Effective July 1, 2026

Privacy Policy: Small Venue Music LLC

1. Information We Collect

To facilitate bookings between Performers and Venues, Small Venue Music LLC ("the Company") collects information that identifies you and describes your professional offerings or physical space.

Authentication & Legal Compliance: We use social sign-in via Apple and Google to collect your name and verified email address. If you provide an alternate email address, we store it and track its verification status. For legal accountability, we also record the timestamp and the version of the Terms & Conditions you agreed to at registration, together with the version of the Privacy Policy that was in effect and provided to you at that time. The Terms & Conditions are accepted; the Privacy Policy is provided to you as notice (see "Changes to This Privacy Policy" in Section 8). During registration, we transiently process your date of birth solely to confirm you are at least 18 years of age; we do not store this information. When you initiate a change to your registered email address through Account Settings, we send a security notice to your previous email address to alert you that a change was initiated. This use of your previous email address is a security measure to protect your account and does not constitute marketing or any other non-transactional use.
Performer Profile Information: We collect your Act Name, Performer Type, primary contact name, phone number, profile image, and description. We store any social media or streaming URLs you provide (e.g., Spotify, Instagram, YouTube). We also collect your Home Zip Code, which we use to derive and store a city/state label (e.g., "Based in Richmond, VA"), a geographic centroid (latitude/longitude), and a timestamp of when the zip was last updated. The derived city/state label is displayed publicly on your Performer profile; the raw zip code and centroid coordinates are private and used only server-side for proximity and ranking calculations. We collect your self-declared Travel Range (Local, Regional, or Touring), stored as an enumerated value, which is used in the performer ranking and proximity system and is visible on your profile. Both Home Zip Code and Travel Range are editable after registration in Account Settings. The Platform supports only United States zip codes within the fifty (50) states and the District of Columbia; APO/FPO/DPO addresses and zip codes associated with US territories outside this geographic scope are not accepted at registration.
Venue Profile Information: We collect your Venue Name, physical address, primary contact name, phone number, profile image, and description. We require your maximum audience capacity to facilitate accurate marketplace reporting. We also derive and store a geographic centroid (latitude/longitude) from the ZIP code in your registered address at the time of venue registration; this centroid is re-derived and updated whenever you change your address ZIP code through Account Settings. The venue geographic centroid is treated as public business-location information and, unlike the Performer centroid, is not subject to private-data access restrictions.
Marketplace & Booking Activity: We record interest requests, pricing "asks," formal booking offers, multi-date offer bundles, and "Tips Only" confirmation requests. (For a definition of "Tips Only," see the applicable Terms & Conditions.) We maintain a complete history of confirmed, completed, and cancelled shows.
Trust, Reliability & Audience Draw: We collect "Thumbs Up/Down" ratings and feedback comments. We collect venue-reported turnout data and snapshots of venue capacity to calculate public Audience Draw metrics. We also track cancellation timestamps to calculate Show Reliability counts.
Safety & Moderation Data: We collect and store lists of blocked performers created by Venues to restrict specific users from interacting with their booking slots.
Technical Integration Data: If a Performer connects a Google Calendar, we store encrypted OAuth tokens and the ID of the selected calendar to facilitate event syncing.
Pre-Launch Waitlist Data: Prior to platform launch, individuals who join our waitlist via the Small Venue Music website provide the following: email address; role (Venue, Performer, or a signup from a city outside our launch market); name (venue name for Venue signups, act name for Performer signups — not collected from signups outside the launch market); performer type, where applicable; and city/state. We also collect limited technical and attribution metadata at the time of submission: the page on which the form was submitted, the referring URL, and any UTM parameters (utm_source, utm_medium, utm_campaign) present in the visit URL. Waitlist data is used to send launch notifications and waitlist communications when those communications begin, and to measure the aggregate effectiveness of our pre-launch outreach. Waitlist signups who have not created an account may request deletion of their data at any time by contacting us using the information in Section 7. When a waitlist signup later creates a platform account with the same email address, the waitlist record is merged into the new user record. Additionally, applicants who attempt to register for the Platform but whose ZIP-derived geographic centroid falls outside all currently active market areas are not permitted to complete registration. These individuals are offered a "Vote for Your City" capture flow, through which we collect an email address and a city label derived from the submitted ZIP code, used solely to gauge geographic demand for future market expansion. As with waitlist data, individuals who submit a "Vote for Your City" entry and have not created a Platform account may request deletion of this data at any time by contacting us using the information in Section 7.
Security & Abuse Prevention Data: When you submit a form on our website, we transiently process your IP address to detect and prevent spam and abuse. IP addresses are used for rate limiting and bot detection only; they are not stored in our waitlist database or associated with your waitlist record.
Website Analytics Data: We use a self-hosted, privacy-preserving analytics tool to measure aggregate usage of our website (page views, referrers, general traffic patterns). This tool does not set cookies, does not identify individual users, and does not track you across other websites. Our website does not use cookies.
Age Requirement: The platform is intended for users who are at least eighteen (18) years of age. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a user under 18, we will delete that information promptly. If you believe an individual under 18 has created an account on the Platform, please notify us at privacy@smallvenuemusic.com so we can investigate and, if confirmed, remove the account and associated data.

