Skip to content
Sign up

Privacy Policy

How we handle your personal data.

Last updated: 16 October 2026

Who are we?

EuroActs.com is a trading name of Nuno Art, which is the data controller for the personal data processed via this platform.

Nuno Art
Registered office: Laan van Cattenbroeck 16A, 3703 BM Zeist, the Netherlands
Chamber of Commerce (KvK) number: 98164325
VAT identification number: NL005311537B71
Email: contact@euroacts.com
Phone: +31 6 20020723

Which data do we process?

  • Account details: name, email address, password (encrypted)
  • Profile details you post yourself: stage name, description, photos, videos, city, service area, email address, phone number and website — these are publicly visible on your profile page, because that is the purpose of the platform
  • Contact and usage data: messages sent via the platform and technical data (IP address, browser) for security and statistics

Reviews. If you write a review about a profile, we process your name (as you enter it; a first name is enough), your score and your text, and, until you confirm, your e-mail address. Name, score and text are publicly visible on that profile; your e-mail address is not. We use your e-mail address only to send the confirmation e-mail. As soon as you confirm, we erase it and keep only an encrypted abbreviation (hash) of it, to prevent more than one review of one profile being written with the same address, and to be able to erase your reviews if you erase your account. To prevent abuse we count per day, with encrypted keys and without storing your IP address or e-mail address itself, how many reviews arrive from one IP address or one e-mail address; we keep those counters for two days. A review that you do not confirm within three days is erased completely. You can always delete your review using the link in the confirmation e-mail; we then erase your name, text and hash. The owner of the profile receives a notification of your review and can report it to us, but cannot change it. Legal basis: our legitimate interest in giving bookers reliable information. We process a review of EuroActs itself in the same way; it appears on our reviews page. The latest reviews, with name, score and text, may also appear at the bottom of every page of the site.

Sign in with Apple. If you choose Apple, we receive your Apple-verified email address (which may be an Apple private relay address) and your Apple user identifier. We store the association between this identifier and your EuroActs account so you can sign in. When you delete your EuroActs account, we also delete this association. Apple manages its own sign-in process and processes data under its own privacy policy.

Agent connections. A registered application or agent gets access only after your consent for that client. account:read permits reading your account ID and email address; profiles:read permits reading only your own published profiles. We store technical authorization records for the connection. Access tokens and consent tickets are valid for 10 minutes; authorization codes for 2 minutes. Tokens can be revoked through /api/oauth/revoke and are revoked when your EuroActs account is deleted.

Why, and on what legal basis?

We process data to perform our agreement with you (displaying your profile, enabling booking contact), on the basis of legitimate interest (security, improving the platform, listing publicly available business details) and with your consent where required.

Pre-created profiles

Some business profiles have been created from publicly available business information. Want to edit or remove your profile? Use the “Claim your page” button or email contact@euroacts.com; we process your request within 5 working days.

Invitations. We look for artists who publish a business email address on their own website. On the basis of legitimate interest, we only process what is on those public pages: name, category, city, website, that email address, a photo, a video, links to your social media profiles and a short text we write based on them. We use this to create a preview profile that is not public. A member of our team checks that preview; only after their approval do we send one email. We publish nothing without your confirmation. If you don't respond, we delete the preview after 3 days; we keep only your email address and website, so that we never contact you a second time. The searching and writing is done for us by Anthropic's AI. You can unsubscribe with one click in the email.

Sharing & retention

We do not sell your data and we do not use it for advertising. We do use service providers who process it on our behalf, each under a data processing agreement:

  • Cloudflare — hosting for the site, the database and protection against abuse
  • Amazon Web Services — storage and delivery of the photos you upload
  • Resend — sending our email
  • Stripe — payment for a paid plan. You enter your card details on Stripe's own page; they never reach us.
  • Anthropic — the AI that writes and translates your profile text and, at your request, reads your own website
  • Google Analytics — visitor statistics; see the Cookies section below
  • Google — signing in with your Google account, only if you choose "Continue with Google". We receive your email address from Google; nothing from Google is loaded on our pages before you click.

Native notifications. When you enable them, Expo Push Service and your device's delivery service (Google Firebase Cloud Messaging on Android or Apple Push Notification service on iOS) process the routing data needed to deliver an alert. See ‘Notifications, the app and what we measure’.

To other users. If you request a quote or send a booking request, we pass your name, email address and phone number to the artist or venue you chose — which is exactly what you are asking for. For a quote request that only happens after you confirm the request by email.

Public. Whatever you put in your profile as an artist or venue appears on a public page. Your phone number, email address and website only if you switch that visibility on yourself in your dashboard.

Retention. Your account and profile data for as long as your account exists. Invoices for paid subscriptions for seven years (a legal retention period). Sent emails for two years, the input to the AI helper for 90 days, login attempts for seven days. An email address on the unsubscribe list we keep indefinitely, precisely so we never email you again.

Sign-in codes and drafts. You can sign in without a password: we email you a six-digit code. The code is valid for 10 minutes, works once and is never stored in readable form, only as a protected hash. A draft of your profile that you have not published yet is kept for at most 90 days and then deleted.

Your rights (GDPR)

You have the right to access, rectification, erasure, restriction, data portability and objection. Email your request to contact@euroacts.com. You can also lodge a complaint with the Dutch Data Protection Authority (NL) or the Belgian Data Protection Authority (BE).

Deleting your account and your data

You do this yourself, straight away, without having to ask us.

  • Remove one profile: log in to your dashboard and choose “Delete profile” on that profile. It disappears from EuroActs at the next rebuild of the site — within half an hour.
  • Remove your whole account and all your data: at the bottom of your dashboard you will find “Delete your account and all your data”. You confirm with your own email address. Gone then are: all your profiles with their name, email address, phone number, description, photos and videos, their translations, your availability calendar with the entries in it, your settings for the booking form and the WhatsApp button, your websites and any notifications you turned on. After that you can no longer log in.

