Gigbusters

Español · English

Privacy Policy

Version 2.4 · Last updated: 24 September 2026

The essentials, in five lines

1. Who processes your data

The controller is Era Creativa Agencia Digital S.L.U., tax ID B01737816, Calle la Encina, 347, 19185 El Casar (Guadalajara), Spain. For any privacy matter write to privacidad@gigbusters.com: we answer, not a form.

We are not required to appoint a data protection officer and we have not appointed one, because we neither process data on a large scale nor process special categories of data.

2. Where the data comes from

• From you: what you type when signing up, completing your profile, publishing a gig or negotiating a show.
• From your use: which screens you visit, from what kind of device, in which area.
• From your band or venue: if someone invites you to their team, that entity sees your display name and your photo.
• From public sources: the gig listings incorporate events from open data portals. If your stage name appears in one of them, it comes from that source and we always credit it.

When you sign up we ask for your date of birth, for one purpose only: checking that you are the required 16 years old. It is stored in your profile, it is not public, it is not used to target advertising and it is not shared with anyone.

We do not ask for your ID number, your postal address, your phone number or your bank details.

3. Purposes, legal basis and retention

Where the basis is legitimate interest we have assessed whether our interest justifies the processing without harming you. You can ask us for that assessment in writing and, of course, object.

4. Your location

It is the most sensitive piece of data a tool like this handles, so we explain it separately.

• It is only requested when you use it, and your browser or phone grants it. You can refuse and keep using Gigbusters by choosing your area by hand. You can revoke it at any time in your device settings.
• Never in the background. There is no tracking while the app is closed.
• It is not retained. It is used to narrow the search — or to check that you are at the gig whose attendance you want to validate — and discarded on the spot. We do not store a single coordinate: there is no history of where you have been or where you have searched.
• For statistics only the area is derived, never the point.

Attendance you validate yourself is a different matter. If you are at a gig and tap to validate that you went, that is recorded — it is what gives meaning to your case and to your city's numbers. What we keep is which gig you went to: the event, the venue, the city, the area and the date. Not the coordinate, which by then has already been discarded. It is not tracking: it does not happen unless you ask for it, and every line in that record exists because you created it.

Two consequences of how it is built, worth knowing before you use it:

• A single entry cannot be edited or deleted, not even by us. That is deliberate: a history someone could touch up would be worthless both as a memory and as a figure, and the door to inflating it would be open from the inside.
• If you delete your account, your history is detached from you rather than removed: it stops being linked to any person and remains an anonymous number inside that venue's and that city's total. Nobody can tie it back to you.

What bands and venues see of all this. By default, figures and never people: "47 people came", not who. On top of that, a figure drawn from too small a group is not published — it stays silent rather than being rounded — because with three attendees a percentage points at someone.

You can decide otherwise for yourself: both when you sign up and in your account there is a checkbox — its own, separate from accepting the terms, and unticked — so that the band or venue whose gigs you keep going to know it was you, with your alias and your city. It is optional, it does not condition any part of the service, and you can withdraw it at any time from your account, as easily as it was given.

Two things we say here because you should know them before deciding, not after:

• Withdrawing it stops what is shared from then on, not what was already shared. A recognition granted while the permission was active stays granted, for the same reason no entry in the history can be touched up.
• We keep a record of when you gave it and when you withdrew it, and of which text you accepted. It is not to nag you: it is the only way to be able to show — to you or to an authority — that at every moment we did what you had decided.

A gig's location is a different matter: that is information about the event, not about you. Even so we protect it: the exact address of events that require it is shown only within their time window; outside it, the point is snapped to a grid of about 500 metres. We use a fixed grid rather than shifting the point at random on purpose: with a random shift, repeating the query many times would let someone infer the real point; with a grid, it would not.

5. Usage data, improvement and anonymous statistics

For the tool to get better we need to know how it is used: what people search for and fail to find, which screens get stuck, which areas have gigs and which need a push. We measure that in two ways.

Always, without asking you anything: we count on our own server, from the requests we already serve. No pixels, no advertising identifiers, and nothing installed on your device.

