Privacy Policy

Who we are

RAVEMANIA, Nicolas Palfi (“Parmo”, “we”) operates the Parmo website at https://parmo.io, the Parmo web app for organizers and the Parmo app for promoters. Our registered address is Tersteegenstraße 15, 40474 Düsseldorf, Deutschland. For everything described here we are the data controller.

Privacy questions, access requests and complaints: privacy@parmo.io. We answer within 30 days.

Parmo connects event organizers with promoters. Organizers publish an event with a brief; promoters post Instagram stories about it themselves; Parmo checks that each story went up and stayed up; the organizer then hands over the reward at the event, in person. No money moves through Parmo. Almost everything below follows from that one loop.

What we collect

We collect only what a described purpose needs. Nothing in this list is bought from a data broker, and nothing is inferred about you beyond what the table says.

• Email address, password · Where it comes from: You, at sign-up · Why we have it: Your account and sign-in. Passwords are stored only as salted hashes; we never see them.
• Name, and for promoters: city, the music genres you like, and when you confirmed you are 18 or older · Where it comes from: You, at sign-up and in your profile · Why we have it: Your profile, identifying you to the organizer of a gig, showing you events in your city, and confirming you are an adult. We do not ask for your birthdate.
• Device location (latitude and longitude), only if you tap “use my location” while setting up the app · Where it comes from: Your device, only after you grant the location permission (while the app is in use; on Android approximate location only) · Why we have it: Setting your city, and telling organizers whether you are within the radius they chose around their venue. You can type a city instead, and declining costs you nothing else.
• Instagram data: your Instagram user id, username, account type and follower count, your live stories while a story day is being checked, and for each story that counts for a gig its Instagram id, posting time, reach and views, plus an access token · Where it comes from: The Instagram API, only after you connect your account, and only for the account you connected · Why we have it: Each item is listed below under “Instagram data”, with the permission it comes from, why we have it, who can see it and how long we keep it.
• Gig records: which events you asked to join, were invited to, accepted or declined, the organizer’s invitation note, the status of each story day, the reward you earned, when it was handed over, your door code, and when and by which team member you were checked in at the door · Where it comes from: Your use of Parmo, and the organizer’s · Why we have it: Running gigs, checking stories, handing over rewards and checking promoters in at the door.
• Organizer data: business name, team members and the email addresses invited to the team, brands (name, logo, Instagram handle, website), events (title, description, venue, city, times, lineup, flyer, story material, captions and mentions, reward), and the ticket files in an event’s ticket vault with the promoter each was given to · Where it comes from: Organizers and their team · Why we have it: Publishing events to promoters and on our website, managing the team, and handing ticket rewards to the promoters who earned them.
• Sign-in sessions: the IP address and the browser or app details of the device you signed in on · Where it comes from: Your device, when you sign in · Why we have it: Keeping you signed in, and spotting sign-ins that are not yours.
• Email we send you: the confirmation link at sign-up, password reset links and invitations to an organizer’s team · Where it comes from: Us · Why we have it: Running your account. We keep no copy and no log of what was sent.
• Request and error logs: IP address, time, the address requested, and browser or app details; and short-lived counters per IP address that limit how many requests can be made · Where it comes from: Your requests to our servers · Why we have it: Keeping the service up, preventing abuse and investigating faults. Not used to build profiles of you.
• Payment data: none · Where it comes from: Nobody: Parmo processes no payments · Why we have it: Rewards on Parmo are guest-list places, free tickets, drinks and VIP access, handed over at the event. Parmo is free and collects no card, bank or payout details.

We do not collect contacts, calendars, health data, photos, microphone or camera input, background location, or any advertising identifier. The Parmo app contains no advertising, analytics or crash-reporting SDK, and sends no push notifications.

Instagram data

Promoters connect a professional (business or creator) Instagram account through Instagram’s own login (Instagram Business Login). Parmo uses two permissions: instagram_business_basic (your profile and your live stories) and instagram_business_manage_insights (the reach and views of a story). Parmo does not publish anything on your account. This is everything we read with them.