2. How We Use Your Information

We use the data we collect to facilitate live event bookings and maintain the professional integrity of the marketplace.

Marketplace Connectivity: Profile information is used to allow Performers to discover slots and Venues to discover acts.
Booking Workflow: Data is used to process the formal offer system, including multi-date bundles and individual offers.
Trust Metric Generation: Show history and rating data are used to display Approval Ratings, Show Reliability (18-month rolling window), and Audience Draw scores.
Transactional Communications: Contact info is used to send automated in-app and email notifications, show reminders, rating requests, and account security notices (including notifications sent to a previously registered email address when an email address change is initiated).
Venue Business Operations: We use consolidated booking data to generate downloadable Excel calendar exports for Venues to manage schedules externally.
Marketplace Intelligence: We use profile information, marketplace activity (interest requests, offers, confirmed bookings, cancellations, ratings), trust metrics, location data, and other Platform data to operate, train, evaluate, and continually improve automated systems and machine-learning models that power core marketplace features — including search ranking, discovery, performer–venue matching and recommendations, fraud and abuse detection, content moderation, anomaly detection, personalization, customer support, audience-draw and reliability scoring, and product research and development. Location data used for these purposes includes zip-derived geographic centroid coordinates (latitude/longitude) collected at Performer registration and used server-side for proximity calculations and performer ranking; the raw centroid is never displayed publicly. As the Platform evolves, we may also use such data to develop and operate generative features (for example, suggested descriptions, intelligent search, or matching assistants) that run within the Platform. Use of Platform data for AI/ML purposes is further described and bounded in Section 6.

As a two-sided marketplace, we share your data between Performers and Venues to enable successful bookings.

Public Profiles: Public profile information — including act or venue names, profile images, photographs, descriptions, logos, social media URLs, trust metrics, and for Performers, a "Based in [City, State]" location label derived from the Performer's registered Home Zip Code — is visible to other registered users of the Platform for marketplace purposes such as discovery and evaluation. The raw Home Zip Code and geographic centroid coordinates underlying this label are not displayed publicly. Within the Platform, viewing a profile does not by itself grant the viewer the right to download, save, or reuse profile content outside the Platform; such rights, where they exist, are described below and are bounded by the applicable Terms & Conditions.
Post-Booking Contact: Upon confirmation of a booking, we share the primary contact name, email address, and phone number of each party with the other. This data is also provided in automated show reminders.
Venue Use of Performer Content for Show Promotion: When a Venue confirms a booking with a Performer, we extend a sublicense to the Venue to use that Performer's profile image, photographs, biographical description, logo, name, stage name, likeness, and social media URLs (collectively, "Performer Content") solely to promote the confirmed engagement. The scope, duration, and limitations of this sublicense — including a thirty (30) day post-show window for active promotion, an indefinite passive historical archive permitting the Performer's name and a single profile photograph subject to a Performer's right to request removal, prohibitions on AI/ML training and on use to promote unrelated events, and a seven (7) day takedown obligation upon request — are set forth in the Venue Terms & Conditions.
Venue Data Export: Venues may export their booking calendar as an Excel (.xlsx) file. For confirmed or completed bookings, this file includes the Performer's contact details (name, phone, and email). Once exported, the Venue assumes full responsibility for the security and appropriate use of any personal information contained in the file. The Company is not liable for any misuse, unauthorized disclosure, or inadequate protection of Performer data after it has been downloaded by a Venue.
Pre-Account and Out-of-Area Data: Pre-launch waitlist data and "Vote for Your City" submissions collected from out-of-area applicants (as described in Section 1) are not shared with other registered users of the Platform, with Performers or Venues, or with third parties for any commercial purpose. This data is processed only by the Company and its service providers acting strictly on the Company's behalf, and is used solely for launch notification and geographic demand assessment.
Service Providers: We may share your information with third-party service providers who perform services on our behalf, including cloud hosting, database infrastructure, and email delivery. These providers are contractually obligated to use your data only as necessary to perform their services and to maintain appropriate security measures.
Third-Party AI and Machine-Learning Providers: Some Platform features rely on third-party AI service providers (such as large language model APIs, computer vision APIs, or speech-to-text services). When we use these services, your User Content or activity data may be transmitted to the provider solely to deliver the requested feature. We contractually require these providers not to use your data to train their general-purpose models and to retain it only as needed to deliver the service. We do not sell, license, or otherwise make Platform data available to third parties for the purpose of training their AI or machine-learning models; this commitment is further described in Section 6.
Legal Requirements: We may disclose your information if required by law or to protect the integrity of the marketplace, in accordance with the laws of the Commonwealth of Virginia.
International Data Transfers: The Platform and our service providers process personal data in the United States. If you access the Platform from outside the United States, your data will be transferred to, stored, and processed in the United States.

