memoro.

Privacy Policy

→ Verbindliche deutsche Fassung

This is a non-binding English translation provided for easier understanding. Only the German version — the Datenschutzerklärung — is legally binding. In case of any discrepancy, the German version prevails.

This Privacy Policy explains how personal data is processed when you use memoro. (available at memoro.live and the associated apps). Terms used are not gender-specific.

Last updated: 17 July 2026

Controller

Lukas Ketterer Hölderlinstraße 50A 70193 Stuttgart, Germany

E-mail: info@lukasketterer.de

Further details are available in the imprint.

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of data processed: inventory data (e.g. name); contact data (e.g. e-mail address); content data (e.g. concert entries, notes, profile information); usage data (e.g. pages visited, interaction with content and functions); meta, communication and process data (e.g. IP addresses, times of access).

Categories of data subjects: users of the online service and communication partners.

Purposes of processing: provision of the online service and its functions; security measures; contractual services and fulfilment of contractual obligations; communication; reach measurement.

Legal Bases

We process personal data on the following legal bases under the GDPR:

  • Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR) — to provide the service and your user account.
  • Legitimate interests (Art. 6(1)(f) GDPR) — e.g. security, abuse prevention, cookieless reach measurement, and enrichment of entries.
  • Consent (Art. 6(1)(a) GDPR) — where you have given it (e.g. certain notifications).

In addition to the GDPR, national data protection provisions in Germany (in particular the BDSG) apply.

Security Measures

We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. This includes access control, encryption of data in transit (TLS), and pseudonymisation where appropriate. Passwords for e-mail/password accounts are stored only as a cryptographic hash.

International Data Transfers

Some of the service providers we use are based in third countries (in particular the USA). Where personal data is transferred there, this is safeguarded by the EU-U.S. Data Privacy Framework (DPF) and/or the EU Standard Contractual Clauses (SCCs). Our primary database is hosted within the EU (Frankfurt am Main, Germany).

Rights of Data Subjects

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to lodge a complaint with a supervisory authority. You also have the right to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. You can delete your account at any time in the settings ("Delete account").

Hosting and Provision of the Online Service

To provide our online service, we use hosting and infrastructure providers. In this context, technically necessary server logs (including IP address, requested page, time of access) may be processed on the basis of our legitimate interests (Art. 6(1)(f) GDPR). Providers: Vercel Inc. (hosting/delivery, USA, DPF) and Supabase, Inc. (database, authentication and storage; server location Frankfurt am Main, Germany / EU).

Cookies

We use only technically necessary cookies (in particular for login/session and for storing your language preference). We do not use tracking or advertising cookies, and our reach measurement is cookieless (see "Web Analytics"). The legal basis for necessary cookies is our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR) and, where applicable, the performance of the contract (Art. 6(1)(b) GDPR).

Registration, Login and User Account

You can create a user account. Registration and login are done with an e-mail address and a self-chosen password. The password is stored only as a cryptographic hash. Data processed includes the e-mail address. We store the IP address and time of the respective action for security purposes.

  • Login with e-mail and password: registration and login are done with an e-mail address and a self-chosen password. The password is stored only as a cryptographic hash. To confirm registration and to reset the password, we send an e-mail with a confirmation or reset link via our provider Resend (see "Electronic Notifications"); legal basis: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).

Profiles can be public; you can control the visibility of your profile in the settings. When you delete your account, the associated account data is deleted, subject to statutory retention obligations.

Community Functions

memoro. offers community functions such as friend connections and shared concert memories. Content and information you provide within these functions may be visible to other users in accordance with your visibility settings; legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Contact and Enquiry Management

When you contact us (e.g. by e-mail), the data provided is processed to handle the enquiry; legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR).

Electronic Notifications (Tour Alerts & Account E-Mails)

We send transactional e-mails such as tour alerts and account e-mails (e.g. registration confirmation, password reset). For dispatch we use the provider Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA; DPF / SCCs). Processed data includes your e-mail address, your name and the content of the respective notification; legal bases: legitimate interests (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR), performance of a contract (Art. 6(1)(b) GDPR).

Web Analytics

We use Vercel Web Analytics, a cookieless reach measurement. No cookies are set and no cross-device profiles of individuals are created; only aggregated, anonymous statistics are derived from the request data (e.g. page visited, referrer, approximate location, device and browser type); provider: Vercel Inc., USA (DPF); legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Plug-ins and Embedded Content (Maps)

We embed maps. The map tiles are loaded directly in your browser from CARTO (USA, SCCs), transmitting your IP address to CARTO. Map data: © OpenStreetMap contributors (OpenStreetMap Foundation, ODbL); legal basis: legitimate interests (Art. 6(1)(f) GDPR).

External Services & Recipients

  • Supabase — database, authentication and storage; your account and concert data are held here. Server location: Frankfurt am Main, Germany (EU, eu-central-1). Processor; provider: Supabase, Inc., USA (any US access safeguarded by DPF / SCCs).
  • Vercel — hosting and delivery of the application; technically necessary server logs (incl. IP address). Processor; provider: Vercel Inc., USA (DPF).
  • Resend — dispatch of transactional e-mails. Processor; provider: Resend (Plus Five Five, Inc.), USA (DPF / SCCs).
  • Vercel Web Analytics — cookieless, aggregated reach measurement without personal profiles. Provider: Vercel Inc., USA (DPF).
  • Spotify — display of artist images and some genre/search information. Artist images are loaded directly from Spotify's servers into your browser when you open an artist page; your IP address is transmitted to Spotify in the process. The artist search itself runs server-side without transmitting any personal data of yours. Provider: Spotify AB, Sweden (EU); any transfer to US sub-processors is based on the DPF or standard contractual clauses.
  • CARTO / OpenStreetMap — map display; map tiles are loaded from CARTO (USA, SCCs), transmitting your IP address. Map data: © OpenStreetMap contributors.

Further content (setlists, festival line-ups, tour dates, genres, artist biographies, the geocoding of places, and the historical weather for the concert date) is retrieved by memoro. server-side from external sources — setlist.fm, Last.fm, Ticketmaster, MusicBrainz, publicly accessible official artist websites (structured event data), Photon (Komoot) and Nominatim (OpenStreetMap), as well as Open-Meteo (historical weather data, based in Switzerland). In doing so, no personal data about you is transmitted to these providers; only factual details such as artist name, place, coordinates or date are requested.

Changes to this Privacy Policy

We may amend this Privacy Policy to adapt it to changes in the law or to changes in the service. Where your involvement (e.g. consent) or notification is required, we will inform you accordingly. The German version is authoritative and is available at Datenschutzerklärung.