RIDEST

Privacy Policy

Last updated: 26 October 2026

1. Who is responsible

Controller under Art. 4 (7) GDPR is Nico Mutert, Blankenburger Straße 10, 49565 Bramsche, Germany (sole trader). Email: nico.mutert@gmail.com. Further details are in the Imprint.

We have not appointed a data protection officer because we are not legally required to. Please send questions about data protection to the email address above.

2. What this site is

RIDEST is a platform for Artists, Managers/Bookers and Events: Artist profiles, public press kits, a booking calendar, booking requests, contacts, file uploads and notifications. The data below is processed to provide exactly these functions.

3. Data we process, purposes and legal bases

  • Visiting the site (server log data). IP address, date and time, requested page, browser and device type. Needed to deliver and secure the site. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, working site). The hosting provider keeps these logs for a short time only (at most 30 days).
  • Account. Email address, password (stored only as a hash), account type, name, sign-in times, optional two-factor authentication data. Needed to create and run your account. Legal basis: Art. 6 (1) (b) GDPR (contract).
  • Sign-up check of the email address. When you sign up, our server checks whether the email domain can receive mail (a DNS lookup). Nothing is sent to your address by this check. Legal basis: Art. 6 (1) (f) GDPR (avoiding fake sign-ups and bounced mail).
  • Profile, press kit, calendar, booking requests, contacts, files. Everything you enter or upload, such as Artist name, texts, photos, music links, riders, contracts, calendar entries, requests and messages. Legal basis: Art. 6 (1) (b) GDPR. You decide what is public: a press kit marked public can be seen by everyone, including search engines; everything else is visible only to you and the people you invited.
  • Data of other people. If you enter or upload data of third parties (e.g. contact persons, guest lists), you must be allowed to do so. See also the confirmation shown before every upload and our Terms of Use.
  • Notifications and emails. We create in-app notifications (e.g. new requests, press kit views). Service emails (confirmation, password reset) are sent through our authentication provider Supabase (see section 5). Legal basis: Art. 6 (1) (b) GDPR.
  • Contact and support forms. Name, email address, title and message that you enter, plus a salted hash of your IP address (not the address itself) that we use only to stop floods of messages. We use the data to answer you. Legal basis: Art. 6 (1) (b) GDPR if your request concerns a contract or account, otherwise Art. 6 (1) (f) GDPR (answering inquiries). Messages are visible only to the operator and are deleted once the matter is settled, at the latest after 12 months unless legal retention duties apply.
  • Spam protection (Cloudflare Turnstile). The contact and support forms are protected by Cloudflare Turnstile (Cloudflare, Inc., USA, and its EU entities). When the form is shown, your browser loads the check from Cloudflare, and Cloudflare receives your IP address and technical browser data to tell people from bots. Legal basis: Art. 6 (1) (f) GDPR (protecting the site from abuse and overload). The check is only loaded on these two pages.
  • Feedback, error reports and feature requests. What you write in these forms and technical details that help us find the problem. Legal basis: Art. 6 (1) (f) GDPR (improving and repairing the service).
  • Press kit view counter. We count views of public press kits so Artists see how often theirs was opened. The count is stored with a random browser ID, only if you allowed it in the cookie banner; without consent all such visits are counted together without any ID. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). You can withdraw consent at any time under "Privacy settings" in the footer.
  • Brand fonts (Adobe Fonts). If you allow it in the cookie banner, your browser loads our fonts from Adobe (Adobe Systems Software Ireland Ltd., Ireland / Adobe Inc., USA). Adobe then receives your IP address and technical browser data. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). Without consent no connection to Adobe is made and standard fonts are shown.
  • Map in calendar entries. If you add an address to a calendar entry, you can show a map of it. The map is not loaded automatically: only after you click "Load map" your browser connects to Google (Google Ireland Ltd., Ireland / Google LLC, USA) and Google receives your IP address, the address you entered and technical browser data. Without your click no connection to Google is made. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent given by the click). Links to Google Maps or Apple Maps are ordinary links: data is only sent to them if you open them.
  • Payments (planned). During the Closed Alpha no paid plans exist and no payment data is processed. Before paid plans start, we will name the payment provider and the data processed (name, billing address, payment data, invoices) here. Legal basis then: Art. 6 (1) (b) and (c) GDPR (contract; retention duties under tax and commercial law, usually 8-10 years for invoices).

4. Cookies and local storage

RIDEST stores the following in your browser:

  • Necessary (no consent needed, § 25 (2) No. 2 TDDDG): login session and security tokens of our authentication provider; your cookie choice ("ridest-consent"); small convenience flags such as a closed banner or a postponed two-factor reminder; the time of your last feedback prompt.
  • Optional (only with consent): visit counter ID ("ridest-visitor"); loading Adobe Fonts; loading a Google map after you click "Load map" (nothing is stored in your browser by us for this).

We do not use advertising or tracking cookies and no analytics tools.

5. Who receives your data (processors and recipients)

  • Supabase (Supabase Inc., USA, and Supabase Pte. Ltd., Singapore: database, login, file storage and sending of service emails). Our data is stored in the EU (Frankfurt, Germany). Supabase acts as our processor under a data processing agreement (Art. 28 GDPR) that is part of its terms of service. Supabase uses sub-processors, for example for hosting; the current list is published at supabase.com/legal/customer-resources/subprocessor-list. Support or technical access from outside the EU is covered by the standard contractual clauses (module 2, controller to processor) that are part of that agreement.
  • Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (web hosting and delivery of the site). Vercel is our processor under its data processing addendum (Art. 28 GDPR); its main processing facilities are in the USA and it uses sub-processors (list at security.vercel.com). For data about our own Vercel account and for service usage data Vercel is itself responsible. Transfer to the USA is based on the EU-US Data Privacy Framework certification of Vercel and on the standard contractual clauses that are part of the addendum.
  • Google (only if you use "Continue with Google"): Google receives the sign-in request and tells us your verified email address and name. Google acts under its own responsibility; see Google's privacy policy.
  • Cloudflare (spam check on the contact and support pages, see above). Transfer to the USA is based on the EU-US Data Privacy Framework and/or standard contractual clauses.
  • Adobe (only with consent, see above).
  • Google (maps, only after your click on "Load map", see above).
  • A payment provider will be added here before paid plans start.
  • Other users: people you invite or share with (Artists, Managers, Events) see the data you released to them.

We do not sell personal data.

6. Transfers to third countries

Where providers are located in or access data from outside the EU/EEA (e.g. USA, Singapore), the transfer relies on an adequacy decision (EU-US Data Privacy Framework) or on the EU standard contractual clauses (Art. 44 ff. GDPR, module 2), which are part of the processing agreements with Supabase and Vercel. Supabase has published a transfer impact assessment for these transfers. You can request a copy of the safeguards from us at the email address above.

7. How long we keep data

Account data and your content are kept while your account exists. When you delete your account (My Account > Delete my account), your profile data and uploaded files are deleted. Data we must keep for legal reasons (e.g. invoices) stays blocked until the retention period ends. Server logs are deleted after a short period (at most 30 days).

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR), and to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR). Write to nico.mutert@gmail.com. You can edit most data directly in your account and delete the account yourself.

You also have the right to complain to a data protection supervisory authority, for example the authority responsible for your place of residence or for our registered office. The authority responsible for our registered office is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (https://lfd.niedersachsen.de).

9. Security and automated decisions

The connection to RIDEST is encrypted (HTTPS). Passwords are never stored in plain text, and you can protect your account with two-factor authentication. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Changes

We update this policy when the service or the law changes. The date at the top shows the current version.