https://app.backstagebaton.com/assets/PrivacyPage-CN3EDmpX.js

1import{w as s,p as e,L as t}from"./chunk-QUQL4437-BmAooogr.js";const r=s(function(){return e.jsxs("div",{className:"pt-28 pb-20 bg-white",children:[e.jsxs(e.Fragment,{children:[e.jsx("title",{children:"Privacy Policy | Backstage Baton"}),e.jsx("meta",{name:"description",content:"How Backstage Baton collects, uses, and protects personal information, including SMS phone numbers, member data, and sub-processor disclosures."}),e.jsx("link",{rel:"canonical",href:"https://app.backstagebaton.com/privacy"})]}),e.jsxs("div",{className:"max-w-3xl mx-auto px-6",children:[e.jsx("h1",{className:"text-3xl md:text-4xl font-bold text-primary mb-2",children:"Privacy Policy"}),e.jsx("p",{className:"text-gray-500 text-sm mb-10",children:"Effective date: September 14, 2026"}),e.jsxs("div",{className:"space-y-8 text-gray-700 text-sm leading-relaxed",children:[e.jsxs("section",{id:"overview",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Overview"}),e.jsxs("p",{children:['Backstage Baton LLC ("Backstage Baton," "we," "us," or "our") operates a multi-tenant membership management platform at ',e.jsx("a",{href:"https://app.backstagebaton.com",className:"text-accent hover:underline",children:"app.backstagebaton.com"})," ",'for community bands, orchestras, choirs, and ensembles. This Privacy Policy describes how we collect, use, store, share, and protect personal information when you use our website, platform, or SMS notification service (the "Service").']})]}),e.jsxs("section",{id:"our-role",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Our Role: Controller vs. Processor"}),e.jsx("p",{className:"mb-3",children:"Backstage Baton supports the privacy frameworks of the GDPR (EU/UK) and the CCPA/CPRA (California). For purposes of those laws:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsxs("li",{children:["When you submit a demo request, sign up for an account, or pay for a subscription, Backstage Baton is the ",e.jsx("strong",{children:"data controller"})," (GDPR) and ",e.jsx("strong",{children:"business"})," (CCPA/CPRA) for that information."]}),e.jsxs("li",{children:["For the member data a subscribing organization enters into the Service — names, contact details, instruments, ensemble assignments, attendance, photos, and similar fields — the"," ",e.jsx("strong",{children:"subscribing organization is the data controller / business"})," and Backstage Baton acts as a ",e.jsx("strong",{children:"data processor / service provider"}),", processing that data only on the organization's documented instructions and to provide the Service."]})]}),e.jsxs("p",{className:"mt-3",children:["We do ",e.jsx("strong",{children:"not"})," sell or share personal information for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA), and we do not rent personal information."]}),e.jsxs("p",{className:"mt-3",children:["Subscribing organizations may request a Data Processing Addendum (DPA) at"," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"}),". Our DPA covers GDPR Article 28 obligations, CCPA service-provider commitments, sub-processor flow-down, breach notification, and the EU/UK Standard Contractual Clauses where applicable."]})]}),e.jsxs("section",{id:"what-we-collect",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"What We Collect"}),e.jsx("p",{className:"mb-3",children:"We collect the categories of personal information below. We do not knowingly collect Social Security numbers, government ID numbers, biometric identifiers, precise geolocation, or health/medical records through the Service."}),e.jsx("p",{className:"font-semibold mt-4 mb-2",children:"From visitors and demo requesters:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsx("li",{children:"Name"}),e.jsx("li",{children:"Email address"}),e.jsx("li",{children:"Organization name (optional)"}),e.jsx("li",{children:"Organization type (Community Band, Orchestra, Choir, etc.)"}),e.jsx("li",{children:"Organization size"})]}),e.jsx("p",{className:"font-semibold mt-4 mb-2",children:"From organization owners and billing contacts:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsx("li",{children:"Owner name and email"}),e.jsx("li",{children:"Mailing address for the organization (street, city, state, ZIP, county)"}),e.jsx("li",{children:"Stripe-issued customer reference IDs (we do not store credit card numbers; Stripe holds those)"}),e.jsx("li",{children:"Nonprofit EIN, and any documents you send us to verify nonprofit status (such as an IRS determination letter, or a fiscal sponsor's letter and sponsorship agreement), where you apply for the nonprofit discount"}),e.jsx("li",{children:"Records of acceptance of our terms (timestamp, IP address, user agent)"})]}),e.jsx("p",{className:"font-semibold mt-4 mb-2",children:"From platform users (members of subscribing organizations):"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsx("li",{children:"First and last name"}),e.jsx("li",{children:"Email address"}),e.jsx("li",{children:"Phone number (mobile, used for SMS notifications)"}),e.jsx("li",{children:"Mailing address (street, city, state, ZIP, county)"}),e.jsx("li",{children:"Birthday (optional)"}),e.jsx("li",{children:"Instrument(s) and ensemble assignments"}),e.jsx("li",{children:"Member status, member type, and role within the organization"}),e.jsx("li",{children:"Emergency contact name, phone, email, and relationship"}),e.jsx("li",{children:"Parent or guardian (proxy) contact name, email, phone, and relationship — when an organization routes a member's communications to a proxy"}),e.jsx("li",{children:"Attendance records (performances and rehearsals)"}),e.jsx("li",{children:"Profile photo (optional)"}),e.jsx("li",{children:"Payments made to the organization through the platform (dues, donations, and similar): the payer, amount, date, and what the payment was for. Card and bank details are collected by Stripe on the organization's own Stripe account; we never receive or store them."