Cookies

We use cookies to keep you signed in. With your OK, we also use analytics cookies to see how the platform is used, so we can improve it.

How we use cookies
OnStage

Privacy policy

OnStage Privacy Policy

Last Updated: 20 October 2026

Introduction

OnStage is a service planning platform for churches, available on iOS, Android and the web. It helps church volunteers and teams plan, organise and communicate. This Privacy Policy explains how we collect, use, disclose and protect your personal data when you use our Platform and Service.

This Privacy Policy is written in English. Translations into other languages are provided for your convenience; if a translation differs from the English text, the English text prevails.

Who We Are

The controller of your personal data is ONSTAGE SRL, a company registered in Romania, located at Petru Maior 61H2, Oradea, Bihor, Romania ("OnStage", "we", "our" or "us"). You can reach us about anything in this Privacy Policy at contact@getonstage.app.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romanian data protection law.

Definitions

  • Personal Data: Information that identifies an individual or can be linked to one.
  • Platform: OnStage on iOS, Android and the web (web.getonstage.app).
  • Service: The services provided through our Platform.
  • User: Anyone who uses our Platform and Service.
  • Team: A church or ministry team on OnStage, which its admins manage and invite people to.

Information We Collect

Personal Data You Provide

  • Account Data: Your name, email address and sign-in details, when you sign up with email and password or with Google or Apple. Passwords are handled by Firebase Authentication; we never see them.
  • Profile Data: Your username, profile photo, phone number (if you add it), and your role or position in your team.
  • Team Data: The teams you belong to, your groups, your participation in events, and the availability you set.
  • Content: The songs, arrangements, notes, files, events, messages and other content you or your team add to the Service, including content you choose to import from files or from other services you connect.
  • Billing Data: Your subscription plan and its status. Card details are entered directly with Stripe (on the web), Apple or Google, and we do not receive them.
  • Communications: The messages you send us, and feedback you choose to give, for example when you cancel a subscription.

Automatically Collected Information

  • Device Information: Device model, operating system and version, the platform version you use, and a device identifier.
  • Notification Tokens: To send push notifications to your devices, if you allow them.
  • Usage Data: How the Platform is used, such as the screens viewed and the features used, through Amplitude and, on mobile, Google Analytics for Firebase. On the web, usage data is collected only if you accept analytics cookies (see Cookies and Similar Technologies).
  • Error Reports: Technical information about errors and crashes, through Sentry.
  • Settings: Your language, time zone, country and display preferences.
  • Referral and Attribution Data: The referral code or invitation you joined with and, on mobile, an advertising attribution identifier from Meta.
  • Location Data: Country-level information only. We do not collect GPS location.

How We Use Your Information

  • Service Provision: To provide the Service, including your account, your teams, and sharing content with the people you choose.
  • Account Management and Support: To manage your account and answer your requests.
  • Notifications: To send you invitations, reminders and updates about your teams and events, by email and push notification.
  • Payments: To manage subscriptions and the features they unlock.
  • Analytics and Improvement: To understand how the Platform is used, and to fix and improve it.
  • Security: To keep the Service secure and to detect and prevent fraud and abuse.
  • Legal Obligations: To comply with the law, for example accounting and tax rules.

Legal Basis for Processing Personal Data

  • Contract (GDPR Article 6(1)(b)): To provide the Service you signed up for.
  • Legitimate Interests (GDPR Article 6(1)(f)): To keep the Service secure, to fix errors, to understand how it is used and improve it, and to measure where our users come from. You may object to this processing at any time.
  • Consent (GDPR Article 6(1)(a)): Where we ask for it, for example for push notifications. You may withdraw your consent at any time, without affecting processing that took place before.
  • Legal Obligation (GDPR Article 6(1)(c)): Where the law requires us to keep or disclose data.

Data Retention

We keep your Personal Data only for as long as necessary to provide the Service and for the purposes described in this Privacy Policy, or as long as the law requires, for example billing records under accounting law. When you delete your account, we delete or anonymise your Personal Data from our active systems; copies may remain in backups for a limited period before they are overwritten. Content you shared with a team may stay available to that team. Analytics and error data are kept for a limited period and then deleted or aggregated.

Disclosure of Your Information

Within Your Teams

The people in your teams can see your name, profile photo, role or position, your participation in events and your availability, and the content you share with them.

Service Providers

We share Personal Data with service providers that process it on our behalf, under contracts that require them to protect it:

  • Firebase Authentication and Firebase Cloud Messaging (Google): Sign-in and push notifications.
  • Amazon Web Services: Hosting of the OnStage server, storage of files in the European Union, and sending of emails.
  • MongoDB Atlas: Database hosting.
  • Vercel: Hosting of the web platform.
  • SendGrid (Twilio): Sending of emails.
  • Amplitude: Product analytics.
  • Google Analytics for Firebase (Google): Product analytics on mobile.
  • Sentry: Error and crash reporting.
  • RevenueCat: Subscription management.
  • Stripe: Card payments on the web.
  • Apple and Google: Payments made through the App Store and Google Play, and sign-in with Apple or Google if you choose it.
  • Meta: Attribution of installs from our ads, on mobile.
  • OpenAI: Processing of the song content you choose to import and of song searches, to provide AI-assisted features such as reading songs from files.

