Privacy Policy

1. Data Controller

• Data Controller: Santiago Fernández Seoane
• Project: Makineo (beta phase)
• Contact: hola@makineo.es

2. Data We Process

When you register or use Makineo, we process the following data:

• — Account: username, email address, password (stored encrypted with bcrypt), date of birth, city
• — Public profile: bio, profile picture, favorite genres, visible city
• — Platform activity: saved events, confirmed attendances, ratings, followed artists, crews you belong to; this activity, together with your date of birth, is used in aggregated, anonymous form in promoters' audience statistics
• — Communications: email address if you subscribe to the newsletter (with explicit consent)
• — Technical data: IP address, device type, browsing data for analytics purposes (Google Analytics, subject to your consent)
• — Mobile app: if you install the Android app and accept notifications, we store a device identifier (push token) and the platform so we can alert you about events
• — Approximate location: only if you tap the detect-location button and grant permission. We use it at that moment to infer your city and sort events by proximity
• — Ticket purchases: if you buy a ticket through Makineo: the event, ticket type, quantity, amount paid, and order status (pending, paid, refunded), together with Stripe's payment session identifiers. We never store your card number: you enter it directly on Stripe, which processes it as a PCI DSS certified entity
• — Payout account (promoters): if you enable ticket sales as a promoter, Stripe verifies your identity and bank account directly (KYC), without going through our servers. We only store your Stripe account identifier and whether it's enabled to charge — never your ID document or account number
• — Messages, photos and videos: chat text (encrypted on our servers) and files you upload: photos and videos in chats and in your crew gallery, the crew cover photo, artist recordings or press photos. A direct chat is only visible to its participants. Crew content is only visible to crew members. The crew cover appears on the invite link. Artist profile media is public. We do not sell this content, use it for advertising, or send it to third-party social networks
• — AI assistant conversations: if you use Party Copilot, Promoter Copilot or the magic event import, the text you type or paste is sent to whichever AI provider is active at the time, after we filter out emails, phone numbers and ID numbers

2 bis. Data about artists, venues and promoters from public sources

The catalogue includes artists, venues and promoters who never signed up to Makineo. Their data comes from public sources and is always professional-activity data: stage or trading name, city, genres, public links and the professional contact details they publish themselves. We do not collect private-sphere data or personal profiles that are not public.

The lawful basis is legitimate interest (art. 6(1)(f) GDPR) in keeping a complete, up-to-date cultural calendar. That interest is balanced by limiting the data to strictly professional details and by honouring any objection without asking for reasons.

You can exercise your rights of access, rectification, objection and erasure by writing to hola@makineo.es, or remove your presence entirely through the opt-out described in the Data Collection Policy.

3. Purpose and Legal Basis for Processing

• Account and service management

  Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Necessary for you to use the platform.

• Newsletter and event-related communications

  Legal basis: consent (Art. 6(1)(a) GDPR). Only applies if you expressly select the corresponding option. You may withdraw your consent at any time.

• Web analytics

  Legal basis: consent (Art. 6(1)(a) GDPR). Only applies if you accept analytics cookies. We use Google Analytics with anonymized IP addresses.

• Legal compliance

  Legal basis: legal obligation (Art. 6(1)(c) GDPR). To respond to requests from competent authorities.

• Push notifications in the mobile app

  Legal basis: consent (GDPR art. 6.1.a). Only if you accept the notification permission the app requests. You can revoke it from your Android settings at any time.

• Approximate location

  Legal basis: consent (GDPR art. 6.1.a). Only requested when you tap the detect-location button. Coordinates are not stored on your profile: they are used during that request and in a temporary cache, rounded to ~1 km.

• Verification of the promoter's payout account

  Legal basis: legal obligation (Art. 6(1)(c) GDPR), under anti-money-laundering regulations applicable to payment service providers. Verification is carried out by Stripe as the authorized entity; Makineo does not take part in that process or access the identity documentation.

• Messaging and content you share

  Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Processed only if you use chat, a crew, or publish media on your profile. You choose what you upload and who can see it; it is not shared outside that circle.

• Performance measurement

  Legal basis: your consent (Art. 6(1)(a) GDPR). We measure how long each type of page takes to load and respond (the Core Web Vitals metrics) so we can fix what is slow. We only do it if you accept in the cookie banner: if you reject it or do not answer, we measure nothing. No identifier is stored: only the route with no personal data in it, the metric, whether the visit was signed in or not, the device type and whether the request came from a bot. We cannot tell who you are from this data, and the measurement neither writes to nor reads from your device. We keep these samples for 13 months, after which they are deleted automatically. You may withdraw your consent at any time from the Cookies link in the footer, or by writing to hola@makineo.es.

• App crash reports

  Legal basis: legitimate interest (art. 6(1)(f) GDPR). When the site or the app breaks — a JavaScript error, a screen that goes blank — the error message, its stack trace, the route where it happened and the released version are sent to our own servers, along with your IP address, your browser or device identifier (user agent) and, if you were signed in, your user id. Without this a failure is only known if someone bothers to report it. No third party is involved: the reports go to our own database, not to Sentry or any external service. When you delete your account the IP is erased and the report stops being linked to you; the failure itself is kept, because it is needed to fix it and no longer points at anyone. You can object by writing to hola@makineo.es.