• Profile: Instagram user id, username, account type, follower count · Permission: instagram_business_basic · Why: Knowing which account you connected and that it is a professional account, applying an event’s follower minimum and reward levels, and showing organizers who they would work with · Who can see it: You. Organizers of events you ask to join or work, and organizers looking for promoters to invite (username and follower count, never the user id). People at Parmo who run the service, where support or a fault needs it · How long we keep it: Read when you connect, and again each time we renew the access token (roughly every 50 days). Kept until you disconnect, remove Parmo in Instagram, ask Meta to delete your data, or delete your account
• Your live stories: their ids, type, image or video links, thumbnail, link and posting time · Permission: instagram_business_basic · Why: Finding the story you posted for a story day. We check about every 10 minutes during a story day, and when you open the story picker · Who can see it: Only you, in the story picker · How long we keep it: Not stored. Of the story that counts for a gig we keep only what the next row lists
• The story that counts for a gig: its Instagram id, Instagram’s posting time, when we last saw it online, and whether it was verified or why not · Permission: instagram_business_basic · Why: Proving the story went up within the story day and stayed online long enough, and making sure one story counts only once · Who can see it: You, and the organizer of that gig (status and posting time, not the story itself). People at Parmo who run the service · How long we keep it: As long as the gig record exists (see “How long we keep it”). If you disconnect or ask Meta to delete your data, the id of a story that already counted stays with the gig as a bare number, so the same story cannot be counted again; ids of stories still waiting are removed
• That story’s reach and views · Permission: instagram_business_manage_insights · Why: Showing the organizer what the story achieved. Read at most once an hour while the story is online · Who can see it: You, and the organizer of that gig. People at Parmo who run the service · How long we keep it: As long as the gig record, unless you disconnect, ask Meta to delete your data, or delete your account first
• Your Instagram access token, and during connecting Instagram’s one-time login code · Permission: Both · Why: Reading the above · Who can see it: Nobody. The token is encrypted (AES-256-GCM) before it is stored, used only on our servers and never sent to the app or website. The login code is held for at most 10 minutes until your app redeems it · How long we keep it: The token is renewed automatically while connected and deleted the moment you disconnect, remove Parmo in Instagram, ask Meta to delete your data, or delete your account

You make and post your stories yourself in Instagram. We never read your password, your messages, your posts, captions or comments, your follower list, or anyone else’s content, and we keep no copy of your stories. Instagram data is never sold, never used for advertising, and never shared with anyone other than the people named in the table and the processors listed below.

Stopping or undoing the Instagram connection

• Disconnect in Parmo: Profile → Instagram → Disconnect, in the app. This deletes the connection and its token, your username, account type and follower count, and the reach and view figures of your gig stories. Stories still waiting to be checked can no longer be verified. What belongs to gigs you already did (the status and posting time of each story) stays with the gig, because it is the organizer’s record too.
• Remove Parmo in Instagram (Settings → Apps and websites): Meta tells us, and we delete the connection with its token, username, account type and follower count at once. Nothing is read after that. The reach and view figures already measured stay with your gigs until you ask Meta to delete your data or delete your account.
• Ask Meta to delete your data (from the same Instagram screen): we erase everything listed under “Disconnect in Parmo” at once. You get a confirmation code and a link to a status page that confirms the deletion.
• Delete your Parmo account: removes all of it, as described in the Account and Data Deletion Policy.

Legal bases (GDPR Article 6)

• Providing your account, running gigs, checking stories, handing over rewards, door check-in, and the email that comes with your account: Performance of a contract (Art. 6(1)(b))
• Showing your profile to organizers looking for promoters near their event, and showing organizers’ events and brand pages to promoters and on our website: Performance of a contract (Art. 6(1)(b))
• Device location and connecting Instagram: Your consent (Art. 6(1)(a)), given per permission and withdrawable at any time in your device settings or in Parmo
• Security, rate limiting, abuse prevention, request and error logs, and the IP address and device details stored with a sign-in: Legitimate interests (Art. 6(1)(f)) in a service that works and is not abused
• Loading the typefaces of the organizer web app from Google Fonts: Legitimate interests (Art. 6(1)(f)) in a consistent presentation of the web app

Who else processes your data

We do not sell personal data, and we do not share it for advertising. These are the providers Parmo runs on. Processors are bound by a data processing agreement and used only for what is listed; Meta, Apple and Google act under their own privacy terms for the parts marked below.

• PlanetScale · What it handles: The database: everything in the tables above except uploaded files · Where: EU (Frankfurt)
• Cloudflare · What it handles: Hosting the website, the organizer web app and our API (Workers); file storage for flyers, story material, logos and ticket files (R2); sending our email (Cloudflare Email Service); the content system behind the website (D1); request logs and rate limiting; and the connection to the database · Where: EU and US (worldwide network)
• Meta Platforms (Instagram API) · What it handles: The Instagram data listed above, which Instagram provides when you connect · Where: EU and US
• Apple (iPhone) or Google (Android), through your phone’s location service · What it handles: When you tap “use my location”, your phone turns its coordinates into a city name using its own system service · Where: EU and US
• Google (Google Fonts) · What it handles: The organizer web app loads its typefaces from Google’s servers, so your IP address and browser details reach Google when a page loads · Where: EU and US

We also disclose data where the law requires it, and to our professional advisers where necessary to a legal claim. If Parmo is ever sold or merged, account data transfers with it, and we will tell you before that happens.

