Privacy Policy

Last updated: 7 August 2026

1. Who we are

MetalBooking (metalbooking.com) is the data controller for the personal data processed on this platform. You can reach us any time through the contact form.

2. What we collect

  • Account data — name, email address, password (stored hashed, never readable by us).
  • Profile data — what you choose to publish: band/venue name, city and country, genres, bio, photos, links, tech riders, capacity, contact details.
  • Booking data — requests, confirmations, cancellations and the dates involved.
  • Technical data — server logs (IP address, time, page) kept for security and debugging.

We do not collect payment data (no payments happen on the platform) and we do not buy data about you from anyone.

3. Why we process it

To run the service you signed up for (contract): showing your profile to potential booking partners, matching bands with venues, sending in-app notifications. To keep the platform safe (legitimate interest): reviewing accounts flagged for moderation, preventing abuse. We don't use your data for advertising and we don't sell it.

4. What is public

Band and venue profiles are visible to signed-in users of the platform — that is the point of the service. Your account email is never public (bands/venues choose separately which contact email to show on their profile). Fan (metalhead) profiles are not public.

5. Cookies

We use only essential cookies: a session cookie (keeping you logged in, up to 24 hours) and a CSRF token (security). No analytics cookies, no advertising trackers, no third-party cookies. Because we use only essential cookies, no cookie consent banner is required.

6. Where your data lives

Data is stored on our server in the United States (InterServer) with access limited to the platform operator. Uploaded files and the database are backed up as part of normal server operation. We keep your data for as long as your account exists; server logs rotate automatically.

7. Your rights (GDPR)

You can access, correct, export, or delete your data. Most of it you can edit directly in your profile; deleting your account from account settings removes your profile and personal data. For anything else — or to exercise any GDPR right — use the contact form. You also have the right to lodge a complaint with your national data protection authority (in Romania: ANSPDCP).

8. Changes

If this policy changes in a way that matters, we'll notify you in-app before the change takes effect.