Privacy Policy

This Privacy Policy explains what information JamHub collects, why, and how you control it. It is written in plain language and follows the principles of Canada's PIPEDA and Quebec's Law 25.

1. What we collect

Account info — your email, display name, and (optionally) your stage name, city, instruments, genres, and profile media.

Content you create — jams, band listings, messages, and listings you publish as a teacher, studio, or venue.

Technical info — basic device and usage data so we can keep the site working and secure.

Consent choices — whether you opted in to marketing or product-update emails, and the date of that choice, so we can respect and prove your preferences.

2. How we use it

To run JamHub, personalize what you see, help other musicians find you, keep the community safe, and communicate about your account. We do not sell your personal data.

Under Quebec Law 25 we are required to tell you the specific purposes for each collection. The table below summarizes ours:

• Provide the service — creating your account, saving your profile, publishing your listings, sending and receiving messages, running search and match features. Legal basis: performance of our service to you.
• Keep the platform safe — detecting abuse, spam, fraud, and Terms violations; reviewing reports; enforcing suspensions. Legal basis: legitimate interest and legal obligation.
• Account and transactional emails — email verification, password reset, listing approval, safety notifications, receipts. Legal basis: performance of our service and legal obligation.
• Marketing and product updates — occasional emails about new features, tips, or community news. Legal basis: your express opt-in consent under CASL and Law 25. You can withdraw consent at any time.
• Aggregate analytics — anonymized counts (e.g. number of listings per city) used to improve JamHub. Legal basis: legitimate interest; no individual profiling.

3. What's public

Anything you publish on a profile or listing (name, city, instruments, genres, bio, media) is visible to other signed-in members. Your email and payment details are never shown publicly.

4. Payments

Subscription payments are processed by Stripe, a PCI DSS Level 1 certified payment provider. Card numbers, CVCs, and full billing details are handled by Stripe and never touch JamHub servers — we only store a customer reference and the subscription status returned by Stripe.

5. Cookies, local storage, and tracking

JamHub uses a small number of first-party cookies and browser storage entries. We do not run advertising trackers, cross-site trackers, or third-party analytics that profile individual visitors. The categories we use today are:

• Strictly necessary — signed-in session, CSRF protection, and load-balancing cookies set by our hosting and auth providers. Required for the site to function; cannot be turned off.
• Preferences — language (EN/FR), dismissed onboarding tips, and UI settings, stored locally in your browser.
• Third-party sign-in — if you choose Google Sign-In, Google places its own cookies during the sign-in flow under Google's privacy policy.
• Payments — when you visit a Stripe-hosted checkout page, Stripe sets its own cookies for fraud prevention under Stripe's privacy policy.

JamHub honours the browser Do Not Track and Global Privacy Control signals for marketing-style tracking. Because we do not run marketing trackers, there is currently nothing for those signals to disable. If we add analytics or marketing tracking in the future, we will update this page and, where required, ask for your consent first.

6. Sub-processors

We rely on a short list of vetted providers to run JamHub. Each is bound by their own security and privacy commitments and only receives what they need:

• Lovable Cloud / Supabase — application hosting, database, authentication, and file storage.
• Cloudflare — edge network, DNS, and DDoS protection.
• Stripe — subscription payments.
• Resend — transactional and account emails sent from notify.jamhub.ca.
• Google — optional single sign-on for members who choose it.

7. Your rights

You can access, correct, export, or delete your JamHub data at any time from your profile settings, or by emailing privacy@jamhub.ca. We will verify your identity before acting on a request and respond within 30 days.

Under Canadian PIPEDA and Quebec Law 25 you have the right to:

• Know what personal information we hold about you and how it is used.
• Access a copy of that information.
• Correct information that is inaccurate, incomplete, or out of date.
• Receive a portable copy of your account data in a common technical format.
• Withdraw consent for optional processing (such as marketing emails) at any time.
• Ask for your account and content to be deleted.
• Know which sub-processors hold or transfer your data (see Section 6).
• Object to a decision made solely by automated means; see Section 12 below.