Only if you accept: Google Analytics, which is a third party and stores two cookies in your browser. It tells us which pages get used, which ones get stuck, from which country and on what kind of device, and whether you came through the web or the app. We do not send it your name, your email or your user number. Its data is also processed outside the European Union, under the safeguards the law requires for such transfers. If you do not accept, nothing is installed and nothing is sent, and Gigbusters works just the same. You can change your mind whenever you like from the Cookie Policy, and in any case we ask again after a year.

From that information we build group statistics: how much live music is programmed, of which styles, in which areas and at which times of year. Those statistics we do share with third parties — advertisers, venues, promoters, media outlets, public bodies or industry studies — and that is one of the ways Gigbusters sustains itself.

What we share meets these three conditions, without exception:

• They are aggregate figures, of the kind "in June there were 1,200 attendances at rock gigs in Guadalajara". Never individual activity.
• They contain no identifier: not your name, not your email, not your user number, not your device's.
• A figure is only published when it covers enough people for none of them to be inferred from it. If a group is too small, that figure does not go out.

Those three conditions refer to these statistics. There is one thing that is not a statistic and is therefore not governed by them: the disclosure of your identity to the band or venue whose gigs you keep going to, which only happens if you switch it on and is explained in the previous section.

Put another way: what leaves this place is no longer personal data, and that is why it can be shared. Those figures are what allow the tool to be free and let an advertiser know whether it makes sense to address the audience of an area, instead of advertising blind. It is a trade, and we would rather you saw it in writing.

How to object

Google Analytics measurement only runs if you accept it in the cookie notice, and you can withdraw it at any time with the "Change my measurement choice" link in the app footer or from the Cookie Policy. Our own visit counter stores nothing that identifies you. To object to any other processing for analytics purposes, write to privacidad@gigbusters.com.

6. Advertising

Which advert you see is decided on our server from three things: the type of profile you have active (audience, musician, band or venue), the screen you are on, and a daily cap so the same advert is not repeated at you. Your location plays no part, nor does your history, nor any data bought from a third party.

The advertiser supplies the creative and receives how many times it was shown and how many times it was clicked. They receive no personal data about you, and cannot know who saw their advert.

7. What is public by design

Gigbusters exists so people can find you, so some information is public on purpose. It is worth knowing exactly which:

• Band and venue pages, with their name, photo, biography, styles, links and gigs. Visible to anyone, even without an account, and indexed by search engines.
• Published gigs, with their poster and their location.
• The display name and photo of a band's members, on that band's page.
• Your personal profile, with the reach you choose: visible to anyone, or only to people with an account.
• Your musician profile, if you activate it. You can set it to hidden: it then appears in no search at all, not even the one bands use to send invitations.

Your email is never public. Contact details are revealed to the other party only when an agreement is sealed, and whoever receives them is bound to use them only for that gig. In classified ads, the contact information is written by you and will be visible: think about what you put there.

8. Who else sees your data

We do not sell personal data and we do not disclose it for commercial purposes. Only those providing us with a necessary service are involved, under a data processing agreement:

In addition, your browser connects directly to these third parties when loading certain parts of the page. In those cases it is not us sending them your data: it is your own browser, and their policies apply.

If Google cannot run the check (for example, because a blocker prevents it), the contact form cannot be sent; you can write to us directly at comunicacion@gigbusters.com.

Turning a postal address into coordinates is done by our server against the Nominatim service of the OpenStreetMap Foundation: the address text is sent, never your IP address.

We also disclose data where a rule requires it or an authority lawfully requests it, and in the case described in the Community Guidelines.

Ticket sales links and affiliation

When you tap "Tickets" on a gig you do not go straight to the seller's website: you first pass through a Gigbusters exit link (/api/v1/go/…) that takes you there. That step records the tap so we can settle accounts with sellers, and it records it without personal data: the event, the seller, the ticket sales link that was chosen, the terms of the agreement with that seller in force at that moment, whether you tapped from the app or from the website, and the date. In the mobile app, until its next version, the button takes you straight to the seller's website and that tap is not recorded.

