circns

Draft, needs review by a lawyer before launch. DRAFT. Not legal advice.

Privacy policy

Status: working draft, 17 October 2026. This policy is not in force until a lawyer has reviewed it and Birdfish BV publishes it as the live policy. It is written for the GDPR. It is not legal advice.

1. Who is the controller

Birdfish BV, a company incorporated in Belgium, is the controller of personal data processed through circns.com.

  • Registered office: [registered office address]
  • Enterprise number (KBO/BCE): [KBO number]
  • Privacy contact: [privacy email]

circns.com is a worldwide platform. This policy is in English. It describes how we process personal data under the EU General Data Protection Regulation (GDPR) and Belgian data-protection law.

circns.com is not a party to bookings or contracts between bookers and artists. We still process personal data in order to run the platform those people use. That is what this policy covers.

2. Accounts: artists and bookers

An account has one role, chosen at sign-up: artist or booker. The role is not changed by the user. Someone who needs both roles has two accounts and two email addresses.

For an account we process the display name, email address, role, country where you give it, and sign-in events. Sign-in is provided by Supabase Auth (for example an email link). We do not ask you to create a password stored by circns.com.

3. Artist profiles, public links and tech riders

For an artist we process the profile and each act or show: name, optional profile type, bio, photos (up to 10 per act), base city and country, references, descriptions, disciplines, formats, settings, optional stage size, an optional tech rider, and video links. A video link may be any web address. YouTube and Vimeo links can be embedded. Other links are shown as links. We do not host video files.

The following are public on purpose when the page is public:

  • the artist website and social links;
  • the tech rider file of a public act or show, which any visitor can view and download.

Other visitors can also see public profile text, photos and references. Account email and phone are not part of the public page.

4. Booker accounts and email confirmation

A booker account is approved when it is created. The email domain does not matter, including free mail, and the country does not matter, including outside the EU. There is no administrator queue for new bookers, and we do not check a company domain or an EU VAT number for this approval.

We still ask the booker to confirm the email address at sign-up, using the confirmation link from Supabase Auth. That confirmation is required before the booker can start a chat or open a contract. A booker who has not confirmed yet can browse and can save shortlists.

5. Chat, email relay and reply-by-email

A conversation is between one booker account and one artist profile. We process the message text, the sender, the time, whether the message came from the website or from email, and the technical identifiers we need to deliver mail and ignore duplicates.

Every message is also emailed to the other party from a circns.com relay address, through Resend. You can reply to that email, and the reply is posted back into the chat. Resend processes the message content and the mail metadata for that delivery and for inbound replies.

The relay address is not your real email. We do not show your real email address on the relay message.

In this version we do not scan or strip contact details that people type into messages, bios or PDFs. Those words are still personal data if you write them, and you should not put private contact details in a public field.

We may also store a block between two accounts, and we may limit new chats to reduce spam.

6. Share my contact details

Phone number and account email are kept in a private contact record. They are not public, and relay addresses are not public.

They are shown to another user only when you tap Share my contact details in a chat. The share reveals your own phone and email to that one counterpart, in that conversation only. It is recorded (who shared, with whom, and when). It does not publish the details and it does not apply to other chats.

In this version a share is not withdrawn. Share only if you are content for that person to keep the details.

A contract between the two parties may also contain legal names, addresses and signatory details. That file is visible only to the two parties and to administrators. It is not a public page.

7. Bookings and DocuSeal

If the parties mark a chat as a booking, we process the booking fields they enter, including a fee and currency. The fee is visible only to the two parties and to administrators. It is not shown on the public profile.

Signing uses DocuSeal, open-source edition, self-hosted by Birdfish BV. We process the contract PDF (the standard template filled from the booking, or a PDF the parties upload), the DocuSeal submission identifier, signing status, the signed PDF and the audit trail. Each party opens their own signing link. The signed copy is stored in private storage and is visible only to the two parties and to administrators.

circns.com is not a party to bookings or contracts between bookers and artists. Hosting the signature does not make Birdfish BV a contracting party.

8. Reports and removal

The Report button on an artist page, an act or show, and a chat sends us the report, who sent it, what it points at, and the reason. Sending a report does not hide the page. Administrators review the content and may then remove it or suspend a profile, an act, a show or an account. Until that decision, the page stays public.

We keep what we need to show how a notice was handled.

9. Technical data and cookies

Hosting, the database and email delivery generate technical data such as IP address, basic device and browser data, and security logs. We use this to run, protect and debug the service.

In this version we use strictly necessary cookies and similar storage so that Supabase Auth can keep you signed in and the service can stay secure.

We also offer Google Analytics 4. The cookie banner asks before any analytics script is loaded. If you reject, the Google Analytics script is not added and analytics cookies are not set. If you accept, the script loads only when this deployment has a measurement id in NEXT_PUBLIC_GA_ID. When that variable is unset, accepting does not load Google Analytics. The choice is stored in a first-party cookie named circns_consent so we can remember it. That choice cookie is how the banner stays dismissed.

Shortlists are private to the booker who made them. We do not show an artist how many bookers shortlisted them.