If you are not satisfied with how we handled your request, you can file a complaint with the Commission d'accès à l'information du Québec at cai.communications@cai.gouv.qc.ca or 1-888-528-7741, or with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

8. Data retention

We keep your account data while your account is active. When you delete your account from profile settings, your profile, listings, and messages are removed from public view immediately and purged from our primary database within 30 days. Encrypted backups roll off within 30 additional days. We may retain a minimal record longer where required for legal, tax, fraud-prevention, or safety reasons (for example, records tied to a paid invoice or a safety report).

Specific retention windows currently applied:

• Active account data — kept while your account is active.
• Deleted account data — removed from public view immediately; purged from the primary database within 30 days; expired from encrypted backups within a further 30 days.
• Payment and invoice records — retained for 7 years as required by Canadian tax law.
• Safety, moderation, and abuse reports — retained for up to 24 months so we can enforce repeat-offender rules.
• Server and security logs — retained for up to 90 days for security investigations.
• Consent records — retained as long as your account exists so we can prove your opt-in choices under CASL and Law 25.

9. International transfers

Our sub-processors may store or process data in Canada, the United States, or the European Union. Where data leaves Quebec, we rely on the provider's contractual and technical safeguards (including SOC 2 controls and, where applicable, EU Standard Contractual Clauses).

Before we add a new sub-processor that transfers personal information outside Quebec, we assess the destination jurisdiction as required by Law 25 and keep a record of that assessment.

10. Security

The following describes how JamHub is operated today. It is a factual description of current controls, not a certification or audit statement.

Hosting. JamHub runs on managed cloud infrastructure (Lovable Cloud, backed by Supabase and Cloudflare). Our database, auth, storage, and edge runtime are hosted by these providers on their SOC 2 audited platforms; we do not operate our own servers.

Encryption. All traffic between your browser and JamHub is served over HTTPS with TLS 1.2 or higher. Data stored in our database and file storage is encrypted at rest by the hosting provider using AES-256.

Access control. Every table that stores member data is protected by Row-Level Security policies enforced by the database, so a signed-in member can only read or change the rows they are allowed to see (their own profile, their own messages, listings they own, etc.). Public listing fields (name, city, instruments, genres, bio, media) are visible to signed-in members by design; contact details such as phone numbers are only shown when the listing owner opts in.

Authentication. Passwords are hashed by our managed auth provider using industry-standard algorithms and are never stored or transmitted in plain text. New passwords are checked against the Have I Been Pwned breached-password list at signup and reset. Social sign-in (Google) is supported. Multi-factor authentication is not yet available to members and is on the roadmap.

Administrative access. Only a small number of JamHub administrators can access production data, and admin actions on member listings (approvals, claims) are recorded. Third-party sub-processors (hosting, email delivery, payments) receive only the data they need to perform their function.

Backups. The database is backed up daily by the hosting provider with point-in-time recovery available for a rolling window.

Incident response. If we become aware of a security incident affecting your personal information, we will notify affected members without unreasonable delay and, for members in Quebec, notify the Commission d'accès à l'information as required by Law 25.

Reporting a vulnerability. If you believe you have found a security issue, please email security@jamhub.ca with steps to reproduce before disclosing it publicly. We aim to acknowledge reports within two business days.

11. Marketing communications and withdrawing consent

We only send marketing or promotional emails to members who have expressly opted in — either at signup or later from profile settings. Every marketing email includes a one-click unsubscribe link, and you can also turn marketing off in your profile at any time. Withdrawing marketing consent does not stop essential account and transactional emails (see Terms, Section 15).

12. Automated decision-making

JamHub does not use fully automated decisions that produce legal or similarly significant effects on you. Match scores and search rankings are informational aids only — they influence what you see, but human members make the actual decisions to message, book, invite, or approve.

13. Children

JamHub is not for anyone under 18. We do not knowingly collect personal information from people under 18. If you believe a child has created an account, contact privacy@jamhub.ca and we will remove it.

14. Changes to this policy

We update this Privacy Policy as JamHub evolves. The version number and "last updated" date at the top of this page always reflect the current version. Material changes are flagged in-app or by email before they take effect.

15. Privacy officer and contact

JamHub's designated person responsible for the protection of personal information (Law 25) can be reached at privacy@jamhub.ca. General questions about this policy also go to the same address.