}),e.jsx("li",{children:"Equipment and instrument loans: what was lent, when, its condition and accessories at checkout and at return, and who recorded it"}),e.jsx("li",{children:"Loan agreements: the agreement wording, who signed it (the member, or a parent or guardian for a minor, with their name and email or phone), and when; for agreements signed online, the IP address and browser user agent; for paper agreements, a record that someone in the organization entered the signed paper copy"}),e.jsx("li",{children:"Photos an organization takes of score pages (to record which parts a set of music contains) and of its equipment"}),e.jsx("li",{children:"Private links: the platform emails members unique links that work without logging in (for example to RSVP, report an absence, subscribe a calendar, sign an agreement, or turn on text messages). We record what is done through them — such as an RSVP — and, for calendar links, when a calendar app last checked for updates."}),e.jsx("li",{children:"SMS consent records: the phone number, the date, how consent was given, the wording shown, and the IP address and browser user agent (recorded only after affirmative opt-in)"}),e.jsx("li",{children:"Audit-log snapshots of changes to a member's record (retained for change forensics)"})]}),e.jsxs("p",{className:"mt-3",children:[e.jsx("strong",{children:"CCPA categories."})," For California consumers, the categories above map to: identifiers, contact information, commercial information (subscription plan, billing history, and records of payments members make to their organization), demographic data including age (birthday is collected when provided), internet or other network activity information (limited to access logs), audio/visual information (profile photos), and professional or employment-related information (where a member provides it on their bio). We do not draw inferences from this data for profiling purposes."]})]}),e.jsxs("section",{id:"how-we-use",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"How We Use Your Information"}),e.jsx("p",{children:"We use the information described above to:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1 mt-3",children:[e.jsx("li",{children:"Respond to demo requests and schedule product walkthroughs"}),e.jsx("li",{children:"Operate, secure, and provide the Backstage Baton membership management platform"}),e.jsx("li",{children:"Send SMS notifications on behalf of your organization (rehearsal reminders, schedule changes, performance updates, cancellation notices)"}),e.jsx("li",{children:"Send transactional emails (account setup, password reset, email verification, weekly digest, welcome and onboarding drip, billing notifications)"}),e.jsx("li",{children:"Process subscription payments via Stripe, and payments members make to their organization through that organization's own connected Stripe account"}),e.jsx("li",{children:"Record equipment loans and the agreements signed for them"}),e.jsx("li",{children:"Provide features that read or draft text and images — including reading spreadsheets and documents you import, reading the parts list from a photo of a score page, looking up details about a piece of music, suggesting programs, checking a new member against your roster for likely duplicates, drafting messages, the weekly update, and grant reports, and, on plans that include it, answering members' questions sent by text or email — by sending the inputs each feature needs to Anthropic"}),e.jsx("li",{children:"Maintain an audit trail of changes for security and operational forensics"}),e.jsx("li",{children:"Improve the Service based on aggregate usage patterns"}),e.jsx("li",{children:"Comply with legal obligations, enforce our Terms, and protect our rights and the rights of others"})]}),e.jsx("p",{className:"mt-3 font-semibold",children:"We will not sell, rent, or share your personal information with third parties for their own marketing purposes."}),e.jsx("p",{className:"font-semibold mt-4 mb-2",children:"Legal bases for processing (GDPR):"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Performance of a contract"})," — operating the Service for organizations that subscribe, processing payments and renewals."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Legitimate interests"})," — securing the Service, preventing abuse, responding to demo requests, improving the product, and protecting our rights."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Consent"})," — SMS notifications (sent only after a member's affirmative opt-in). You may withdraw SMS consent at any time."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Legal obligation"})," — tax and accounting records, response to lawful requests, compliance with privacy laws."]