Privacy
Zempel is a tool festivals use to organise themselves. That means information about artists, volunteers and partners ends up with us. This page says what we store, where, for how long, and what you can ask for.
Who is responsible
The festival using Zempel decides which information goes in and why. It is the data controller for its own data. Zempel processes that data on the festival's behalf, as a data processor.
For sign-in, your account and enquiries through zempel.no, Zempel itself is responsible. Zempel is run by SpaceMonkey in Bergen, Norway. Questions go to hei@zempel.no.
What we store
About you when you sign in: email address, name and optionally phone number, and which festivals you have access to.
About artists: name, contacts, technical rider, hospitality (including allergies where the artist provides them), guest list, files the artist uploads, and internal fields such as fee. Internal fields are visible to festival staff only.
About volunteers: name, phone, email, shifts and the issues you report.
About partners: company name, contact person, agreement and logo.
About you when you send an enquiry from zempel.no: name, festival, email and what you write.
We do not store payment details, national identity numbers or plain-text passwords. Sign-in uses a one-time email link or a password stored encrypted by Supabase.
Where it lives
The database and files are hosted by Supabase in Frankfurt (EU). The website runs on Vercel. Email is sent through Resend from servers in Ireland (EU). All three are our data processors and bound by data processing agreements.
We use Vercel Analytics to count visits. It sets no cookies and does not store your IP address.
Who sees what
Access is enforced in the database, not just on screen. An artist sees their own card and nobody else's. A volunteer sees their own shift, the daily plan and the contacts the festival has marked as visible. Staff see what they have been given responsibility for. Fees and internal notes are never shown to artists or volunteers.
Zempel does not read the content of festivals, except when troubleshooting at a festival's request.
For how long
A festival's data stays as long as the festival has a Zempel account. When the festival deletes an artist, volunteer or agreement, the data is deleted immediately, including files.
Enquiries from zempel.no are deleted no later than one year after they arrive.
Your account is deleted when you ask, or when you are no longer a member of any festival and have not signed in for two years.
Your rights
You can ask to see what is stored about you, have it corrected, or have it deleted. If the information was entered by a festival, the festival answers and we help them. If it concerns your account or an enquiry, we answer ourselves. Write to hei@zempel.no.
If you believe we handle data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).
Cookies
Zempel only uses cookies needed to keep you signed in. No tracking, no ads, no third-party cookies.
Changes
When this page changes, the date at the top changes with it. Changes that matter to you are announced by email.