Privacy Policy
Last updated: 25 February 2026
The headlines
- We collect your contact details, professional profile, and (optionally) voice onboarding data to match you with opportunities.
- We never sell your personal data to anyone.
- We do not use your data to train third-party AI models or create biometric voiceprints.
- Voice recordings are never shared with hirers — only the profile fields you approve.
- Payments are handled by Stripe; we never see or store your card details.
- You can access, correct, export, or delete your data at any time.
1. Who We Are
Repme ("we", "us", "our") is a music-industry opportunity-matching platform based in the United Kingdom. We are the data controller for personal data processed through repme.app (the "Platform"). You can contact us at [email protected].
2. What Data We Collect
Account data
Full name, email address, and password-less authentication tokens.
Talent profile data
Professional title, roles, instruments, genres, location, travel radius, phone number (optional), years of experience, seniority level, equipment, software, certifications, transport details, availability, rate range, bio, username, profile photo, header image, social links, and video URLs.
Hirer data
Company name, company description, and opportunity listing details (title, description, location, dates, pay range, contact information).
Application data
Application messages, email-sharing consent, and application status.
Payment data
Stripe customer and subscription identifiers. We do not store card numbers; all payment data is processed and held by Stripe.
Voice interaction data
If you use our voice onboarding feature, conversation data is processed by our AI provider to populate your profile fields. We store the resulting profile fields, not raw audio recordings. Voice data is never shared with hirers or prospective employers.
Usage data
Match scores, agent activity logs (searches, matches, applies), notification preferences, IP address, and device information from server logs.
3. How We Use Your Data
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| Create and manage your account | Contract |
| Match you with opportunities | Contract |
| Display your public profile | Contract / Consent |
| Process subscription payments | Contract |
| Send email notifications & digests | Legitimate interest (opt-out available) |
| Generate AI-assisted bios | Consent (you initiate the action) |
| Voice-based onboarding | Consent (you initiate the session) |
| Improve the Platform & fix bugs | Legitimate interest |
| Prevent fraud & enforce our Terms | Legitimate interest |
| Comply with legal obligations | Legal obligation |
4. What We Will Never Do
We commit to the following:
- We will never sell your personal data to third parties.
- We will never use your voice recordings to create biometric voiceprints.
- We will never sell or licence your personal data to train third-party AI models.
- We will never share your voice interaction data with hirers or prospective employers.
5. Automated Decision-Making
Our matching engine uses automated scoring to rank opportunities against your profile (based on location, genres, instruments, rates, and experience). This helps surface relevant opportunities but does not make binding decisions — you always choose which opportunities to apply to.
You have the right to request a review of how your match scores are calculated by contacting us at [email protected].
6. Third-Party Processors
We share personal data only as necessary with the following processors, all of whom are bound by data-processing agreements:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, file storage | All account & profile data, uploaded images |
| Stripe | Payment processing | Email, Stripe customer ID |
| ElevenLabs | Voice onboarding agent | Profile fields provided during voice sessions |
| OpenAI / OpenRouter | AI bio generation | Profile details used to draft bio text |
| Resend | Transactional email delivery | Email address, notification content |
| Vercel | Hosting & edge functions | Request logs, IP addresses |
We may also share data with professional advisors (lawyers, accountants) or law enforcement when required by law.
7. Public Information
Talent profiles are publicly accessible at repme.app/[username]. This includes your username, bio, photo, genres, instruments, and other profile details you choose to provide. Opportunity listings posted by Hirers are visible to authenticated users.
8. Data Retention
We retain your data for as long as your account is active. When you delete your account (via your settings page or by emailing [email protected]), your personal data — including your profile, applications, and matches — is deleted.
Payment records are retained as required by UK tax and accounting law (typically 6 years). Anonymised, aggregated data that cannot identify you may be retained indefinitely to improve the Platform.
9. Your Rights
Under the UK GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data (you can do this directly in your profile settings)
- Erasure — request deletion of your data
- Restriction — ask us to limit processing
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest, including automated matching
- Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing
To exercise any of these rights, email [email protected]. We will respond within 30 days.
10. Cookies
We use essential cookies only. These are:
- Authentication session cookies (set by Supabase) — keep you signed in as you navigate the Platform.
- Panel preference cookie ("active_panel") — remembers whether you last used the musician or hiring view.
All cookies listed above are strictly necessary for the Platform to function and do not require your consent under UK privacy law (PECR Regulation 6). We do not use advertising, analytics, or third-party tracking cookies.
11. International Transfers
Some of our processors (Supabase, Stripe, Vercel, OpenAI, ElevenLabs) may process data outside the UK. Where this occurs, transfers are protected by Standard Contractual Clauses, an adequacy decision, or equivalent safeguards as required by UK data protection law.
12. Children
The Platform is not directed at anyone under 18. We do not knowingly collect data from children. If we learn that we have collected data from a person under 18 we will delete it promptly.
13. Security
We use HTTPS, row-level security policies on our database, server-side authentication, and webhook signature verification to protect your data. We regularly review these measures. No system is 100% secure; if you become aware of a security issue, please report it to [email protected].
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. The "Last updated" date at the top will always reflect the most recent version.
15. Complaints
If you are unhappy with how we handle your data, please contact us first at [email protected] so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
16. Contact
For any privacy-related questions, email [email protected].