Transfers outside the EEA rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one covers the recipient.

What other people can see

Parmo connects people who work together, so some of your profile is deliberately visible to the other side. It is worth knowing exactly how much.

• Promoters have no public profile. The website shows brands and events, never promoters.
• Organizers looking for promoters to invite see promoters whose city or shared location is near their event, and promoters who worked with their business before: your name, city, Instagram username and follower count.
• The organizer of an event you ask to join or work additionally sees your request and its status, the status, posting time, reach and views of your stories for it, whether your reward was handed over, and when you were checked in. Every member of the organizer’s team sees the same.
• Door staff checking you in see your name and Instagram username.
• Organizers never see your email address, your location coordinates, your door code or your Instagram token.
• A promoter sees an event’s brand, details, story brief and reward. Brand pages and published event pages, including the brand’s logo, Instagram handle and website, are public on our website.
• People at Parmo who run the service can see account data where support, moderation or a fault needs it.

How long we keep it

• Account and profile, including location coordinates you shared: Until you delete your account
• Instagram connection (token, username, account type, follower count): Until you disconnect, remove Parmo in Instagram, ask Meta to delete your data, or delete your account. Item by item under “Instagram data”
• Gigs, story records, rewards and check-ins: Until the promoter deletes their account or the organizer’s business is deleted, whichever comes first. They are then deleted, not anonymized
• Organizers’ events, brands, uploads and ticket files: Until the organizer removes them or the business is deleted
• Sign-in sessions with IP address and device details: Until you sign out, or the session expires after 7 days without use
• Links in sign-up and password emails, team invitations, Instagram login codes: Until used or expired: password links after one hour, team invitations after 48 hours, Instagram login codes after 10 minutes
• Request and error logs: Up to 7 days, set by our hosting provider
• Database backups: Until they are overwritten on our database provider’s backup schedule

Your rights

If you are in the EEA or the UK you have the right to access your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable form, and withdraw any consent you gave. Exercising a right never costs you the service, and never costs you money.

• Delete your account, yourself, now: Profile → Account → Delete account, in the app. It removes your login and your data immediately, with no email to us and no waiting. Organizers write to privacy@parmo.io. See the Account and Data Deletion Policy for exactly what goes and what stays.
• Access or export: write to privacy@parmo.io and we will send a machine-readable copy within 30 days.
• Withdraw a permission: location is in your device settings; to have coordinates you already shared removed, write to us. The Instagram connection is under Profile → Instagram in the app, and also revocable from Instagram itself (see “Stopping or undoing the Instagram connection”).
• You may also complain to a data protection authority. The one responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

How it is protected

• Everything travels over TLS, and is encrypted at rest by our database and storage providers.
• Every request is checked against the account making it: a promoter only reaches their own data, and an organizer only that of their own business.
• Passwords are stored only as salted hashes. Instagram access tokens are encrypted (AES-256-GCM) before they are stored. They and every other secret stay on our servers, never in the app or website.
• Ticket files are served only to the promoter they were handed to, and door codes are never shown to organizers.
• Sign-in attempts and other requests are rate-limited, and access to production data is limited to the people who need it.

No system is perfect. If a breach ever affects your data we will notify the relevant authority within 72 hours and tell you directly where the law requires it. Security reports are welcome at privacy@parmo.io.

Children

Parmo is for adults. You must be 18 or older to hold an account, and promoters must confirm this in the app before they can take part. We do not knowingly collect data from children, and if we learn that an account belongs to someone under 18 we delete it. If you believe a minor has an account, tell us at privacy@parmo.io.

Tracking and cookies

Parmo does not track you across other companies’ apps and websites, does not use the advertising identifier, and shows no ads. The app therefore never asks for App Tracking Transparency permission, because there is nothing to ask about.

We use no analytics and no advertising cookies. The organizer web app sets one cookie that is strictly necessary to keep you signed in; on the website, only the editors of our content system get a sign-in cookie. The app keeps your sign-in in your phone’s secure storage.

Changes to this policy

When we change something substantive we bump the version at the top of this page, and tell you by email or in the app before it takes effect. The current version and its effective date are always shown here.