How Roadkit handles personal data. We keep only what we need to run the service, for as long as needed. Last updated: August 2026.
Roadkit (contact: support@roadkit.band) is the data controller for account data, billing data, and technical data needed to run and secure the service.
When your band stores information about other people in Roadkit — for example venue contacts, phone numbers, emails, or notes in Outreach — your band decides what is entered and why. For that band content, your band is the controller and Roadkit acts as a processor: we host and process it only to provide the product, on your instructions (what you enter, edit, and delete in the app).
You are responsible for making sure you may store those third-party details (for example a legitimate interest in booking venues) and for keeping them accurate.
Account details you give us (name, email; password is handled by our authentication provider).
Band workspace content you create: tracks (titles, chords, sheet images), gigs and setlists, planner items, costs/expenses, and — on Unlimited — venues, contacts and outreach history.
Billing data when you subscribe (band billing details, payment status, invoices). Card and bank details are handled by our payment provider; we do not store full card numbers.
Technical and operational data: login sessions, security logs, email delivery status, and error reports needed to keep the app working. Operational alerts use internal identifiers where possible; full detail stays in our EU database.
To provide Roadkit under our agreement with you (accounts, band workspace, syncing between members).
To process payments and meet legal bookkeeping duties.
To keep the service secure, prevent abuse, and fix outages.
We do not sell personal data and we do not use it for advertising.
When you delete content in the app, it is soft-deleted and then permanently removed after a short retention window (for accidental recovery and abuse prevention).
Deleting a band permanently removes that band's workspace content. Account deletion removes your profile and memberships; bands where you were the sole member are removed as well.
After hard deletion, the content is not recoverable by you or by us.
Account and active band content: for as long as your account/band exists, or until you delete it.
Financial records (invoices, payments): kept for the period Dutch tax law requires — generally around seven years — separate from deleted band content.
Email delivery logs: kept for a limited operational period (about 90 days), then removed.
If a venue in Outreach has no activity for 24 months, its contacts and outreach history are moved to the trash together (recoverable for a short period), then permanently deleted — so third-party contact details are not kept indefinitely.
To run Roadkit we use external providers, including: database and authentication hosting (Supabase, EU), application hosting (Netlify), email delivery (Resend), payments (Mollie), error monitoring (Sentry, EU), and operational alerting (Slack).
They process data only to provide their service to us. Where EU law requires a data processing agreement (verwerkersovereenkomst / DPA), we have that in place with the provider. Mollie may also act as an independent controller for certain payment, fraud and compliance processing under applicable financial rules.
Our primary database and authentication are hosted in the European Union (Supabase EU). Error monitoring is configured for the EU (Sentry EU).
Some providers may process data in the United States or other countries outside the European Economic Area (for example email delivery, hosting edge networks, or operational tools). Where that happens, we rely on an adequacy decision where available, or on the provider's Standard Contractual Clauses (SCCs) and related transfer safeguards under the GDPR.
Depending on the situation, you can ask to access, correct, export or erase personal data we hold as controller, and object to or restrict certain processing. Band admins can export their band's database content from the app; contact us if you need help with a full request.
Email support@roadkit.band. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
We use essential and functional cookies: your login session, which band is active, your language, and a cookie that remembers your cookie choice. These are needed for the app to work.
We currently do not use analytics, tracking or advertising cookies. If we add any, we will ask for consent first and you will be able to choose necessary cookies only.