1. Data controller
The controller of personal data processed through Artistour is SONUS Events SRL, a company registered in Romania, registered office: Bacului 47, Sector 1, 012501 București, România, VAT / tax ID RO52517434, Trade Register number J2025070254001. Privacy and support contact: office@artistour.app. Where a workspace owner (for example an artist management company) uses Artistour to organise its own team and events, that customer also decides what information about its crew, contacts and events is entered into its workspace and is responsible for having an appropriate legal basis to do so.
2. Data we process
Depending on how you use Artistour and on the role and permissions you have in a workspace, we may process the following categories. Not every category exists for every user. • Account and profile data: name, email address, password credentials managed by our authentication service, language and display preferences. • Workspace and company data: workspace name, company details, country, default settings. • Artist, team and crew data: artists managed in a workspace, team members, their per-artist roles and functions, invitations and Event Team participation. • Event operations data: dates, times and timezones, venues and addresses, programme/schedule, travel and ground transport, accommodation and rooming, meals, technical and production notes. • Contacts: names, roles, phone numbers and email addresses of event contacts entered by workspace users. • Financial and business operational data: fees, per diems, budgets or settlement information entered by authorised managers. • Calendar integration data: connection status, connected account email, calendar identifiers and names, and mappings between Artistour events and calendar events (see section 4). • OAuth credentials: encrypted access and refresh tokens for calendar integrations you connect (see section 6). • Private documents and files: PDFs and other files uploaded to events, such as rooming lists, transport plans or riders. • Subscription metadata: trial dates, selected plan, artist slots and entitlement status. No card data is collected in the current version of Artistour. • Notification and device data: in-app notifications, read status and push-notification device tokens if you enable push notifications. • Security and technical data: IP address, browser and device information, authentication and security logs, error diagnostics and issue reports you submit. • Offline Day Sheet data: a copy of the Day Sheets you are authorised to view may be stored on your own device so they remain available without a connection; it is scoped to your user account.
3. Purposes and legal bases
We process personal data to: • provide the Artistour service and its features under our contract with you or with your workspace (Art. 6(1)(b) GDPR); • operate calendar integrations, push notifications and other optional features you choose to enable (Art. 6(1)(b) GDPR and, where required, your consent); • secure the platform, prevent abuse, diagnose errors and maintain service quality (legitimate interests, Art. 6(1)(f) GDPR); • handle support, privacy and data-protection requests (legal obligation and legitimate interests); • comply with accounting, tax and other legal obligations (Art. 6(1)(c) GDPR). We do not sell personal data and we do not use workspace or calendar data for advertising.
4. Google user data
Artistour offers the optional Official Google Calendar integration, which requires explicit authorisation on Google's consent screen. Personal Google Calendar has been retired. New connections and synchronization are disabled. Previously stored connection records, mappings and encrypted credentials are retained; retirement does not revoke credentials or change or delete previously exported Google calendars or events. Official Artist Calendar An authorised artist manager may connect one official Google Calendar for an artist. For this integration Artistour may access the connected Google account email, calendar-list metadata (to let the manager choose a writable calendar), information about candidate and mapped calendar events, and the event details required for approved creation and updates. Artistour creates or updates an Official Calendar event only through its controlled workflow: a manager reviews a preview and explicitly confirms the mapping, creation or sync of a specific event. Artistour does not delete Official Calendar events. Official Calendar data exported from Artistour may include: event title; date, time and timezone; venue/location; the complete management Program; and accommodation/hotel names. The Official Calendar export does NOT include: rooming lists, room occupants, room numbers, private hotel notes, financial data, per diems, internal notes, documents/files, Event Team, or Artistour permission metadata. Who can see a Google calendar and its events is controlled by the calendar owner through Google Calendar sharing settings, not by Artistour. Google API Services – Limited Use Artistour's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. This statement does not mean that Google has certified or endorsed Artistour. Google user data is used only to provide and maintain the user-requested calendar integrations described above and the associated security and support functions; it is not used for advertising, not used to train AI models, not sold, and not read by humans except with your consent, for security purposes, to comply with law, or where aggregated and anonymised for internal operations.
5. Microsoft and other calendar providers
If you connect a Microsoft Outlook calendar, Artistour uses the permissions you grant to create and maintain a dedicated Artistour calendar and export the events you are permitted to see.
