Privacy Policy
Last updated: October 13, 2026
About this policy
NextStage helps independent artists discover relevant music opportunities. This policy explains the information used to provide that service. Contact the NextStage operator at pierre@next-stage.io for privacy questions or requests.
Information you provide
We process account email addresses, authentication information and profile details supplied during registration or through an enabled sign-in provider. Artist searches use artist or band names, genres, locations, target countries, submitted music and social profile URLs, and search preferences. Saved analyses, workspace selections and opportunity statuses help restore your work. Do not submit private information about other people without authorization.
How information is used
Artist and search information is used to identify profiles, find similar artists and opportunities, enrich results and explain relevance. Account and session data support sign-in and saved work. Technical request, error and provider diagnostic logs support security and troubleshooting; depending on the request they may include artist queries and technical connection information. Search recommendations assist your decisions and do not make booking decisions for you.
Services and external data
Supabase provides authentication and database storage when configured. The application is designed for deployment on Vercel, which handles requests and hosting logs when used. OpenAI is used for AI analysis and enrichment when configured; artist context, search queries and relevant source content may be sent to it. Configured web research integrations include Tavily, Exa, Firecrawl and Jina, which receive search queries or source URLs. Optional music and event integrations include Spotify, YouTube, Last.fm, Deezer, MusicBrainz, Chartmetric, Bandsintown, Songkick, setlist.fm, Ticketmaster and OpenAgenda. They receive the artist identifiers or queries needed for the enabled lookup. These integrations are not all active on every deployment or search. Public artist, venue, event and professional contact information may be collected from third-party sources and displayed with available evidence. Enabled Google or Apple sign-in is subject to the provider’s own privacy policy.
Optional analytics
When enabled on the production site, Plausible receives analytics only after explicit consent. Events contain a public landing route or synthetic activation route, acquisition channel and funnel stage; they exclude form values, emails, account IDs, artist inputs, private paths, query strings and referrer URLs. Plausible receives the connection IP address and user agent. Do Not Track and Global Privacy Control suppress sending. Use the analytics control to decline or withdraw consent; withdrawal clears stored session attribution and milestone flags.
Cookies and browser storage
Necessary cookies support authentication, language preference and guest analysis retrieval. The guest analysis cookie lasts up to 30 days. Local storage can hold onboarding data, workspace and search state, opportunity statuses, cached results, dismissed notices and analytics consent. After analytics consent, session storage holds attribution and event deduplication flags. You can clear browser storage using your browser settings, but this may sign you out or remove locally saved work.
Retention
Guest analyses have a seven-day expiry and are excluded from retrieval after expiry; cleanup removes expired rows when it runs. Saved account analyses and shared artist, venue and opportunity records persist in the database; no universal automatic deletion period is implemented for them. Local browser data remains until cleared or replaced, and session storage lasts for the browser session. Hosting logs, backups and provider retention depend on the configured services. Contact us to request deletion or details of applicable retention.
EU users and your rights
For EU users, providing the requested account and search service is the basis for necessary processing; optional analytics relies on consent. Security and maintenance may rely on legitimate interests, subject to your rights. You may request access, correction, deletion, restriction, portability or object to processing where applicable, and withdraw consent without affecting prior lawful processing. Contact us using the address below; we may need to verify your identity. You may complain to your local data protection authority.
International processing and updates
Configured providers may process information outside your country, including outside the EEA. Ask us for the current processing locations and applicable transfer safeguards. We update this notice as functionality and integrations change and display the revision date above.
Questions or privacy requests: pierre@next-stage.io