Privacy without
the small print.

1. Who is responsible for your information?

Riff Mates is responsible for deciding how personal information collected through this website is used. This is sometimes called the “data controller”.

For a privacy question or request, use the Riff Mates contact form and begin your message with Privacy request. We may need to confirm that the account or information belongs to you before completing a request.

2. Information Riff Mates collects

3. Why the information is used

Riff Mates does not currently send advertising emails. If marketing or personalised advertising is introduced later, this policy and any required consent controls will be updated before that processing begins.

4. Who can see information?

• Signed-in members can see profiles whose owners enabled Discover, along with the public area, musical details and profile photograph.
• Jam listings show the general area and organiser information needed to make a connection, but not an email address or precise location search.
• Message participants can see the messages in their conversation.
• Approved moderators or administrators can see reports, reported content, contact messages and related information needed to investigate a safety issue. They do not routinely read ordinary private conversations.
• Administrators can also access a protected member directory containing account email, join and last-sign-in dates, general profile information, account status and activity counts. This directory does not include precise location searches or ordinary private-message content. Moderator accounts cannot access it.

5. Services that process information

Riff Mates uses service providers only where needed to run the website:

• Supabase provides account authentication, database storage, profile-picture storage and protected server functions.
• Netlify hosts and delivers the website and may generate security and access logs.
• Postcodes.io processes UK postcode and town searches.
• GeoNames supplies a place-name dataset stored inside the website for Republic of Ireland town searches under the Creative Commons Attribution 4.0 licence.
• OpenStreetMap Nominatim may process a fallback UK town search where the main lookup cannot resolve it.

An external location provider receives the search text sent to it and the technical information normally accompanying an internet request, such as an IP address. Riff Mates does not send your email address or profile to these location services. Republic of Ireland town names are normally matched against the local GeoNames dataset without sending the search to GeoNames.

Service providers may process information in the UK, European Economic Area or other countries. Where international processing is involved, Riff Mates will use the provider’s applicable contractual and legal safeguards. The selected hosting regions and provider terms should be reviewed as the service grows.

6. Cookies and device storage

Riff Mates currently uses essential browser storage rather than advertising cookies:

• Supabase keeps the secure sign-in session so you remain signed in.
• A draft jam may be kept on your device until it is published or cleared.
• A homepage search is kept for the current browser session.
• Town-location results may be cached on your device for up to 30 days to reduce repeated location requests.

No analytics or advertising tracker is currently installed. This section and any consent controls will be updated before non-essential tracking is introduced.

7. How long information is kept

• Account, profile, jam and message information is generally kept while the account remains active or until the relevant content is deleted.
• Contact messages are retained until they have been handled and are no longer needed.
• Reports and moderation records may be retained for longer where reasonably necessary to protect members, prevent repeated misuse, resolve disputes or meet legal obligations.
• Provider security logs are retained according to the relevant provider’s settings and retention arrangements.

When information is no longer needed, it will be deleted or anonymised where reasonably possible. Backup copies may remain for a limited period before being overwritten.

8. How information is protected

Riff Mates uses protected database access rules, account authentication, private location records, restricted staff roles and time-limited profile-picture links. Uploaded profile pictures are converted to a standard image and metadata is removed before storage. No online service can guarantee absolute security, so members should use a unique password and avoid sharing unnecessary private information.

9. Your data-protection rights

Depending on the circumstances and applicable law, you may ask Riff Mates to:

• provide a copy of your personal information;
• correct inaccurate or incomplete information;
• delete information;
• restrict or object to particular processing;
• provide certain information in a portable format; or
• explain how a decision involving your information was made.

Your right to object: where Riff Mates relies on legitimate interests, you can object to that processing. The circumstances will be reviewed and the processing will stop unless there is a compelling lawful reason to continue.

Riff Mates does not currently make decisions based solely on automated processing that have legal or similarly significant effects. Distance sorting and profile filters help members search; they do not decide who may join or communicate.

10. Questions and complaints

Please contact Riff Mates first so the issue can be investigated. You may also complain to the UK Information Commissioner’s Office. People in the Republic of Ireland may also contact the Irish Data Protection Commission.

11. Changes to this policy

This policy will be reviewed when Riff Mates introduces a materially different feature, provider, advertising system or use of personal information. Important changes will be announced through the member dashboard before or when they take effect.