6. Google User Data Protection and Security
Artistour applies the following measures to data received from Google through the Official Artist Calendar integration. • Encrypted credentials: Google OAuth access and refresh tokens are encrypted with AES-256-GCM before they are stored and are decrypted only on our servers when needed for an action you have authorised. This application-level encryption applies to OAuth credentials; other Google user data described below is protected by the access controls in this section. • Server-side processing and key protection: OAuth client credentials and encryption keys are kept as server-side secrets and are never sent to browsers. Token exchange, token refresh and all requests to Google APIs run only on our servers. Browser sessions cannot read stored tokens or their encrypted form. • Encryption in transit: communication between your browser and Artistour, and between Artistour and Google APIs, uses HTTPS (TLS). • Authentication and role-based access: every Official Calendar operation requires a signed-in user. Our servers check, at the time of each request, that the user is an authorised manager for that artist; this check is repeated when Google returns you to Artistour after consent. • Workspace and artist isolation: database row-level security and per-artist roles restrict calendar connection records and event mappings to authorised managers of the relevant artist. Each artist has at most one Official Calendar connection. • Calendar selection and controlled actions: an authorised manager chooses the single writable calendar Artistour may use. Events are created, linked or synchronised individually, only after a manager explicitly confirms each one. Updates are sent conditionally using Google's ETag version check so that an event changed in Google since it was read is not overwritten unintentionally. Automatic synchronisation is not enabled. • Protected sign-in flow: the OAuth request uses a fixed, registered callback URL and a cryptographically signed, time-limited state value tied to the user, workspace and artist. Invalid or expired requests are rejected before any credential is obtained. • Data minimisation: we request only your account email, read-only access to your calendar list (to choose a calendar) and access to calendar events. We store the connected account email, granted permissions, encrypted tokens, the selected calendar's identifier, name and access level, links between Artistour events and Google event identifiers, and technical metadata needed to prevent duplicate events. Calendar lists, search results and event contents read from Google are processed only for the requested action and are not stored as separate copies. • Logging: our logs do not record OAuth tokens, authorisation codes or calendar event content. Error messages shown in the app are limited to generic, predefined descriptions. • Disconnect and revocation: when a manager disconnects, Artistour deletes the stored tokens and makes a best-effort request to Google to revoke its access. Google calendars and events are not deleted. You can also revoke access at any time at https://myaccount.google.com/permissions. To request deletion of remaining connection records and mappings, contact office@artistour.app. Artistour's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements (see section 4). Private documents are opened only through short-lived links issued after a fresh permission check. No system is completely secure, but we apply technical and organisational measures appropriate to the risks.
7. Disconnecting integrations and remote copies
• Outlook Calendar disconnect: when you disconnect, you can choose whether Artistour should attempt to delete the dedicated remote calendar. If remote deletion is not chosen or does not succeed, the calendar and its events can remain with Microsoft, where you can delete them yourself. • Official Calendar Disconnect: clears the locally stored credentials and attempts to revoke Artistour's access with Google, but leaves the Google calendar and its events intact. • Official Calendar Unlink: removes only the Artistour mapping for that event; it does not delete the Google event. • Deleting an event in Artistour does not guarantee deletion of a copy already exported to a remote calendar. You can also revoke Artistour's access at any time from your Google or Microsoft account security settings.
8. Sharing and service providers
We share personal data only as needed to operate Artistour, with the following categories of providers: • Lovable / Lovable Cloud — application hosting, database, authentication, file storage and server functions; • Cloudflare — content delivery, network and edge execution; • Google — Google Calendar integrations you connect, Google Maps/Places/Geocoding for address and location search and, for push notifications, Firebase Cloud Messaging; • Microsoft — the Outlook calendar integration, if you connect it; • Open-Meteo — weather forecasts based on event location (no account data is sent); • authentication email infrastructure — delivery of sign-up, invitation and password-reset emails. Within a workspace, information is visible to other members according to the roles and permissions configured by the workspace owner and artist administrators. We may disclose data where required by law or to protect rights and safety. Some providers may process data outside the European Economic Area; where this happens, transfers rely on the safeguards provided under applicable data-protection law.
9. Retention
We retain personal data only as long as necessary for the purposes for which it is processed and to meet applicable legal obligations. There is no fixed retention period for most categories of workspace data; they are kept while the account or workspace relationship requires them. • Operational and historical records (for example past events and Event Teams) remain available while the workspace needs them, including after a subscription expires, in read-only form. • Archiving an event or item is not the same as erasing it. • Residual copies may temporarily remain in provider backups and logs until they are overwritten or deleted according to the providers' infrastructure cycles. • Copies you or others have previously downloaded, printed or exported (including PDFs and calendar exports) cannot be recalled by Artistour.
10. Your rights
Under the GDPR and applicable Romanian law you have the right to access your personal data, to rectification, to erasure, to restriction of processing, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time where processing is based on consent. Artistour does not currently offer self-service account deletion in the application. To exercise any of these rights, including deletion of your account, write to office@artistour.app. Requests are handled manually, may require us to verify your identity, and are answered within the deadlines set by applicable data-protection law. Where data was entered by a workspace owner about you, we may need to coordinate with that workspace. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or with the supervisory authority of your EU country of residence.
11. Children
Artistour is a professional service and is not intended for children under 16.
12. Changes
We may update this Privacy Policy when the service or legal requirements change. The current version and date are shown at the top of this page; significant changes will be communicated in the application or by email.
13. Contact
SONUS Events SRL — office@artistour.app