fonts from Google, which receives your IP address;
• phone push notification delivery (Google Firebase Cloud Messaging) — only if you use the phone app and allow notifications.

We also share data with other users as the service requires (for example, the other party to a booking), with professional advisers, and with police, regulators or courts where the law requires. If paid plans are switched on, a regulated payment provider will process card details — this notice will be updated first. We never sell or rent personal data or share it for advertising.

Some providers may process data outside the UK, including in the European Economic Area and the United States. Where that happens we rely on UK adequacy regulations (including the UK–US data bridge for certified companies) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. Ask us for more detail.

• Account and profile data: while your account is open. When you delete your account, your profile is removed or irreversibly anonymised.
• Bookings, reviews and messages connected to real engagements: they are anonymised rather than erased so the other party keeps their records, and may be kept for up to six years for disputes, legal or tax reasons.
• Terms acceptance records: for as long as your account exists and up to six years afterwards, as evidence.
• Safety and moderation records, including pre-booking contact protection records: as long as needed to keep the platform safe, and reviewed regularly. These records never contain the blocked text.
• Contact messages and mailing list sign-ups: until dealt with or until you ask us to remove them.
• Analytics records: kept for aggregate trend reporting and reviewed regularly; they contain no direct identifiers.

We use encrypted connections, hashed passwords, per-user access rules in our database, private storage with short-lived links for galleries and videos, and restricted founder tools that never display members' contact details. No system is perfectly secure; if a breach affecting your data happens, we will act and notify you and the ICO where the law requires.

You have the right to:

• access a copy of your data;
• correct inaccurate data;
• erase your data (you can delete your account in settings);
• restrict processing;
• data portability;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent where we rely on it (for example, change your cookie settings or unsubscribe from emails).

Email hello@gigarmy.co.uk. We normally reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113, though we would appreciate the chance to help first.

GigArmy automatically matches and orders performers and gigs using act type, area, travel distance, availability and fair rotation (for example in SOS alerts and Spotlight). It also automatically stops contact details being sent before a booking is confirmed (see section 3). These help you find each other and keep pre-booking contact on GigArmy, but do not produce decisions with legal or similarly significant effects: a blocked attempt never suspends or bans an account by itself, and repeated attempts are only shown to a person for review. Suspensions and other moderation decisions are made by a person, not automatically.

We send service messages about your account, bookings, SOS alerts and messages; you can adjust most of these in your notification settings, and every non-essential email has an unsubscribe link. We only send marketing emails to people who have opted in (for example by joining the mailing list), and you can opt out at any time.

GigArmy accounts are for people aged 18 and over. We do not knowingly collect data from children; if you think we have, please contact us and we will delete it.

We will update this notice when our processing changes and show the new effective date. Material changes will be notified in the app or by email.