BandRoom Privacy Policy

Version 1.0 of 13.10.2026

1. General Provisions

This Privacy Policy explains what personal data is processed when you use the BandRoom service, for what purposes and on what legal grounds, who receives it, how long it is kept, and what rights you have.

BandRoom (the Service) is an online booking service for rehearsal rooms and recording studios in Serbia. The Service is available on the website bandroom.rs, as an app that can be installed on a phone's home screen, and in Telegram as the @bandroom_bot bot and a mini app. Musicians find a venue, see free time slots and prices, and send a booking request; venue owners and their assistants accept requests and manage the schedule in the owner dashboard.

The personal data controller is the BandRoom service administration (the Operator). Contact for any personal data questions: info@bandroom.rs.

This document is prepared in accordance with the Law of the Republic of Serbia on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "Službeni glasnik RS", br. 87/2018) and applies to the extent that personal data processing is carried out in connection with the operation of the Service in Serbia.

Your BandRoom account is kept in the Operator's shared account system. If you are already registered with another service of the Operator using the same email address, Google account, Yandex ID or Telegram, signing in to BandRoom opens that same account.

2. The Operator and Venue Owners

• The Operator determines the purposes and means of data processing in the Service: accounts, the catalog, requests and bookings, notifications, logs and analytics.
• A venue owner and the assistants they appoint (the venue team) receive the data of your requests to that venue in order to decide on the request, contact you and hold the session. When the venue team uses this data to provide its own service (room rental, recording), it acts as an independent controller and is itself responsible for that use, including outside the Service (for example, when it calls you or copies a booking into its own calendar).

3. What Data We Process

Account. The name you enter or that the sign-in provider passes to us; email address and whether it is confirmed; password in hashed form (bcrypt algorithm) if you register with email; interface language; registration and last sign-in dates; acceptance of documents and their versions; sign-in sessions (device type and validity period).

• Sign-in with Google: Google account ID, name, email address and whether it is verified, profile photo link.
• Sign-in with Yandex ID: ID, name, email address, profile photo link.
• Sign-in with Telegram (website widget, the @bandroom_bot bot or the mini app): Telegram ID, username, name, profile photo link, Telegram language.

Requests and bookings. Venue and room, date and time, weekly repetition, selected equipment, purpose of the session (category and/or comment), price according to the venue's price list at the time of the request, status (pending, confirmed, rejected, cancelled, rescheduling, no-show), who cancelled a booking and when, late-cancellation flag, rescheduling history. Your phone number, if you enter it in a request: without a linked Telegram account it is required so that the venue can contact you. If your profile has no phone number yet, this number is also saved to your profile.

Other actions of a musician. Waitlist entries (the room and time you are waiting for), favorite venues, opt-outs from venue promotional messages, reviews and ratings, suggestions of new venues for the catalog (name, address, contact, comment).

Information about you from a venue team. Decisions on requests and rescheduling, no-show marks, closing a specific venue's booking to you, as well as private notes about a client (up to 500 characters) that the team of a venue where you have booked may keep for itself. Notes are visible only to that venue's team.

Booking summary. The Service automatically counts, across your bookings, how many sessions took place, how many bookings you cancelled, including late cancellations (after the venue's free cancellation period), and how many no-shows there were. This summary is shown to the team of the venue you send a request to (section 6).

Owners and assistants. Venue card data: name, address and coordinates, contacts (phone, email, website, Instagram, Telegram), photos, description, rooms, equipment, prices and packages, opening hours, cancellation rules. Team members and assistant permissions, assistant invitations. The venue calendar link and the events received through it; settings for writing bookings to Google Calendar. Dashboard activity log: who changed what and when in settings, prices, bookings and the team. Records of venue listing fees, if introduced: period, amount, method and date of payment.

Notifications. Push notification subscriptions: the subscription address issued by your browser's push service, encryption keys, browser type. Delivery log: to whom, for which event and through which channel (Telegram, push, email) a notification was sent and whether it was delivered. The text of messages is not stored in the log.

Technical data. IP address, device and browser type, operating system, browser language, the page address, referral source and UTM tags (including visits via the QR code on a venue poster), date and time, cookie and browser local storage identifiers, page loading speed metrics.

What we do not process. BandRoom does not request your device's geolocation. The Service does not accept payments, so it does not receive bank card numbers or other payment data of musicians. We do not ask for information about health, political opinions or other special categories of data; please do not include such information in comments and notes.

4. Purposes of Processing and Legal Grounds

We process personal data only when there is a legal basis and to the extent necessary for a specific purpose:

• Performance of a contract (the Terms of Use) and steps taken at your request before entering into it: registration and sign-in, the catalog and search for free time, passing your request to the venue team, confirmation, cancellation and rescheduling, the waitlist, reminders 24 hours and 1 hour before a session and other service notifications, the owner and assistant dashboard, assistant invitations, connecting a venue via an invitation link, writing bookings to the owner's calendar as configured by the owner.
• Legitimate interests of the Operator and venue owners: Service security and abuse prevention (request rate limits, checks on sign-in forms); activity and delivery logs for handling complaints and disputes; the booking summary and venue team notes (protecting venues against no-shows and late cancellations); venue promotional messages to their own clients with the option to unsubscribe; filling the catalog with venue information from public sources and a single message to a venue owner via the venue's public contacts offering to join; our own visit statistics and improvement of the Service. You have the right to object to such processing (section 13).
• Consent: optional analytics cookies and services (section 5), browser push notifications (you enable them yourself), linking Telegram for notifications, optional data you provide voluntarily. You can withdraw consent at any time; this does not affect the lawfulness of processing before the withdrawal.
• Compliance with legal obligations: responding to lawful requests from state authorities, keeping records of listing fee payments by venue owners (if introduced) as required by accounting and tax legislation.

5. Cookies, Local Storage and Analytics

The Service uses cookies and browser local storage:

• Necessary: sign-in data (session tokens are kept in the browser's local storage), interface language, short-lived service cookies during sign-in with Google or Yandex ID (protection against request forgery), visit identifiers for our own statistics. The Service does not work without them.
• Form protection: Cloudflare Turnstile runs on the email sign-in and registration forms to check that a form is filled in by a person and not a program.
• Analytics (optional): Google Analytics and Yandex Metrica (including click maps). They show which pages are opened and where the interface is inconvenient. We do not pass your account identifier to these services and do not link their data to your profile. The Service does not record actions on the page (Yandex Metrica Webvisor, Microsoft Clarity). These scripts are not loaded on the page of a venue owner's personal invitation link.

By continuing to use the Service after reading this Policy, you agree to the use of analytics cookies. You can opt out at any time: delete or block cookies in your browser settings, enable tracking protection or a content blocker, or install the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout). Opting out of analytics does not affect booking. If you disable all cookies and browser storage, sign-in and some features will stop working.

6. Who We Share Data With

We do not sell personal data and do not share it with third parties for their own advertising. Data is shared only to the extent necessary for the purposes in section 4.

The team of the venue you send a request to: your name, a link to your Telegram profile (if linked), the phone number from the request, the date, time, room, equipment and purpose of the session, your bookings at this venue, the summary of your bookings in the Service and that venue team's notes. If the owner has turned on showing details to visitors, other visitors see only the session category next to a booked time slot. Your name, phone number and comment are in any case visible only to the venue team.

Other users: your review of a venue is published after moderation together with the name from your profile. Venue card informat