})]})]}),e.jsxs("section",{id:"sms-messaging",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"SMS Messaging & Phone Numbers"}),e.jsx("p",{className:"mb-3",children:"Backstage Baton sends SMS text messages to organization members on behalf of subscribing organizations. These messages include rehearsal reminders, schedule changes, performance updates, cancellation notices, and other time-sensitive organization communications."}),e.jsx("p",{className:"font-semibold mb-2",children:"Consent:"}),e.jsxs("p",{className:"mb-3",children:["SMS notifications are ",e.jsx("strong",{children:"off by default"}),'. Members opt in themselves, either by tapping a private consent link in an email from their organization (no login needed) or by turning on text messages in Notification Preferences in the app. Either way, they first see a consent disclosure that includes message frequency, STOP/HELP instructions, and "Msg & data rates may apply." Consent is recorded server-side with the date, how it was given, the wording shown, the IP address, and the browser user agent. See'," ",e.jsx(t,{to:"/sms",className:"text-accent hover:underline",children:"our SMS program page"})," for the full A2P 10DLC disclosure shown at opt-in."]}

1),e.jsx("p",{className:"font-semibold mb-2",children:"Opt-out:"}),e.jsxs("p",{className:"mb-3",children:["You may opt out of SMS messages at any time by replying ",e.jsx("strong",{children:"STOP"})," to any message. You may also disable SMS notifications in your account settings, or contact your organization administrator to update your preferences."]}),e.jsx("p",{className:"font-semibold mb-2",children:"Help:"}),e.jsxs("p",{className:"mb-3",children:["Reply ",e.jsx("strong",{children:"HELP"})," to any SMS message for support information, or email ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"}),"."]}),e.jsx("p",{className:"font-semibold mb-2",children:"Message frequency & rates:"}),e.jsx("p",{children:"Message frequency varies based on your organization's activity (typically about 2–8 messages per month). Backstage Baton does not charge for SMS messages, but your mobile carrier's standard messaging rates apply."})]}),e.jsxs("section",{id:"third-party-services",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Sub-processors & Third-Party Services"}),e.jsx("p",{className:"mb-3",children:"We engage the following sub-processors to deliver the Service. Each processes personal data only as needed to provide its function and under contractual confidentiality and security obligations. All current processing occurs in the United States, except where a different location is noted below."}),e.jsxs("ul",{className:"list-disc pl-6 space-y-2",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Amazon Web Services (AWS)"})," — cloud hosting, database, file storage, container registry, logging. The primary store of record for all Customer Data. See"," ",e.jsx("a",{href:"https://aws.amazon.com/privacy/",target:"_blank",rel:"noopener noreferrer",className:"text-accent hover:underline",children:"AWS's Privacy Notice"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Twilio"})," — SMS message delivery. Twilio processes phone numbers and message content solely to deliver text messages on behalf of your organization. See"," ",e.jsx("a",{href:"https://www.twilio.com/en-us/legal/privacy",target:"_blank",rel:"noopener noreferrer",className:"text-accent hover:underline",children:"Twilio's Privacy Notice"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Twilio SendGrid"}

1)," — transactional and notification email delivery, including the inbound parse webhook used to capture weekly-digest reply text from leadership. Processes recipient names, email addresses, and message content."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Stripe"})," — subscription billing and payment processing, and payments members make to their organization through the organization's own connected Stripe account. Stripe processes billing contact information and payment-method data directly; we do not store card or bank numbers. See"," ",e.jsx("a",{href:"https://stripe.com/privacy",target:"_blank",rel:"noopener noreferrer",className:"text-accent hover:underline",children:"Stripe's Privacy Notice"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Anthropic"})," — features that read or draft text and images, such as importing files, reading photos of score pages, looking up music, suggesting programs, and drafting messages and the weekly update (see How We Use Your Information for the full list). Under Anthropic's commercial/API terms, inputs submitted via the API are ",e.jsx("strong",{children:"not used to train Anthropic's models"}),", and we limit inputs to what each feature requires. See"," ",e.jsx("a",{href:"https://www.anthropic.com/privacy",target:"_blank",rel:"noopener noreferrer",className:"text-accent hover:underline",children:"Anthropic's Privacy Notice"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Crisp IM SAS"})," — the in-app support chat shown to organization administrators. Processes the administrator's name, email, organization, plan, role, and the messages exchanged with our support team. The chat is not shown to rank-and-file members. Crisp processes this data in France (European Union). See"," ",e.jsx("a",{href:"https://crisp.chat/en/privacy/",target:"_blank",rel:"noopener noreferrer",className:"text-accent hover:underline",children:"Crisp's Privacy Policy"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Cloudflare"})," — bot defense on the public sign-up form (Turnstile). Processes the IP address and browser signals of sign-up-page visitors solely to distinguish humans from automated abuse. Turnstile does not use this data for advertising and does not fingerprint users across sites. See"," ",e.jsx("a",{href:"https://www.cloudflare.com/turnstile-privacy-policy/",target:"_blank",rel:"noopener noreferrer",className:"text-accent hover:underline",children:"Cloudflare's Turnstile Privacy Policy"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Plausible Analytics"}),` — visit counts on our marketing website and the platform. Plausible does not use cookies. It receives the page address, the referring page, browser and device type, and the visitor's IP address, which it uses only to count unique visits and does not store. Private link codes (such as those in invitation, attendance, audience-counter, RSVP, and calendar links, and similar links that work without logging in) are removed from page addresses before they are sent. Plausible also records two anonymous events that contain no personal data: "Demo requested" (when our demo request form is accepted) and "Signup" (when a band finishes signing up). Plausible processes this data in the European Union. See`," ",e.jsx("a",{href:"https://plausible.io/data-policy",target:"_blank",rel:"noopener noreferrer",className:"text-accent hover:underline",children:"Plausible's data policy"}),"."]})]}),e.jsxs("p",{className:"mt-3",children:["A current list of sub-processors is maintained at"," ",e.jsx(t,{to:"/sub-processors",className:"text-accent hover:underline",children:"/sub-processors"}),"."]}),e.jsxs("p",{className:"mt-3",children:[e.jsx("strong",{children:"Notice of sub-processor changes."})," Before we add a new sub-processor that processes member personal data, we will update the sub-processors page and aim to notify organization owners and administrators at least ",e.jsx("strong",{children:"30 days"})," in advance. Customers on enterprise contracts may object on reasonable data-protection grounds; the parties will work in good faith to address the objection. To subscribe to sub-processor change notices, email"," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"}),"."]}),e.jsx("p",{className:"mt-3",children:"We do not share your personal information with any third parties for their marketing purposes."})]}),e.jsxs("section",{id:"cookies",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Cookies & Analytics"}),e.jsxs("p",{children:["Our marketing website and the platform use ",e.jsx("strong",{children:"Plausible Analytics"})," to count visits without cookies (see Sub-processors above). Our marketing website does not use advertising trackers or marketing cookies. The Backstage Baton platform uses HTTP-only session cookies (a short-lived JWT access token and a longer-lived refresh token) solely for authentication. If we add other analytics or marketing tracking, we will update this policy and, where required, provide a consent mechanism."]})]}),e.jsxs("section",{id:"data-retention",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Data Retention"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Demo request information"})," — retained for up to 12 months after your inquiry, then deleted or anonymized."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Customer Data"}

1)," — retained while your organization's account is open."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"When a member is removed"})," — removing a member from your roster hides their record and turns off their sign-in, but does not erase it: the record, and history such as attendance, stays in your organization's account until the account itself is permanently deleted. To have a removed member's record erased sooner, the organization — or the member, through the organization or at [email protected] — can ask us, and we will delete it subject to the exceptions below."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"When a subscription ends or an account closes"})," — canceling a subscription does not by itself delete anything. An account closed at the organization's request is kept for ",e.jsx("strong",{children:"90 days"}),", so it can be restored or exported, and then permanently deleted. When a free trial or a subscription ends without a paid plan in place, the account becomes read-only; if nobody from the organization signs in for 60 days, we email the owner a 30-day deletion notice, and if nobody signs in during that time the account is closed and permanently deleted 30 days later. CSV export is available on all plans at any time. We remind the owner to export when a subscription is canceled, email the export when an account is closed at the owner's request, and email it again seven days before permanent deletion. These periods are subject to the narrow exceptions below."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Session tokens"})," — signed-in sessions are ended ",e.jsx("strong",{children:"when an account is closed"}),", not at permanent deletion."