Privacy Policy

1. Introduction

At Laffstr ("we", "us", "our"), we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform (https://laffstr.com), including profiles, uploads, bookings tools, contracts, media, and more.

2. Scope & Applicability

This Policy applies to all visitors, users and others who access or use the Platform ("you", "your"). It covers all personal data collected through the Platform, whether you are a comedian, venue owner, or other user. It does not apply to third-party websites, services or content accessible through links from our Platform.

3. Information We Collect

a) Information you provide us:

• Account registration data: name, email address, password, phone number (optional).
• Profile information: for comedians – stage name, biography, contact information, social media handles; for venues – venue name, address, contact information, booking details.
• Creative material: jokes, bits, premises, sets, press-release drafts, contract templates you upload.
• Media uploads: photos and videos you upload.
• Booking/contract data: details of bookings, contracts you generate via the Platform, correspondence between you and another user.
• Payment information: if you purchase Paid Services, we collect billing information (e.g., credit card or other payment instrument) via our payment processor.

b) Information we automatically collect:

• Usage data: when and how you use the Platform, log-ins, IP address, browser type, device details, pages viewed, time spent.
• Cookies and tracking technologies: we use cookies, web beacons, similar technologies to collect information about your use of the Platform, enable functionality, personalize your experience, and perform analytics.

c) Information from third parties:

We may obtain information from third-party services (for example social media profiles if you link them) or publicly available sources, and combine it with other information we have.

4. How We Use Your Information

We use collected information for purposes including:

• To provide, operate, maintain and enhance the Platform and its features.
• To create and manage your account and profile.
• To enable you to upload, store and manage your creative, media and booking-related content.
• To facilitate connections between comedians and venues (e.g., profile review, bookings, contract generation).
• To process payments for Paid Services, and to provide related customer support.
• To send you administrative communications (e.g., account changes, updates to Policies, security alerts).
• To personalize your experience (e.g., suggesting appropriate tools or venues).
• To monitor, analyze and improve usage of the Platform, and to prevent or detect fraud or abuse.
• To comply with legal obligations (e.g., tax, regulatory, law enforcement requests).

5. Disclosure of Your Information

We may disclose your information as follows:

• Within the Platform: Comedians' public profile information and media may be visible to venues (and vice versa) to facilitate bookings, subject to your profile settings.
• Service providers and subcontractors: We may share your information with vendors who perform services for us (hosting, payment processing, analytics). They act under our instructions and are obligated to protect your data.
• Business transfers: In the event of a merger, acquisition, sale of assets or bankruptcy, your information may be transferred as part of that transaction.
• Legal requirements: We may disclose information if required by law or to respond to legal process, enforce our Terms, protect our rights, or the rights of others, or prevent fraud or misuse.
• With your consent: We may share your information with others if you consent.

6. Google User Data & YouTube Integration

If you choose to connect your YouTube account, Laffstr accesses a limited set of Google user data to let you display your channel and recent videos on your Laffstr member profile. We request only the read-only scope https://www.googleapis.com/auth/youtube.readonly, which allows us to retrieve your public channel information (channel title, channel URL, subscriber count) and metadata for your most recent uploaded videos (titles, thumbnails, and video IDs). We do not request write, upload, or deletion access to your YouTube account, and we never post, modify, or remove content on your behalf.

How we use Google user data. The YouTube data we access is used solely to populate the “From My YouTube” section of your Laffstr profile so that visitors can view and play your videos. We do not use this data for advertising, and we do not sell it or transfer it to third parties except as needed to provide this feature to you or as required by law.

How we store it. When you connect YouTube, we store the OAuth access and refresh tokens issued by Google, along with the retrieved channel and video metadata, in our secure database (hosted on Supabase). These tokens are used only to refresh your video list and are protected by the safeguards described in Section 7. We never expose your OAuth tokens to other users or to client-side code.

Revoking access and deletion. You may disconnect YouTube at any time from your Laffstr account settings, which removes the stored tokens and associated YouTube data from your profile. You can also revoke Laffstr's access directly through your Google Account permissions page at myaccount.google.com/permissions. To request deletion of all data we hold about you, see our Data Deletion page or contact us at support@laffstr.com.

Limited Use disclosure. Laffstr's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data Protection & Security

We implement industry-standard technical and organizational measures to protect your personal information — including sensitive data such as authentication credentials and OAuth tokens obtained through Google sign-in — against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption in transit: All data exchanged between your device and the Platform, and between the Platform and third-party services such as Google APIs, is encrypted using TLS/HTTPS.
• Encryption at rest: Personal information, including OAuth access and refresh tokens, is stored in our database (Supabase, built on PostgreSQL) with encryption at rest.
• Access controls: Access to stored data is restricted through database Row Level Security (RLS) policies and server-side authorization. Sensitive operations run only through privileged, server-side functions; OAuth tokens and other sensitive credentials are never exposed to client-side code or to other users.
• Least-privilege scopes: When integrating with third-party services such as YouTube, we request only the minimum, read-only permissions required to deliver the feature.
• Payment data handling: Payment card information is processed by PCI-compliant third-party payment processors; Laffstr does not store full card numbers on its own servers.
• Credential protection: Account passwords are hashed and salted by our authentication provider and are never stored in plain text.
• Monitoring and retention limits: We monitor for unauthorized access and retain sensitive data only for as long as needed to provide the associated feature or as required by law, after which it is deleted or de-identified.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at support@laffstr.com.

8. Advertising & Third-Party Cookies

Laffstr uses Google AdSense to display advertisements on our Platform. Google and its partners use cookies to serve ads based on your prior visits to this website and other websites on the internet.

Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to Laffstr and/or other sites. You may opt out of personalized advertising by visiting Google's Ads Settings.

You may also opt out of third-party vendor use of cookies for personalized advertising by visiting aboutads.info.

9. Your Choices & Controls

• Account profile visibility: You can control what profile information is visible to others (e.g., whether your full contact info is public or only venues you approve).
• Communication preferences: You may opt out of promotional emails (while still receiving service-related communications).
• Access, correction and deletion: You may access, correct or update your personal information via your account settings or by contacting us. You can request deletion of your account and associated data (subject to retention as required by law).
• Cookies & tracking: You can reject or delete cookies via your browser settings; however, some parts of the Platform may not function properly if you disable necessary cookies.
• Opting out of analytics/targeting: Where applicable, you may disable certain analytics or tracking features (via in-Platform settings or your browser/device settings).

10. Data Retention

We will retain your personal information for as long as your account is active or as needed to provide you services. We may retain certain information after account closure as required by law, to resolve disputes, enforce our agreements, or for legitimate business purposes.