What stays, and why: invoices for paid subscriptions (a legal seven-year retention period) and, if you ever unsubscribed from our emails, your email address on the unsubscribe list — precisely so you never hear from us again. The web address of a deleted profile stays reserved, so it is never handed to someone else.

Prefer that we do it? Email contact@euroacts.com from your account's address and we will delete your account within 30 days.

Mobile sessions and Connect. Account deletion revokes active native sessions and deletes associated push tokens, app preferences, mobile event records and conversations on your own Connect channels. Merely logging out on a device removes its local session and push-token link; your account, bookings, subscriptions and conversations remain.

Cookies

Functional — always. Your login session, your language choice and, if you arrive through a colleague's referral link, the referrer's code for 30 days. Without these cookies the site does not work.

Website and app statistics — only with consent. Google Analytics for the website loads only after Accept in the cookie notice; after Decline this website Analytics is not loaded. Your browser stores this choice; change it using Cookie settings on the site. The native iOS and Android apps ask separately through Appstatistieken delen in Account. This choice stays in secure device storage. Firebase Analytics records app events only after this consent. Push-notification permission is separate. When measurement is enabled, Google may infer an approximate location from network and device data.

Our own counter — for everyone, without cookies. To see how people find and use EuroActs, our own counter counts every visit, even if you decline cookies. It uses no cookie and no identifier that would let us recognise you, and it does not store your IP address. It records: where your visit came from (for example Google, a social network, WhatsApp, an AI assistant or another website — for a website, only its name), the country and city that Cloudflare derives from your IP address, the type of device, operating system and browser, which pages you view and what you do on the site (for example signing up, sending a request, tapping a phone number or sharing a page). Your browser remembers where you came in for this tab only; that is gone as soon as you close the tab. We see daily totals. Individual page views, without any identifier, are kept for 2 days for the live overview; the daily totals for 25 months. Legal basis: our legitimate interest in improving the site.

Likes and views. In the swipe feed and in the lists on every EuroActs page, our own counter also counts how often a profile appears on screen (at least half of it) and when someone likes a profile. The artist sees these numbers in the dashboard and, if they have notifications switched on, in a push notification, with the country a like comes from — never who. So that no one can like one profile endlessly, we calculate a code from your IP address, the profile and the date when you like a profile, and delete it after 2 days; we do not store your IP address itself. The list of profiles you like stays on your own device. Legal basis: our legitimate interest in showing artists what their profile achieves.

All cookies and everything we store in your browser, with how long they last, are listed in our Cookie policy.

Notifications, the app and what we measure

Push notifications. Web notifications use a browser subscription with an endpoint and encryption keys. In the native apps we request device permission when you tap ‘Enable notifications’. On registration we store the Expo push token, platform, and its connection to your account and active session, alongside preferences for enquiries, messages, likes and saved profiles. Expo routes notifications via Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS). Native push carries a generic alert and a route, not the contents of a private message. You can disable categories in Account and revoke device permission in system settings. Logging out, session expiry or account deletion removes the server's connection to the device.

The mobile apps. The existing Android version opens the website; newer Android and iOS versions also have native account, enquiry, activity and message screens. At login, the app keeps a session token in secure device storage; the server keeps only its hash and expires that session within 14 days. Private website management inside the app has a separate functional browser session. Public discovery works without an account. The app does not request contacts or location access; when you select media for your profile, the standard system picker is used.

EuroActs Connect. As a visitor to a profile or linked website you can start a conversation. We store the name and email address you supply (if any), the originating website, conversation, messages, timestamps and read status. The profile owner can read and reply. Visitors receive a random access token of which we store only a hash. Conversations expire and are cleared 30 days after the last message; the owner may delete one sooner. After one hour, a reply can be sent by email if you first verify your address using a code. We process that verification and delivery through our email provider. Temporary hashed request counters limit abuse; the IP address itself is not stored in the chat tables.

The AI helper in the sign-up wizard (writing text, reading your own website) stores your input, the answer and your IP address, so we do not have to ask the same thing twice and abuse stays limited. After 90 days that is cleared out.

Our components on your site — the booking form, the WhatsApp button, the availability calendar and the “Book via EuroActs” badge — report to us, on every view, the hostname and path of the page they sit on. That is your own public website, so that you can see in your dashboard where they are. About the visitor to that page we store nothing.

The app on Google Play — If you use EuroActs on an Android phone, we remember only that fact with your account, and whether you already use our app; this note says nothing else about your device (what the app itself processes is described above). That way our emails only show the link to the EuroActs app on Google Play when it is useful to you. If you delete your account, this information goes with it.

Reports about content

If you report content through our report form, we process your email address, your name if you enter it, the page address, your explanation and the time. We use this to handle your report and to inform you of our decision; the Digital Services Act requires us to. The person you report does not see your name or email address, except your name in a copyright report. To prevent misuse we count per day how many reports come from one IP address and one email address, only as a code that cannot be traced back and for two days. We keep a report for up to two years after it has been handled.

Security

We take appropriate technical and organisational measures: encrypted connections (HTTPS), passwords we can never read ourselves (PBKDF2-SHA256, 100,000 rounds, a separate salt per account), a session cookie JavaScript cannot read, a limit on login attempts, and — if you have lost your password — logging in through a one-time link sent to your own email address.

Transfers outside the EU

To generate profile texts, we use an AI service provider that may process data outside the European Economic Area. This transfer takes place on the basis of the European Commission’s standard contractual clauses.

Changes

We may update this privacy policy. The most recent version is always available on this page.