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Our billing, invoice, and tax records"})," — retained for the period required by applicable tax, accounting, and consumer-protection law (typically up to 7 years in the United States), regardless of when your Customer Data is deleted. ",e.jsx("strong",{children:"This covers our transactions with your organization, not dues or fees your members pay to you"})," — where you collect money through the platform your organization is the merchant of record, so those records are yours and are deleted with the rest of your Customer Data."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Audit log entries"})," — retained for the duration of the organization's account, then deleted with the rest of your Customer Data when your account is permanently deleted. May contain historical snapshots of personal data, including IP addresses, for change forensics."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"SMS consent records"})," — where we have sent text messages to a member's phone number, we retain the record of that member's consent for ",e.jsx("strong",{children:"four years from the last message sent to that number"}),". That is the period during which a claim about those messages could be brought, and the consent record is our evidence that the messages were permitted. A consent record for a number we never messaged is deleted with your Customer Data when your account is permanently deleted. Retained records contain the phone number, the date and method of consent, the wording agreed to, and the IP address it was recorded from; they are used for no other purpose."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Anonymized product and business records"})," — aggregate product feedback and internal account-health metrics are kept after deletion with personal identifiers removed. No names, email addresses, or member records."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Backups"})," — daily encrypted database snapshots with a rolling 7-day retention."]})]})]}),e.jsxs("section",{id:"data-security",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Data Security"}),e.jsx("p",{className:"mb-3",children:"We implement industry-standard security measures, including:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsx("li",{children:"Encryption in transit (TLS 1.2 or higher) and at rest for the database and object storage"}),e.jsx("li",{children:"Hashed passwords (bcrypt) and short-lived JWT access tokens with HTTP-only refresh cookies"}),e.jsx("li",{children:"Role-based access control (RBAC) and enforced multi-tenant isolation — every request is bound to the authenticated organization's data"}),e.jsx("li",{children:"Rate limiting and anti-abuse controls on public and authentication endpoints"}),e.jsx("li",{children:"Least-privilege access for personnel and contractors"}

1),e.jsx("li",{children:"AWS infrastructure with provider physical, network, and availability controls"}),e.jsx("li",{children:"Logging and monitoring, including request timing and slow-query monitoring"}),e.jsx("li",{children:"Automated tests, including cross-tenant isolation tests"})]}),e.jsx("p",{className:"mt-3",children:"No system is perfectly secure. We work to mitigate risk and to respond promptly to any incident that affects your data. Our DPA describes our breach-notification commitments to organization customers."})]}),e.jsxs("section",{id:"childrens-privacy",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Children's Privacy"}),e.jsx("p",{className:"mb-3",children:"Backstage Baton is a tool that organizations — including youth, school, and community ensembles — use to manage their members, some of whom may be minors. The Service is not directed to children, we do not knowingly collect personal information directly from children through our marketing website, and the platform is intended for use by an organization's administrators rather than directly by children."}),e.jsxs("p",{className:"mb-3",children:["When a subscribing organization is a school or youth ensemble, that organization is the operator responsible for the member information it enters and for obtaining any consent required by law before adding a member's information — including ",e.jsx("strong",{children:"verifiable parental or guardian consent for children under 13"})," under the Children's Online Privacy Protection Act (COPPA), and any consent required by state law or by FERPA where the organization is an educational institution. Backstage Baton processes that information only on the organization's behalf."]}),e.jsx("p",{className:"mb-3",children:`To support youth ensembles, the platform lets an organization route a member's communications to a parent or guardian (a "communication proxy") instead of contacting the member directly. Proxy contact details are treated as sensitive and are visible only to organization leadership.`}),e.jsxs("p",{children:["If you are a parent or guardian and believe a child's information has been provided to us without appropriate consent, or you would like that information reviewed or removed, contact us at"," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"}),". We will work with you and the relevant organization to address your request promptly."]