• Audience statistics for promoters

  Legal basis: legitimate interest (art. 6.1.f GDPR). When you like, save or mark that you're going to an event, your date of birth counts towards the age bracket of that promoter's audience. The promoter never sees your date of birth, your age or who you are: only counts per bracket, with at least 5 people per bracket and 20 in total. Under-18s are not included in any bracket. You can object at any time, as explained in section 7.

• AI assistants

  Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the features aimed at promoters (Promoter Copilot, magic event import), and consent (Art. 6(1)(a) GDPR) for the fan-facing discovery chat (Party Copilot), which only activates if you start the conversation yourself. The automatic narratives about venues, artists and scenes, and semantic search, rely on legitimate interest (Art. 6(1)(f) GDPR) to keep the catalogue up to date. In every case we strip emails, phone numbers, ID numbers and tokens from the text before sending it to the AI provider, and the feature is only active when the Makineo team has configured and enabled it.

4. Minors

Makineo is intended for individuals over the age of 18: that's the minimum age to create an account (Terms of Use, section 4). We do not knowingly collect data from minors under that age. If you become aware that a minor has provided data without parental consent, please contact us so that we can proceed to delete it.

6. Disclosure of Data to Third Parties

We do not transfer your personal data to third parties for commercial purposes. The only parties with access to data are:

• — Infrastructure and CDN providers OVH (server hosting, in France), Cloudflare (DNS and protection against bots and attacks) and Bunny.net (image CDN), as data processors under contract
• — Google Analytics for web analytics, with anonymized IP addresses and only where you have given consent
• — Competent authorities where required by law
• — Firebase Cloud Messaging (Google) as a data processor, solely to deliver push notifications to your device
• — Stripe (Stripe Payments Europe, Ltd. and its group companies), as a data processor for processing ticket payments and promoters' payout accounts. For verifying promoters' identity (KYC), Stripe acts as an independent controller under its own privacy policy: stripe.com/es/privacy
• — Komoot (Photon service) as a data processor, to resolve a location into a city name when you tap "detect my location" or search for a place. Only the coordinates or the search text are sent, never linked to your account
• — AI providers (OpenAI, Anthropic, Groq) as data processors, only for the features described in section 3 (Party Copilot, Promoter Copilot, magic event import, automatic narratives and semantic search). Only the provider the Makineo team has configured and enabled at a given time is used, always after filtering the text to remove emails, phone numbers and ID numbers. Semantic search always uses OpenAI, the only provider that builds the search index
• — Resend as a data processor, to send transactional emails (verification, password reset, notices) and the newsletter
• — Google (sign in with Google) if you register or log in with your Google account, Google provides us your email, name and profile picture to create or identify your account

When the processor is outside the European Economic Area, we apply the safeguards GDPR requires for international transfers: the EU-U.S. Data Privacy Framework where the provider is certified, or Standard Contractual Clauses approved by the European Commission otherwise. You can ask us for the detail of the safeguard applied to each provider by writing to hola@makineo.es.

7. Your Rights

Under the GDPR and the LOPDGDD (Organic Law 3/2018), you have the right to:

• — Access: find out what data we hold about you
• — Rectification: correct inaccurate data
• — Erasure: request the deletion of your data
• — Portability: receive your data in a structured format
• — Objection and restriction: object to certain processing activities or request that they be restricted
• — Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out prior to withdrawal

For access and portability you can download a copy of your data yourself from Settings → Account → Your data. To exercise any of these rights, write to us at hola@makineo.es. You may also file a complaint with the Spanish Data Protection Agency (AEPD).

7. Consent Records (GDPR Art. 7)

We record explicit consents in the user_consents table to comply with GDPR Art. 7. Each consent record includes:

• — Type of consent (terms, privacy, analytics, marketing)
• — Accepted/rejected
• — Exact date and time of the decision
• — Client IP address (for audit purposes)
• — User-Agent (browser used)

You may withdraw your consent at any time. See Section 7 (Your Rights).

8. Cookies

Makineo uses its own cookies that are strictly necessary for the operation of the session. Google Analytics analytics cookies are only activated with your prior consent (requested when you first access the site). We do not use advertising or profiling cookies.

You can change your decision about analytics cookies at any time from the «Cookies» link in the footer, or delete them from your browser settings.

9. Security

We apply appropriate technical and organizational measures to protect your data: password encryption with bcrypt, communications over HTTPS, restricted access to personal data, and servers located within the European Union.

Ticket payments are processed through Stripe, a PCI DSS Level 1 certified provider. Makineo never receives or stores your card details.

10. Changes to This Policy

We may update this policy to reflect legal or service changes. We will notify you of any material changes by email or through a notice on the platform. The date of the last update appears at the top of this document.