4. Your Privacy Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

Right to Access: You may request confirmation of whether we are processing your personal data and obtain a copy of the specific information we hold about you.
Right to Correct: You may request that we correct inaccuracies in your personal data. You can also update most of your profile information directly within the app. Performers may update their Home Zip Code and Travel Range at any time through Account Settings; updating a Home Zip Code causes the derived city/state label and centroid coordinates to be recalculated and replaced.
Right to Delete: You may request the deletion of your personal data. You can also permanently delete your account at any time through the app, which will remove your personal profile information and contact details, including your Home Zip Code, derived city/state label, centroid coordinates, and Travel Range.
Right to Request Removal from Third Parties (Performers): In addition to the Platform-side deletion rights described above, if you are a Performer you may request that a Venue cease use of your Performer Content (such as your profile image, photographs, biographical description, logo, name, likeness, or social media URLs) where the Venue obtained that content through a confirmed booking on the Platform. Venues are contractually obligated to comply with such requests as soon as commercially reasonable, and in any event within seven (7) days of receipt, subject to a limited carve-out for materials already physically printed or distributed at the time of the request. To submit a takedown request, contact us using the information in Section 7 or use any in-Platform takedown function we make available.
Right to Data Portability: You may request a copy of your personal data in a portable, readily usable format.
Right to Opt-Out of Sale or Sharing: The Company does not sell or share your personal information for cross-context behavioral advertising, and we do not engage in targeted advertising that would require an opt-out right under California's CPRA, Virginia's VCDPA, or Colorado's CPA. If this practice ever changes, we will update this policy and provide a clear opt-out mechanism before any such processing begins.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights, including by denying services, charging different prices, or providing a different level of service.
Right to Appeal: If we decline a privacy request, you may appeal our decision by contacting us at the address listed in Section 7. We will respond to your appeal within 60 days.
Automated Decision-Making: We use automated systems and machine-learning models to operate marketplace features such as search ranking, recommendations, fraud and abuse detection, content moderation, and trust scoring. These systems do not produce decisions that have legal or similarly significant effects on you. If an automated process restricts or suspends your access to the Platform, you may request human review by contacting us using the information in Section 7.
How to Submit a Request: To exercise any of these rights, please contact us using the information in Section 7. We will verify your identity and respond to your request within 45 days. If additional time is needed, we will notify you of the extension and the reason for it.

5. Data Retention and Deletion

Account Deletion: You may permanently delete your account at any time. Upon deletion, we remove your personal profile information and contact details. Some deletion steps — including removal of profile images from storage, removal of synced events from third-party services such as Google Calendar, and propagation of deletions through backups and content delivery network caches — are performed on a best-effort basis and may take additional time to complete after the account record itself is removed.
Waitlist Data Retention: Waitlist signup data is retained until the subscriber requests deletion or until the waitlist is closed following full launch of the Platform, whichever occurs first. Signups who have created a Platform account have their waitlist record merged into their account, and the standard Account Deletion rules then apply.
Metric Retention: To maintain marketplace integrity, data regarding confirmed bookings and cancellation timestamps is retained for 18 months to support rolling reliability counts.
Permanence of Ratings: Ratings and comments are generally permanent to maintain marketplace integrity. However, the Company reserves the right to remove content that violates our Terms of Service or Community Guidelines & Code of Conduct. If you delete your account, your feedback for others will remain in an anonymized format.

When you upload content to the Platform — including profile images, photographs, biographical or venue descriptions, logos, and social media URLs (collectively, "User Content") — we process and display that content to operate the marketplace, including showing your profile to other users and including it in marketplace listings, search results, and notifications. The license you grant the Company to use your User Content, the duration of that license, your representations and warranties regarding User Content, and the post-deletion handling of User Content are governed by Section 6 of the Performer Terms & Conditions or Section 7 of the Venue Terms & Conditions, as applicable. Use of your User Content in external marketing of the Platform and other Company Services is separately governed by the Marketing Permissions described below.

