Privacy Policy — MesaMerch

Last updated: 29 October 2026

Version 2026-10-29-2

→ If a band has entered your contact details

MesaMerch is an app that helps bands sell their merchandise at shows and organise themselves: sales, catalogue, expenses, shows, tours and technical rider. This policy explains what personal data we process, why, where it is kept, who can see it, how long it stays and what rights you have. It also applies if you don't have an account: for example if you are a technician or sound engineer and a band has entered your contact details.

Who is the data controller

The data controller is Andrea Grasso, a private individual who runs MesaMerch.

For any question or request about your data, write to: privacymesamerch@gmail.com. This is the address we answer for every request described below.

What data we process

If you use the app:

• Email address: to log you in with a temporary code. We do not use passwords.
• Display name: the name you choose. It appears next to what you record.
• Band membership: which bands you belong to and your role (member or administrator).
• Sales: product, price, quantity, size, optional note, date and time, who recorded it and the show it may be linked to. Also gifts, corrections and moved stock.
• Catalogue: products, prices, sizes, bundles, with any photos.
• Band accounts: expenses, cash adjustments and fees, with the name of whoever entered them.
• Shows and tours: dates, venues, status and members' replies.
• Unavailability: the days you mark yourself as unavailable, with the reason if you choose to write one. The reason is visible to every band you play in.
• Day sheet: times, venue, accommodation, transport and notes for a show, with the name of whoever filled it in.
• Technical rider: stage plot, input list and crew contacts.
• Invite code attempts: when you try to join a band with a code, we record your account, your IP address, the time and whether the code was right. This is to block anyone trying random codes.

If you don't use the app but a band has entered your data:

• Crew contacts in the rider (name, role, phone, email) and whatever a band writes in the day sheet or in notes (for example the name and number of the person who meets you at the venue).

Technical data: when you open the app, the providers that host it receive your IP address and the technical details of the request (browser, time). These are needed to deliver the page and to protect the service.

We don't ask you for sensitive data: don't write it in notes or in the reason for an unavailability. Remember that the reason is read by the members of every band you play in, not just one: "doctor's appointment" written there is seen by all of them. We don't track your location and we don't use profiling cookies or advertising. The app loads no resources from other sites (no external fonts, analytics or scripts).

Why we use it and on what legal basis

• Account and band data (email, display name, bands, sales, catalogue, accounts, shows, unavailability, day sheet, rider): needed to run the app for you and your band. Basis: performance of the contract with you, i.e. the terms of use you accept when you sign in (GDPR art. 6.1.b).
• Contacts of people without an account (crew, venue contacts): needed by the band to organise the show with the people who work on it. Basis: legitimate interest of the band and ours in organising the work (art. 6.1.f). You can object at any time: see below.
• IP address, technical data and invite code attempts: needed to deliver pages, for security and to prevent abuse, for example someone trying random codes. Basis: legitimate interest in running the service securely (art. 6.1.f).

We don't sell data to anyone and we don't use it for advertising.

Who can see the data

• Members of your band see the band's data: sales with the name of who recorded them, catalogue, accounts, shows, day sheet and the rider with crew contacts. The administrator also manages members.
• Your other bands see when you are busy and, only if you write it yourself, the reason. If you mark yourself unavailable, the members of all your bands see those days and the reason, if you wrote one, but not which band it comes from. If you already have a show with another band, the others only see that you are busy that day, not with whom or where.
• Product photos and logos are public files. Anyone with the exact address of a file can open it, even without an account. Don't upload photos showing people or information you don't want to make public.
• Whoever receives the rider from the band: if the band exports the rider and sends it to a venue or a PA company, that copy leaves MesaMerch and is handled by whoever receives it.
• Andrea Grasso, the controller, has technical access to the database for maintenance and to carry out the requests he receives. He uses it only for these purposes.

Where the data is kept and who helps us

We rely on three providers, which process data on our behalf and only to run the app:

• Supabase (database, login, uploaded files). The data is stored on servers in the European Union. The contracting provider is Supabase Pte. Ltd. (Singapore). Technical support may be provided by Supabase, Inc. (United States), and some technical usage data may be processed outside the EU. These transfers to Singapore and the United States rely on the Standard Contractual Clauses approved by the European Commission.
• Vercel Inc. (United States) hosts the app and receives your IP address when you open it. Vercel is certified under the EU-US Data Privacy Framework and also uses the Standard Contractual Clauses.
• Resend (United States) sends the emails with your login code, so it processes your email address. Resend is certified under the EU-US Data Privacy Framework.

What stays on your phone

To work with poor signal, the app keeps some copies on your phone, in the browser's storage: for example the draft and backup copies of the rider, which may contain crew contacts. Today these copies stay on the phone even after you log out. If the phone passes to someone else, or if you used the app on a device that isn't yours, clear the site data for mesamerch.app in the browser settings.

How long we keep it

• Account and band data: as long as the account and the band remain active.
• Rider: each time it is saved we keep a copy of the previous version, up to the last 20. These copies are not visible or editable from the app: only the controller can see them, and they are used to recover a damaged rider. A contact removed from the rider may therefore remain in these copies until they are replaced by 20 new saves, unless you ask us to remove it (see below).
• Deleted band: when a band is deleted, the database removes the data linked to that band: members, catalogue, sales, accounts, shows, tours, day sheets, the rider and its copies. Uploaded photos and logos may instead remain among the public files. To have them removed, write to privacymesamerch@gmail.com.
• Invite code attempts (with the IP address): two days at most, then they are deleted automatically.
• Technical data: for the time set by the providers for their logs.

If a band has entered your contact details

If you are a technician, sound engineer or anyone else whose contact appears in MesaMerch without you having an account:

• your data is in the database described above, in the European Union;
• it is visible only to the members of the band that entered it and to the controller;
• it stays until the band removes it or is deleted, plus the rider copies described above;
• you can ask us to remove it by writing to privacymesamerch@gmail.com. We remove it from the rider and from the copies saved in our systems. We cannot remove the copies band members have on their phones or files the band has already sent: we notify the band so they can delete them. We reply within one month.

Your rights

Under the EU General Data Protection Regulation (GDPR), whether or not you have an account, you have the right to:

• access: know whether we process your data and receive a copy;
• rectification: correct inaccurate data;
• erasure: ask us to delete your data;
• restriction: ask us to suspend its use;
• portability: receive the data you gave us in a machine-readable format;
• objection: object to processing based on legitimate interest, for example your contact details entered by a band.

To exercise them, write to privacymesamerch@gmail.com. We reply within one month.

To delete your account, write to privacymesamerch@gmail.com from your account's email address, or confirm the request from that address. We delete your email, login and band memberships. The name you used in the band stays on the sales, expenses and adjustments you recorded, because they are part of the band's accounts. If you are the only administrator of a band, we ask you who should take over the role; if you don't reply, we give it to the member who joined first. If you are the last member of a band, deleting your account also deletes the band, its data, its photos and its logos: we tell you beforehand, and we go ahead only after you confirm. We reply within one month.

You also have the right to lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

Minors

MesaMerch is not intended for children under 16. If you are a parent and believe a minor has given us their data, write to us and we will remove it.

Changes to this policy

When we change this policy significantly, we update the date at the top and ask you to accept it again the next time you create or join a band. You can read it again at any time from the Privacy link, on the login screen and on the band selection screen.