Privacy Policy

Effective date: 10/29/2026

This Privacy Policy explains how StageLink ("StageLink", "we", "us") collects, uses, shares and protects personal information when you use the StageLink website at stagelink.dev, the StageLink app, artist pages and the other services we provide (together, the "Service"). StageLink is operated by Queer Music Agency.

1. Who this policy covers

Users: people who create an account, join a workspace, or join our waitlist.
People our users work with: contacts, venues, promoters, crew, fans and others whose information a user adds to StageLink, or who use a user's artist page, contracts, invoices or shared links.

For information a user adds about other people, the user decides what goes into their workspace and why. We process that information on their behalf and under their instructions.

2. Information we collect

Information you give us

Account information: your name, email address, profile picture, and the details your sign-in provider shares with us when you sign in. We don't store a password for accounts that sign in through a provider such as Google.
Workspace content: everything you add to or create in StageLink, such as contacts, companies, venues, shows, bookings, deal terms, advances, contracts, invoices, settlements, expenses, tasks, notes, documents, sheets, files, pictures, links, profile details and artist pages.
Tax and insurance documents: if you add a W-9 or an insurance certificate to your workspace's Paperwork, we store the file, and for a W-9 signed on StageLink the tax ID number, encrypted separately from the rest of your data. The tax ID is shown masked, and revealing it is logged. A document is shared with a venue only when you choose to share it, and every time a shared document is opened, the opening is recorded in your access log.
Payment details for your own invoices: if you add details such as bank or payout information so the people you invoice can pay you, we store them encrypted.
Communications: messages you send us through support, feedback or contact forms, and our replies.
Waitlist and setup details: your name, email address and anything else you choose to tell us when you join the waitlist or set up your account (for example how you heard about us, your genre and where you're based).

Information from services you connect

Signing in with Google gives StageLink only who you are (your name, email address and profile picture). Everything else is optional and you turn it on yourself:

Mail: you connect an email address with an app password you create at your mail provider. StageLink reads that mailbox over IMAP and sends from it over SMTP, so we receive email messages (subjects, bodies, attachments, senders and recipients). We store the app password encrypted and use it only for your mailbox.
Google Calendar: if you choose "Connect Google Calendar", you grant access to calendar events, and we receive the access tokens that let StageLink add and update the events it creates.

The provider's own screen shows what access you are granting, and you can disconnect at any time.

Information collected automatically

Device and session information: for each signed-in device, when it signed in, the browser and device type, and the IP address.
Usage information: first-party records of which features are used and how often (for example that a workspace created an invoice, or which tool the assistant used to answer a question) and what metered features such as AI, maps and storage cost to run. We use this to apply usage limits, keep the Service reliable and improve it. We don't use third-party advertising or tracking tools.
Security information: IP addresses and request details used to protect the Service from abuse, for example rate limiting and blocking automated attacks. Rate-limit counters are deleted after 2 days. The IP address recorded on a sign-in session is kept while the session exists and removed from our records 30 days after the session ends or last changes, unless we need it to investigate an incident. When you choose a password we check it against passwords known from public breaches by sending only the first five characters of a one-way hash of it to a breach-checking service; your password itself, and your email address, are never sent.
Cookies and similar technologies: see section 9.

Information about people who aren't users

Contacts: names, email addresses, phone numbers, companies, notes and correspondence that a user adds, imports or syncs.
Artist page visitors: if you send a booking or contact form on an artist page, we store what you send for that artist. If you sign up for an artist's announcements, we store your email address and your consent, and every announcement includes a way to unsubscribe. Page visits are counted in aggregate.
Ticket buyers: if you buy a ticket through a StageLink sale page, we store your name, email address, the order and the tickets, the amount, and, when the sale page links to a campaign or a social channel, a first-party record that credits the sale to it. Card payments are handled by our payment processor, Stripe, and we don't see or store card numbers. We email your tickets to you, and the venue that sold them sees the orders for its shows. Free tickets are stored the same way.
Door scanning: when a venue's staff scan tickets at the door, the scan (ticket, time and result) is recorded for the venue, along with a label for the scanning device (such as the browser and city it was opened from) so the venue can see which phones were used.
Email campaign recipients and audience contacts: a venue or artist can keep an audience list (email addresses, names, source and consent) and send email campaigns to it. We record whether each email was delivered, opened or clicked, bounced or marked as spam, and who unsubscribed. Every campaign email includes an unsubscribe link, and unsubscribes are honoured for that sender.
Recipients of contracts, invoices and shared links: your name and email address, what you do on the link (for example viewing or commenting), and, if you sign a contract, your signature or typed name, when you signed, and the IP address and browser used, as a record of the signature. For agreements sent for e-signature we keep a trail of when the document was sent, opened, signed or declined, the signer's email verification code check (stored only as a hash), a fingerprint of the document, and the signed PDF. The sender and the signers can download it.

