Privacy Policy

1. Who we are

Agency Assistant is a booking and artist management platform for talent agencies and independent music professionals. This policy explains how we collect, use, and protect your information when you use our services.

The service is operated by Agency Assistant, based in the Netherlands. For privacy questions or requests, contact hello@agency-assistant.app.

We manage information needed to operate accounts, subscriptions, support and platform security. For personal data added to a workspace, the agency or independent artist generally decides why it is processed, and we process it on their behalf. If an agency manages your artist, promoter or staff record, contact that agency about its own use of your information.

2. Information we process

We collect information you provide directly when you create an account or use the platform:

• Account information: name, email address, and profile details provided at sign-up.
• Business data: artist profiles, contact details, bookings, contracts, signatures, invoices, bank and tax details, itineraries, travel arrangements and files you or your workspace provide.
• Communications: messages sent through the platform's messaging features.
• Technical information: request and error logs, device and browser information, security events, IP addresses and delivery or signing records needed to operate and protect the service.
• Connected-service information: the Google Calendar information described in section 5, only if you authorize that connection.

3. How we use your information

• To provide and operate the platform and its features.
• To send transactional emails such as contract notifications, invoice reminders, and account alerts.
• To process payments through our payment provider (Stripe).
• To respond to support requests and communicate with you about the service.
• To detect and prevent fraud, abuse, or security incidents.
• To improve and develop the platform over time.

Where the GDPR applies, we rely on performance of a contract for providing your account and service, legitimate interests for security and reliable operations, legal obligations for required records, and consent where required for optional processing. You can withdraw consent without affecting processing that was lawful before withdrawal. Workspace data is processed under the workspace's instructions and applicable data-processing terms.

4. Data sharing and third parties

We do not sell your personal data. We share information only with service providers who help us operate the platform:

• Authentication: Clerk manages sign-in and account security.
• Email delivery: Resend delivers transactional emails on our behalf.
• Payments: Stripe processes payment transactions. We do not store full payment card details.
• Hosting and infrastructure: the platform runs on Replit's cloud infrastructure.
• Google Calendar: Google receives booking information that you choose to synchronize with your selected calendar.
• AI features: when you use the assistant or document-processing tools, your request and relevant workspace content may be processed by the AI providers used for those features, including OpenAI through our AI integration.

Each provider processes data only as necessary to deliver their service and is subject to their own privacy commitments.

Workspace members, artists, promoters and document recipients may see information according to their access or the links and documents you share. Public or bearer-link content can be accessed by someone who receives that link. We may also disclose information where legally required, to protect rights and security, or as part of a lawful business transfer subject to applicable safeguards.

5. Google Calendar access and use

Connecting Google Calendar is optional. We request access only after you choose to connect your Google account and approve Google's consent screen.

• Calendar selection: we read your calendar list, including calendar identifiers, names and access permissions, so you can choose a calendar you can write to. Google's response can include other calendar-list metadata beyond the information used by the selector. This uses calendar.calendarlist.readonly.
• Event synchronization: we create, update and remove Agency Assistant booking and hold events in the selected calendar. These are all-day events, not timed appointments. Exported information includes all-day start and end dates, booking title, artist, venue, city/country, stage, and fee and currency when present. The current event builder does not send document links. This uses calendar.events.
• Cleanup reads: to find workspace-owned events for cleanup, we request only event identifiers and pagination tokens for non-deleted events in the selected calendar. This includes identifiers of unrelated events, which we filter locally. We do not import unrelated event titles, descriptions, attendees or availability into booking records.
• Background access: stored authorization allows synchronization when booking records change and during periodic background checks, without your browser open, while authorization remains valid.
• Stored connection data: we store encrypted OAuth access and refresh tokens, the selected calendar identifier, event references and synchronization status needed to keep the connection working.
• Purpose limitation: Google Calendar information is used to provide and maintain the calendar features you requested. We do not sell it, use it for advertising, or use it to train generalized AI or machine-learning models.

Choose a suitable calendar and check its sharing permissions. Other people may be able to see exported booking information, including fees and currency, according to the selected calendar's sharing settings.

We do not allow people to read Google user data except with your consent for a specific purpose, where necessary for security or abuse investigations, or where required by applicable law. Service providers may process it only as needed to provide these features under applicable obligations.

Agency Assistant's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deleting Google data

Google Calendar controls are temporarily hidden. This does not delete stored connection data or itself stop an existing authorized sync. When the controls are restored, disconnection attempts to remove events created for that workspace from the currently selected calendar before deleting the stored connection and tokens. If Google cannot be reached or cleanup fails, disconnection can remain pending and require a retry. Removal of legacy events, copies or events on previously selected calendars is not guaranteed. We do not intentionally remove unrelated calendar events.

You can revoke access directly at any time through your Google Account connections. Revocation stops future authorized access but does not itself delete data already stored in Agency Assistant or remove events from Google Calendar. Contact us to request deletion of stored connection information. Disconnecting does not delete the booking records you originally entered into your workspace.

6. Retention and deletion

We retain your data for as long as your account is active or as needed to provide the service. If you close your account, we will delete or anonymise your personal data within a reasonable period, unless we are required to retain it for legal or financial record-keeping purposes.

Retention depends on the record's purpose, workspace instructions, applicable data-processing terms and legal requirements. Invoices, signed documents and security or audit records may need to be retained after other information is deleted. Backup copies may remain until their normal retention cycle ends. You can contact us about deletion, including Google connection data, using the address below.

7. Your rights

Depending on where you are located, you may have rights regarding your personal data, including the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.

To exercise any of these rights, contact us at the email address below. If you are a business using Agency Assistant and require a formal Data Processing Agreement for GDPR compliance, see our Data Processing Agreement.

We may need to verify your identity before handling a request. Some requests must be directed to the agency that controls your workspace record. You may also complain to your local data-protection authority, including the Dutch Autoriteit Persoonsgegevens where applicable.

8. Security

We take reasonable technical and organisational measures to protect your data. All data is transmitted over encrypted connections (TLS). Access to production systems is restricted to authorised personnel. For more detail on our security practices, see our Security page.

No service can guarantee complete security. Keep account access secure, review workspace permissions and share document links only with their intended recipients.

9. Cookies and browser storage

We use cookies and browser storage for sign-in, security, account switching and preferences. Authentication and payment providers may also use technologies needed for their services. We do not use Google Calendar data for advertising. Blocking necessary storage can prevent sign-in or other features from working.

10. International processing

Our service providers may process information outside your country, including outside the European Economic Area. Such processing is subject to applicable data-protection rules. Contact us for information about the providers, processing locations and transfer safeguards relevant to your workspace.

11. Children

The service is intended for professional booking and artist-management work, not for children to use independently. Workspace administrators must have a lawful basis and any required authorization before adding information about a minor. Contact us if you believe information about a child has been provided unlawfully.

12. Changes to this policy

We may update this policy as the service or legal requirements change. We will update the date above and provide additional notice of material changes where required. A policy update does not replace consent where consent is required.

13. Contact

For privacy questions, access or deletion requests, including Google Calendar data, contact hello@agency-assistant.app. Tell us which workspace and request you mean, but do not send passwords, OAuth tokens or other credentials.

See also our Terms of Service.