10. Why we process data

Purpose GDPR legal basis in this draft
Account, profile, chat, shortlist and booking tools Article 6(1)(b), steps toward and performance of the service. While these terms are still a draft, we also rely on Article 6(1)(f), our legitimate interest in building and securing the platform.
Email confirmation for booker chats and contracts Article 6(1)(b), a step before chatting and contracting, and Article 6(1)(f), our legitimate interest in knowing the mailbox belongs to the account.
Share my contact details Article 6(1)(b), because you asked us to pass your own details to that counterpart.
Email relay and reply-by-email through Resend Article 6(1)(b), to deliver the chat.
Analytics after consent Article 6(1)(a), consent given in the cookie banner. Refusing leaves this purpose unused.
Reports, abuse prevention, security and rate limits Article 6(1)(f). Where a notice concerns illegal content, Article 6(1)(c) where a legal duty applies.
Storing signed contracts for the two parties Article 6(1)(b), and Article 6(1)(f) so the parties and we have a record of what was signed.
Legal claims and duties toward authorities Article 6(1)(c), or Article 6(1)(f) to establish or defend a claim.

We do not sell personal data. We do not use circns personal data to train public AI models.

We do not ask for special-category data (for example health, religion or biometric data used to identify you). Please do not put it in a profile, a chat or a file.

This version does not process payments, so we do not collect card numbers or bank details in order to pay a booking.

11. Processors

We use the following processors. A lawyer should confirm each provider's current data-processing terms, location and transfer tool before launch.

Vercel. Hosts and delivers the Next.js application. Vercel, Inc. is based in the United States. Connection and application data may be processed on Vercel's infrastructure, including outside the EEA. The intended safeguard is Vercel's data-processing terms, including Standard Contractual Clauses where personal data leaves the EEA.

Supabase (EU Frankfurt). Database, authentication and file storage for the circns project. The project region is the EU, Frankfurt. Personal data in the database and storage is hosted there. Supabase's contracting entity and its subprocessors (including the cloud operator in Frankfurt) must be confirmed against Supabase's data-processing terms before launch. Supabase staff may access data only as our processor, for example to support the service.

Resend. Transactional email and inbound parsing for the chat relay, including reply-by-email. Message content and email metadata pass through Resend. Resend is based in the United States. The intended safeguard for transfers outside the EEA is Resend's data-processing terms and Standard Contractual Clauses.

DocuSeal (self-hosted). Open-source signing software operated by Birdfish BV, not a DocuSeal cloud subscription in this version. Signing data is processed on infrastructure Birdfish BV controls, intended to be in the EU. The company that rents that server will be a processor once it is chosen. It is not chosen in this draft: [EU hosting provider].

Google (Google Analytics 4). Only after a visitor accepts analytics in the cookie banner, and only when NEXT_PUBLIC_GA_ID is set. Google processes usage data such as pages viewed and a client identifier. Google LLC is based in the United States. The intended safeguard for transfers outside the EEA is Google's data-processing terms and Standard Contractual Clauses. If the measurement id is unset, this processor is not used.

We do not authorise these processors to use circns personal data for their own marketing.

Public pages are visible to visitors. Those visitors are not our processors.

12. Transfers outside the EEA

Supabase data for this project is stored in the EU (Frankfurt). Self-hosted DocuSeal is intended to stay in the EU.

Vercel, Resend and, when analytics is accepted, Google may process personal data in the United States and in other countries. Where that is a transfer out of the European Economic Area, this draft relies on the Standard Contractual Clauses in that provider's data-processing terms, together with any supplementary measures those terms describe. That reliance has to be checked against the terms Birdfish BV actually signs, before launch.

This version does not send VAT numbers to VIES.

13. How long we keep data

The periods below are proposals for a lawyer to fix. They are not final.

  • Account, profile and private contact details: for the life of the account, then deleted or anonymised within a short time after closure, unless a record must be kept.
  • Chat messages: for the life of the accounts in that conversation, then deleted with the account, unless a booking, a dispute or a report means we must keep them longer.
  • Email confirmation: for the life of the booker account, as the record that chats and contracts were unlocked.
  • Bookings, signed contracts and DocuSeal audit trails: for as long as needed to evidence the booking and to meet legal duties. The number of years is for the lawyer to set.
  • Reports: until the matter is closed, plus a limited period so we can show how the notice was handled.
  • Security and hosting logs: no longer than needed to secure and debug the service.

14. Your rights

Where the GDPR applies, you can ask us to:

  • give you access to your personal data;
  • correct it;
  • erase it;
  • restrict how we use it;
  • provide a portable copy of data you gave us, where the basis is contract or consent;
  • object to processing that is based on legitimate interests;
  • withdraw analytics consent by rejecting cookies in the banner, which stops later Analytics loads on that browser.

Email [privacy email]. We may need to confirm that the request comes from you. We aim to answer within one month.

You can also lodge a complaint with the Belgian Data Protection Authority, the Gegevensbeschermingsautoriteit / Autorité de protection des données, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, https://www.gegevensbeschermingsautoriteit.be. If you live or work elsewhere in the EEA, you can complain to the authority in that country.

Closing an account does not by itself erase a signed contract or another record we are required to keep.

15. Security

Access to database rows is limited by row-level security. Contract files sit in private storage. Account email and phone are not rendered on public pages. No method of sending or storing data is perfectly secure. Please use a mailbox you control, and use Share my contact details only when you mean to.

16. Children

The platform is not directed at children, and we do not knowingly create accounts for children. If you believe a child has an account, email [privacy email].

17. Changes

We will update this policy when the processing changes. A lawyer must review it before launch. Until then, treat this page as a draft.

18. Contact

Birdfish BV
[registered office address]
Enterprise number (KBO/BCE): [KBO number]
[privacy email]