Crowdbeats Privacy Policy

• 100% Free & No Subscription Tracking: Crowdbeats is free to use. We do not store or track recurring subscription billing profiles.
• Zero Spyware, Ad Pixels, or Data Sales: We never sell, rent, or trade your personal data, location telemetry, or listening history to data brokers or third parties.
• Ephemeral Location Discovery: Your live stage radar calculates nearby concerts on your local device. We do not maintain a permanent location tracking history.
• Secure Tipping Tokens: Voluntary tips are handled via PCI-DSS Level 1 tokenization with Stripe. We never see or store your raw credit card numbers.
• Full Data Control & Instant PDF Download: Under CCPA and GDPR, you have the right to inspect, download a certified PDF/JSON statement, or permanently delete your account data within 30 days.

Crowdbeats LLC ("Company", "we", "us") is dedicated to protecting the privacy rights of musicians, performers, and fans. This Privacy Policy governs our compliance with the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and the European Union General Data Protection Regulation (EU GDPR). We practice strict data minimization and user transparency.

We collect only essential data needed to deliver free artist discovery and voluntary live tipping:

1. 1
   Free Account Information: Email address, display name, username, and authentication tokens (Google, Apple, or email login) to manage your profile and favorites.
2. 2
   Ephemeral Local Geolocation (Optional): Used in real time solely to display nearby live musicians, bands, and venues on our interactive discovery map. Geolocation calculations are processed locally on your device and are never sold or permanently logged to surveillance databases.
3. 3
   Payment Tokens for Voluntary Tips: Tokenized customer and payment references processed securely via PCI-DSS Level 1 compliant processors (Stripe, Inc., Google Pay). Crowdbeats LLC never receives, handles, or stores raw credit card numbers or banking PINs.
4. 4
   Performance & Interaction Logs: Song requests, live session check-ins, and voluntary tip allocations recorded on our immutable zero-sum ledger.

If you reside in California, you hold explicit statutory rights under the CCPA/CPRA:

• Right to Know & Access: Request full disclosure of the personal data categories collected about you over the preceding 12 months, accessible instantly via your Account Statement PDF.
• Right to Delete: Request permanent erasure of your personal data from all active databases and backup systems.
• Right to Correct: Request correction of inaccurate profile information.
• Right to Opt-Out (Do Not Sell/Share): Crowdbeats LLC DOES NOT SELL OR SHARE PERSONAL INFORMATION, TELEMETRY, OR FINANCIAL DATA TO THIRD PARTIES.
• Right to Limit Sensitive Data: Restrict use of sensitive data (such as precise geolocation) strictly to necessary platform discovery functions.
• Right to Non-Discrimination: You will never receive diminished service or altered terms for exercising your statutory privacy rights.

To submit a CCPA request, email privacy@crowdbeats.ai or visit our Help & Support Center.

For users in the European Union, European Economic Area, or United Kingdom, processing complies with GDPR Articles 15 through 22:

1. 1
   Right of Access (Art. 15): Obtain confirmation and structured copies of personal data processed.
2. 2
   Right to Rectification (Art. 16): Update or correct inaccurate personal records.
3. 3
   Right to Erasure / "Right to be Forgotten" (Art. 17): Request total deletion when data is no longer necessary.
4. 4
   Right to Restriction of Processing (Art. 18): Limit processing during active dispute inquiries.
5. 5
   Right to Data Portability (Art. 20): Export your personal profile and tip history in a standard PDF, CSV, or JSON format.
6. 6
   Right to Object (Art. 21): Object to processing based on legitimate interests.
7. 7
   Automated Decision-Making (Art. 22): Right not to be subject to legal decisions based solely on automated algorithmic processing.

• Data Minimization: We retain personal data only for as long as your free account remains active or as required by law.
• 30-Day Automated Erasure: When you request account deletion, all personal identifiers and profile records are automatically and permanently erased across all database clusters within thirty (30) days.
• Financial Audit Isolation (7-Year IRS Requirement): Records of voluntary tip disbursements required for statutory tax compliance (Internal Revenue Code § 6001 / § 6050W, California FTB) are stored in an encrypted, read-only compliance vault.

WE DO NOT TRACK YOUR BROWSING ACROSS THE WEB, LOG UNNECESSARY IP TELEMETRY, OR INITIALIZE THIRD-PARTY ADVERTISING SCRIPTS.

• Essential session cookies are used solely for user authentication and platform security.
• We honor browser Global Privacy Control (GPC) and "Do Not Track" (DNT) header signals automatically.

• TLS 1.3 Encryption: All communication is secured using high-grade TLS 1.3 encryption with HSTS enforcement.
• AES-256 at Rest: All account credentials and metadata are stored in Google Cloud / Firebase facilities with AES-256 encryption.
• Strict PII Redaction: System logs automatically redact authentication tokens, payment references, and sensitive personal identifiers.

For privacy questions, CCPA/GDPR requests, or certified statement downloads:

Crowdbeats LLC — Privacy Office Attn: Data Protection Officer (DPO) 100 Montgomery St, Suite 1500 San Francisco, CA 94104, United States of America Email: privacy@crowdbeats.ai Compliance Portal: Help & Support Center