3. How we use information

We use personal information to:

provide, operate and maintain the Service, including the features you choose to use;
create and secure your account, keep you signed in, and verify sign-ins;
sync, display, send and organise information from the services you connect, when you ask us to;
provide AI-assisted features you choose to use (see section 5);
send you service messages, such as security alerts, account notices and replies to your requests;
send product news, where the law allows; you can opt out at any time;
monitor usage and performance, fix problems, and improve and develop the Service;
detect, prevent and respond to security incidents, abuse and breaches of our Terms;
comply with legal obligations and enforce our agreements.

We don't sell personal information, and we don't use it for targeted advertising.

We share personal information only in these cases:

Service providers that help us run the Service, under contracts that limit their use of the information to providing services to us. These include providers of cloud hosting, databases and file storage, email delivery, maps and location services, AI model hosting, and support tools. Some features also send non-personal data, such as place names, dates and routes, to public data sources (for example routing, fuel price or encyclopedia services) to look up facts.
When you ask us to: when you send an email, publish an artist page, share a link, send a contract or invoice, or connect a third-party service, we share the information needed to do what you asked.
Within your workspace: people you invite to your workspace can see and change workspace content according to the access you give them.
Support access: our support staff can open your workspace when you send us a support request, or for security, abuse or legal reasons (see section 7).
Legal reasons: when we believe in good faith that the law, a regulation, legal process or a government request requires it, or that it is needed to protect the rights, property or safety of StageLink, our users or others.
Business transfers: if StageLink is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.

Each workspace's data is kept separate from every other workspace's data. Other StageLink users can't see your workspace unless you invite them or share something with them. The one shared resource is our directory of venues, built from public sources, and what you type about a venue stays in your own workspace.

5. AI features

Some features use artificial intelligence, such as our assistant, writing help, matching and document reading. When you use them, the relevant information (for example the email thread or document you asked about) is sent to the AI model provider we use to produce a response. That information is used only to provide the feature to you. Neither we nor our AI providers use your content to train AI models. AI output can be wrong, so check it before you rely on it. Our assistant asks you to confirm before it sends, changes or deletes anything.

6. Google user data

Signing in with Google asks only for the basic scopes openid, email and profile. We use your name, email address and profile picture to create your account and sign you in, and for nothing else. Signing in with Google doesn't give StageLink access to your Gmail, Calendar or Drive.

Mail doesn't use Google access. To use Mail you connect any mailbox, including a Gmail one, with an app password (IMAP and SMTP), as described in section 2. We store that password encrypted. Gmail messages you read in StageLink reach us through that mailbox connection, not through a Google API. We don't change or delete anything in your mailbox, apart from what you ask StageLink to do, such as sending an email, marking a message or filing it in a folder.

Google Calendar is optional. If you choose "Connect Google Calendar" in Settings, you grant the calendar events scope. We use it to add your shows and the events and meetings you create in StageLink to your calendar and keep them up to date. StageLink only changes the events it created, and shows you the events you ask to see.

You can revoke StageLink's access at any time from your Google Account (https://myaccount.google.com/permissions) and disconnect your mailbox in Settings. When your account is deleted, we delete the Google data we stored and revoke our access to your Google account.