Other Disclosures

  • Legal Compliance: When the law requires it, or to protect the rights and safety of our users and of OnStage.
  • Business Transfers: In case of a merger, acquisition or sale of assets, under the same protections as this Privacy Policy.

We do not sell your Personal Data.

Connecting AI Assistants

You can connect an AI assistant, such as Claude, ChatGPT or another client that supports the Model Context Protocol (MCP), to one of your teams, and ask it about the team or have it make changes in plain language. A connection exists only if you set it up yourself. How to connect, and everything a connected assistant can do, is explained at web.getonstage.app/connect-ai.

  • Who Can Connect: Only the owners and admins of a team. If you stop being an owner or admin of the team, your connections and tokens stop working.
  • What the Assistant Can Read and Change: The team's members, roles, groups and positions; events, their participants and setlists, and their reminders; songs and their files; reports; and members' availability and blockouts. At your request, it can also add songs and events, change setlists and who serves where, attach files to songs, publish events or delete an event.
  • It Acts as You: The assistant acts on your behalf, with your permissions in the team. It can never see or do more than you can in the Platform, and the changes it makes are made in your name. They may notify your team as they would if you made them in the Platform.
  • Your Assistant's Provider: The data the assistant reads from OnStage is sent to the assistant and is then processed by the company that provides it (for example Anthropic for Claude, or OpenAI for ChatGPT) under that provider's own terms and privacy policy, not this Privacy Policy. You choose to share the data with that provider; it is not our service provider. We process the data to provide the connection you ask for (contract).
  • Sign-In and Tokens: You approve each connection on OnStage's consent screen, where you choose the team and the access you grant. The assistant then receives an access token (OAuth) for that team only; it never receives your password. Assistants that cannot sign in through a browser may use a personal access token instead, which is shown to you only once. We keep a record of each connection (the assistant, the team and the access granted), and we log the requests made through it, to keep the Service secure.
  • Revoking Access: You can end a connection at any time by removing OnStage from your assistant's connectors. Connections and tokens can also be revoked on our side: write to us at contact@getonstage.app and we will revoke them.

International Data Transfers

Some of our service providers process data outside the European Economic Area (EEA), for example in the United States. Where they do, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses (SCCs), together with additional safeguards where needed. You may ask us for a copy of the safeguards that apply.

Data Storage and Security

  • Security Measures: Data is encrypted in transit, and access to it is limited to the people and systems that need it.
  • Web Sessions: On the web, your session is kept in secure cookies that page scripts cannot read.
  • Breaches: If a data breach puts your rights at risk, we will notify the supervisory authority and, where required, you.

Your Rights Under GDPR

You have these rights over your Personal Data:

  • Access: Request a copy of your data.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure: Request the deletion of your data. You can also delete your account yourself in your profile settings.
  • Restriction: Ask us to limit how we use your data.
  • Data Portability: Receive your data in a structured, machine-readable format, or have it transferred to another provider.
  • Objection: Object to processing based on our legitimate interests.
  • Withdraw Consent: Withdraw a consent you gave, at any time.

To exercise these rights, contact us at contact@getonstage.app. We will answer within one month. We may need to confirm your identity first.

You also have the right to lodge a complaint with a supervisory authority. In Romania, that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro). You may also complain to the authority in the country where you live or work.

Children and Minors

Church teams may include minors. A minor uses the Service under the responsibility of a parent or guardian, or of the church or team that invites them. If you believe that a minor's data was provided to us without proper permission, contact us and we will delete it.

Cookies and Similar Technologies

The web platform uses cookies and similar technologies, such as the browser's local storage:

  • Strictly Necessary: The session cookies that keep you signed in, a device identifier for your session, your language choice, your cookie choice, and the storage Firebase Authentication uses for sign-in. When you pay on the web, our payment provider sets its own cookies to prevent fraud. The web platform does not work without them, so they do not need your consent.
  • Analytics: Only if you accept analytics cookies, Amplitude stores an identifier in a cookie and in local storage, to count visits and understand how the web platform is used. Until you choose, and if you reject them, no analytics cookies are set and no usage data is sent from the web platform.

We ask for your choice on your first visit, keep it for 12 months and then ask again. You can change it at any time under Cookie settings, in About or at the bottom of the sign-in page. When you withdraw your consent, we stop analytics and delete its cookies and local storage.

Our mobile platform uses comparable identifiers on your device for the same purposes.

You can also block or delete cookies and local storage in your browser settings. If you block the strictly necessary ones, you will not be able to sign in.

Third-Party Websites and Services

Our Platform and Service may contain links to third-party websites, apps or services that are not operated or controlled by OnStage. This Privacy Policy does not apply to them, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy. We will notify you of significant changes before they take effect, through the Platform or by email, and show the date of the latest change at the top.

Contact Us

ONSTAGE SRL
Petru Maior 61H2, Oradea
Bihor, Romania
Email: contact@getonstage.app