That record stores neither your IP address nor your user identifier. The web server's technical logs do contain the IP address of that request, just as they do for any other request that reaches the server: they are kept for a limited time and used only for security and operation (rate limiting, detecting and blocking abuse), with security tools that may share attack signals. They are not used for analytics and are not cross-referenced with the tap record or with your account.

Taps are kept for 400 days and then deleted.

Once on the seller's website, the affiliate cookie (the one that tells the seller you came from Gigbusters) is set by the seller or its affiliate network on its own domain, under its own privacy and cookie policy, not by Gigbusters. How we decide which seller we show you is explained in How we choose the seller.

9. Transfers outside the European Union

All the main infrastructure — servers, database, images, backups — is in the European Union.

The only necessary transfer is the push notification service (Expo, United States), which receives the device's delivery identifier and the text of the notification. It relies on the standard contractual clauses approved by the European Commission and on the adequacy framework between the European Union and the United States, where the provider is certified. If you do not use the mobile app or do not accept notifications, this transfer does not happen.

The third parties your browser connects to (maps, players and Google's reCAPTCHA check) may be outside the European Union. Google LLC participates in the EU-U.S. Data Privacy Framework. You can avoid the players by not playing embedded content; the reCAPTCHA check only happens if you use one of the forms listed in section 8.

10. Deletion and retention

You can delete your account from My profile, without asking permission or giving reasons. Your profile, your images, your sessions and your content are erased.

What does not disappear straight away, and why:

• Agreements closed with another person, for the period in the table above: a third party there may need to evidence what was agreed.
• Moderation decisions, so we can justify them if appealed.
• Whatever a rule obliges us to keep, notably accounting and tax rules.
• Backups, for up to 14 days, at which point they are overwritten.

If you are the only administrator of a band or a venue and there are other members, you must hand that role over to someone else before deleting your account. If you are its only member, the band or venue is closed along with your account: its future gigs and agreements are cancelled and we notify the affected bands, venues and people in the app and by push notification. Anything that has already taken place is left untouched.

11. Your rights

You may exercise at any time your rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent you have given, without affecting processing carried out before.

• From the app itself: editing your profile, changing its visibility, closing sessions, switching marketing messages on or off, and deleting your account.
• By writing to privacidad@gigbusters.com. We reply within one month at most; if the case is complex we will tell you and may extend it by two further months.
• We may ask you to prove your identity, and we will only do so where we have a reasonable doubt.

If you believe we have not handled things properly, you can complain to the Spanish Data Protection Agency (aepd.es). We would be grateful if you told us first so we can put it right, but it is your right and it is not required.

12. Security

• All traffic is encrypted with TLS, including the connection to the mail server.
• Passwords are stored using a cryptographic hash: we do not know them and cannot recover them, only check them.
• Verification and password-reset links expire and are single-use, and only their hash is kept in the database.
• Uploaded images are fully reprocessed before being stored, which strips metadata — including the location cameras embed in photos — and neutralises tampered files.
• Internal access is limited to those who need it, and the team's actions are logged.
• Should a breach occur with a risk to you, we would tell you and notify the Spanish Data Protection Agency within the legal deadline.

13. Automated decisions

We do not take decisions producing legal effects concerning you based solely on automated processing, and we do not build profiles to score you as a person.

There are automated checks — usage limits, duplicate detection and abuse patterns — which may lead to a moderation measure. In that case you have the right to have a human review it, to an explanation and to contest the decision, as set out in the Community Guidelines.

14. Minors

Gigbusters is for people aged 16 or over. That is our own decision: Spanish law would allow 14, but contracts are negotiated here and events with real responsibilities are organised. That is why sign-up asks for a date of birth and the server rejects registrations below that age.

If we find an account belonging to someone under 16 we will close it and erase their data. If you are a parent or guardian and believe such an account exists, write to us and we will act immediately.

15. Changes to this policy

When we change anything significant we will tell you by email or inside the app, in advance and explaining what changes; we will never quietly broaden what we use your data for. The version and the date are always at the top, and the Spanish version prevails.

Legal Notice · Terms · Community · Business · Privacy · Cookies · Cookie settings · Emails