If you connect a Google account, StageLink's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular:

we use Google user data only to provide and improve the user-facing features you use in StageLink;
we don't sell Google user data, use it for advertising, or use it to train AI or machine learning models;
we don't transfer Google user data to others except as needed to provide the Service, to comply with the law, or as part of a merger or acquisition with appropriate protections;
no person at StageLink reads your Google data unless you ask us to (for example by sending us a support request), it is needed for security or to investigate abuse, or the law requires it.

The same commitments apply to data we receive from any other email, calendar or sign-in provider you connect.

7. Support access

Sending us a support request does not give our support staff access to your account. If we need to look inside your account to help, we email the account's owner to ask, and nothing opens unless they allow it; the access ends as soon as our support staff are done, and never later than the time the owner chose. For security, abuse or legal reasons we may open a workspace, view only, without asking; when we do, we email the workspace owner and explain why. Support never sees your password, billing or payment details. Every visit is logged. The owner is emailed each time support signs in, with a link to end access at once, and is emailed a summary of what support did when the access ends.

8. Security

We use administrative, technical and physical safeguards designed to protect personal information. These include encryption in transit (HTTPS), encryption at rest for stored data and files, additional encryption for sensitive credentials, mailbox passwords, tax IDs and payment details, ticket and signing links that can't be guessed, strict separation between workspaces, access controls and logging for our staff, rate limiting, and two-step sign-in for your account. No method of transmission or storage is completely secure. If we learn of a security breach that affects your personal information, we'll notify you as the law requires.

9. Cookies

We use only the cookies and similar technologies needed to run the Service: to keep you signed in, remember your preferences, and protect against fraud and abuse. They include your session cookie; a short-lived cookie that remembers which sale page or campaign link sent a ticket buyer; a cookie that keeps a venue's door-scanner phone signed in to the scanner; a cookie that identifies a visitor to a shared document who has no account; and, only when our hosting can't tell us a visitor's network address, a random device id used to apply abuse limits. We don't use advertising cookies or third-party tracking cookies. You can control cookies in your browser settings, but the Service may not work properly without the necessary ones.

10. How long we keep information

We keep personal information for as long as your account is open and as needed to provide the Service. When you disconnect a connected service, we stop syncing it and delete the data we stored from it, except anything you saved into your workspace. When the workspace owner deletes the account, it is closed right away and can be restored for 14 days using the link we email; after that we permanently delete the account, the workspace and all of its content and files, and revoke our access to connected services. Signed agreements and expense receipts are deleted with the rest of your files. Copies in routine backups are overwritten on a regular schedule. We keep some information longer when we must, for example records needed to resolve disputes or enforce our agreements, and information the law requires us to keep.

11. Your choices and rights

You can:

see, correct and update much of your information directly in the Service;
download a copy of your workspace data from your account settings (the export covers your contacts, shows, tours and expenses, invoices, contracts and signed agreements, mail, ticketing and orders, campaigns and audience, paperwork records (without the tax ID number) and the links between workspaces; secret links and passwords are left out);
disconnect connected services and revoke their access at any time;
delete your account from your account settings;
unsubscribe from product news using the link in those emails;
leave the waitlist by contacting us.

Depending on where you live, you may have further rights: to know what personal information we hold about you, to get a copy of it, to correct or delete it, to object to or restrict some processing, to withdraw consent, and not to be treated differently for using these rights. To make a request, contact us using the details in section 15. We'll verify your request and respond within the time the law requires, and within 30 days in any case. If you're a contact, fan or visitor whose information a StageLink user added, we may pass your request to that user, because they control that information.

12. International transfers

We are based in the United States and process information there. If you use the Service from another country, your information will be transferred to and processed in the United States and wherever our service providers operate, with the safeguards the law requires.

13. Children

The Service is not intended for anyone under 16, and we don't knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we'll delete it.

14. Changes to this policy

We may update this policy from time to time. If we make a material change, we'll tell you in the Service or by email before it takes effect. The effective date at the top shows when it was last updated. If you keep using the Service after a change takes effect, the updated policy applies.

15. Contact us

For questions about this policy or your personal information, contact us through the form at https://stagelink.dev/contact or at support@stagelink.dev.

Queer Music Agency
176 Woodward Avenue, Ridgewood, NY 11385