Use of Platform Data for AI/ML. As described in Section 2, we use User Content, profile data, and marketplace activity to develop, train, evaluate, and improve internal AI and machine-learning systems that power Platform features. Regardless of the broader User Content license granted in the applicable Terms & Conditions, we commit to the following limits:

We do not sell, license, or otherwise make Platform data available to third parties for the purpose of training their AI or machine-learning models.
We do not develop or deploy models whose principal purpose or foreseeable effect is to reproduce, impersonate, or generate substantially similar versions of an individual Performer's likeness, voice, photographs, or biographical writing for use outside the Platform's marketplace functions.
We do not use sensitive personal information (as defined under applicable state law) for AI/ML training purposes.
Aggregated, de-identified, or pseudonymized data derived from the Platform may be used and shared without restriction, provided we do not attempt to re-identify it.
When you delete your account in accordance with Section 5, your User Content is excluded from future training runs; however, models trained on data prior to deletion may continue to operate.

Opt-Out from AI/ML Training (Performers). Performers who do not want their User Content (such as profile images, photographs, biographical descriptions, and stage name) used to train internal AI/ML models may opt out by contacting us at privacy@smallvenuemusic.com. Opting out does not affect (i) the operation of automated systems that rank, match, or recommend in real time using your data, (ii) use of aggregated or de-identified data, or (iii) use of your data for fraud and abuse detection and other trust and safety purposes. We may, in the future, provide an in-product toggle for this opt-out; until then, email is the supported channel.

Marketing Permissions. In addition to the AI/ML rules above, the Company offers two optional, opt-in marketing permissions during registration and in in-app Settings. Both are off by default and are not required to use the Platform.

Promotional Content Permission. If you turn this on, you authorize the Company to use your User Content — for Performers, including your stage name, band name, logo, photographs, and biographical description; for Venues, including your venue name, logo, photographs, and venue description — in the Company's external marketing of the Platform and other Company Services (for example, our website, social media, paid advertising, press materials, sales and pitch materials, case studies, and partner co-marketing). This permission is royalty-free and worldwide while it is on, and does not by itself authorize use of (i) audio or video recordings of you, your performances, or events at your venue, (ii) AI-generated or materially altered images of you or your venue, or (iii) quotes or testimonials attributed to you or your venue, each of which requires a separate written consent.
Marketing Email Permission. If you turn this on, you agree to receive marketing emails from the Company about new features, tips, events, partner offers, and similar non-transactional content. SMS marketing is not part of the Platform today; if we add it in the future, we will ask you separately and obtain a distinct, TCPA-compliant opt-in for that channel — granting this email permission today does not grant any SMS permission.

Revocation and retention. You can turn either permission off at any time in Settings (and you can opt out of marketing emails using the unsubscribe link in any marketing email we send). Revocation applies prospectively: new uses stop promptly, but materials already printed, distributed, or scheduled for delivery prior to revocation may complete their natural lifecycle. Upon deletion of your account, both permissions terminate immediately for new uses. We retain a record of your permission choices, including version, timestamp, and method of consent, for audit and compliance purposes.

Relationship to other rules. These permissions are separate from, and do not override, the AI/ML limits described elsewhere in this Section 6 or your underlying license to the Company under the applicable Terms & Conditions. We will continue to send transactional and legal communications regardless of the Marketing Email Permission.

7. Contact Information

For questions regarding this policy or to exercise your data rights, please contact us using either of the following:

Email: privacy@smallvenuemusic.com

Postal mail: Small Venue Music LLC 440 Monticello Ave Ste 1802 PMB 445566 Norfolk, Virginia 23510-2670

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will provide notice to each registered user at least fourteen (14) days before the changes take effect, sent to the email address associated with that user's login (and, where practical, also shown as a prominent notice within the Platform). If you are not an active user at the time notice is sent (for example, your account is pending verification or suspended), we will provide the notice when your account next becomes active. Non-material changes (such as clarifications, formatting corrections, or updates to contact details) may take effect upon posting. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision, and the revised Policy governs our handling of your information on and after its stated effective date. We provide Privacy Policy changes to you as notice: we do not ask you to re-accept the Privacy Policy, and we do not rely on your continued use as acceptance of it. The revised Policy simply governs as of its effective date. If you do not agree with the revised Policy, you may stop using the Platform and request account deletion in accordance with Section 5.

9. Governing Law and Dispute Resolution

This Privacy Policy is governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to conflict of law principles.

Any dispute arising out of or relating to this Privacy Policy or the Company's data practices — including claims of unauthorized collection, use, or disclosure of personal information — is subject to the dispute resolution provisions set forth in the applicable Terms & Conditions (Venue or Performer), including the mandatory informal resolution step, binding arbitration agreement, class action waiver, and jurisdiction clause contained in Section 9 of those Terms. The data rights appeal process described in Section 4 of this Privacy Policy applies exclusively to requests to exercise specific statutory privacy rights (access, deletion, correction, portability, and opt-out); it does not replace or limit the dispute resolution process in the Terms & Conditions for broader privacy-related claims.