Privacy Policy

Marrow is an online marketplace connecting Irish venues with DJs, singers, and bands. We are operated by Marrow (contact: hello@joinmarrow.ie). We are the data controller for the personal data we collect through joinmarrow.ie.

• Account data: your name, email address, password (hashed), and account type (artist or venue).
• Profile data: display name, artist type or venue name, city, bio, genres, demo links, and profile photo.
• Transaction data: booking amounts, payment status, and Stripe payment identifiers. We do not store card numbers — these are handled securely by Stripe.
• Communications: messages sent between artists and venues through the platform.
• Usage data: pages visited, actions taken, and technical logs (IP address, browser type) for security and debugging.
• Waitlist data: email address if you signed up to be notified at launch.

• To provide the Marrow marketplace service (matching artists with venues, processing bookings).
• To process payments securely via Stripe Connect.
• To send transactional emails (booking confirmations, application updates, payout notifications).
• To notify you of new gig applications or booking activity relevant to your account.
• To maintain the security and integrity of the platform.
• To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for advertising.

We process your data on the following legal bases:

• Contract: processing necessary to provide the service you signed up for.
• Legitimate interests: platform security, fraud prevention, and service improvement.
• Consent: for the waitlist, where you explicitly opt in to receive launch communications.

• Supabase — our database and authentication provider. Data is stored on secure servers. See Supabase Privacy Policy.
• Stripe — payment processing. Stripe handles all card data directly and is PCI-DSS compliant. See Stripe Privacy Policy.
• Resend — transactional email delivery (booking confirmations etc.). See Resend Privacy Policy.

We do not share your data with any other third parties without your consent, except where required by law.

Marrow uses only functional cookies required to keep you logged in (session cookies managed by Supabase Auth). We do not use tracking cookies, advertising cookies, or third-party analytics. No cookie consent banner is required for strictly necessary cookies under Irish/EU law.

We retain your account data for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance (e.g. Stripe transaction records).

As a user in the EU/EEA, you have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your account and data ("right to be forgotten").
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Restriction: request that we limit how we process your data.

To exercise any of these rights, email us at hello@joinmarrow.ie. We will respond within 30 days.

You also have the right to lodge a complaint with the Data Protection Commission (Ireland's supervisory authority).

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and row-level security on our database. No system is 100% secure — if you suspect a security issue, contact us immediately at hello@joinmarrow.ie.

We may update this policy as the platform evolves. We will notify active users of significant changes by email. The "Last updated" date above will always reflect the most recent version.

For any privacy questions or data requests: hello@joinmarrow.ie