})]}),e.jsxs("section",{id:"your-rights",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Your Rights"}),e.jsx("p",{className:"mb-3",children:"Subject to applicable law, you have the following rights with respect to personal information about you:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Right to know / access"})," — request a copy of the personal data we hold about you."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Right to rectification"})," — request correction of inaccurate or incomplete data."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Right to deletion / erasure"})," — request that we delete personal data about you, subject to retention required for legal, tax, or accounting compliance."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Right to data portability"})," — request a portable copy of your data (CSV export is available in-app)."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Right to restrict or object"})," — under the GDPR."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Right to opt out of SMS"})," — at any time by replying STOP or updating your account settings."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Right to non-discrimination"})," — under the CCPA/CPRA, we will not discriminate against you for exercising these rights."]})]}),e.jsxs("p",{className:"mt-3",children:[e.jsx("strong",{children:"How to exercise."})," Email"," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"})," ","from the address on file, or contact your organization's administrator for member-level data. We will respond within ",e.jsx("strong",{children:"30 days"})," (or as required by applicable law — for example, the CCPA's 45-day window, extendable by 45 additional days when reasonably necessary). We may need to verify your identity. Under the CCPA/CPRA you may use an authorized agent (we will require written authorization). If you are a member of a subscribing organization, your data is controlled by that organization and we will forward your request to them where appropriate."]}),e.jsxs("p",{className:"mt-3",children:[e.jsx("strong",{children:"GDPR — right to lodge a complaint."})," If you are in the EU, UK, or Switzerland, you have the right to lodge a complaint with your local supervisory authority."]})]}),e.jsxs("section",{id:"international-transfers",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"International Data Transfers"}),e.jsx("p",{children:"Backstage Baton is based in the United States and processes data in the United States on AWS infrastru

1cture. Two sub-processors process data in the European Union: Crisp (the support chat shown to organization administrators) and Plausible (visit counts). If you are located outside the United States, your information will be transferred to and processed in the United States, which may have data-protection laws different from those in your jurisdiction. For transfers from the European Economic Area, the United Kingdom, or Switzerland, our DPA incorporates the relevant Standard Contractual Clauses by reference and the parties will complete the required annexes at execution."})]}),e.jsxs("section",{id:"contact-sharing",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Member Contact-Sharing within an Organization"}),e.jsx("p",{children:`Inside the platform, organizations can choose how members' email addresses and phone numbers are shared with their band peers. The default is configurable per organization and per channel ("all band" / "section only" / "private"), and each member may override the default for their own email and phone in their account settings. Organization administrators always see member contact information; section leaders always see contact information for the members in their section. Sharing preferences do not affect the obligations in this Privacy Policy.`})]}),e.jsxs("section",{id:"governing-law",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Governing Law"}),e.jsx("p",{children:"This Privacy Policy is governed by and construed in accordance with the laws of the State of Colorado, United States."})]}),e.jsxs("section",{id:"changes",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Changes to This Policy"}),e.jsx("p",{children:"We may update this Privacy Policy from time to time. If we make significant changes, we will post the updated policy on this page with a revised effective date and, for material changes that affect your rights, notify organization owners by email. Continued use of the Service after the effective date of an update constitutes acceptance."})]}),e.jsxs("section",{id:"contact",children:[e.jsx("h2",{className:"text-lg font-bold text-primary mb-3",children:"Contact Us"}),e.jsxs("p",{children:["Privacy questions and rights requests:"," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"}),e.jsx("br",{}),"Legal and DPA requests:"," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"}),e.jsx("br",{}),"General support:"," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-accent hover:underline",children:"[email protected]"})]}),e.jsx("p",{className:"mt-3 text-gray-500 text-xs",children:"Backstage Baton LLC · Highlands Ranch, CO, United States · EIN 41-4595541"})]})]}),e.jsx("div",{className:"mt-12 pt-8 border-t border-gray-200",children:e.jsx(t,{to:"/",className:"text-accent hover:underline text-sm",children:"← Back to home"})})]})]})});export{r as default};