Last updated: 2026-07-25
Who we are
Estelle is operated by Amitay (individual, based in the Netherlands), trading as Estelle and thebits.club ("we", "us", or "our"). We are the data controller for personal data described in this Privacy Policy.
Our website is hiestelle.com. Our Terms of Use govern your use of the service.
Scope
This Privacy Policy applies when you use Estelle's beta booking assistant and related pages on hiestelle.com. It is written for performers who create an account as natural persons.
What we collect
We collect the following categories of personal data:
- Account and profile — email address, name, performer type, city, city coordinates (latitude and longitude), website or social profile, phone number, and free-text notes you provide at signup or in Settings.
- Authentication — login credentials handled by our auth provider (passwords are hashed; we do not store plain-text passwords). If you sign in with Google, we receive your Google account identifier and email as provided by Google.
- Booking activity — venues and events you shortlist or select, booking request status, and related workflow data.
- Technical and service data — session identifiers, request identifiers, page paths logged as event sources, HTTP status codes, error codes, and IP addresses processed in server logs for security and debugging. We do not use advertising analytics such as Google Analytics or PostHog.
- Email engagement — delivery, open, and click events for emails we send, collected via our email provider when tracking is enabled.
- Venue and booker contacts — names, email addresses, and related contact details of venue staff or organizers obtained from public sources to provide scouting results. This is personal data of third parties, not of Estelle users.
Why we use your data and legal bases
Under the AVG (EU GDPR), we process personal data only with a valid legal basis:
| Processing | Legal basis |
|---|---|
| Creating and managing your account, scouting, shortlists, and booking workflow | Performance of a contract (Art. 6(1)(b) AVG) |
| Booking-related emails to you and, when you approve venues, outreach to bookers using your profile | Performance of a contract and your instructions (Art. 6(1)(b) AVG) |
| Optional beta product emails | Consent (Art. 6(1)(a) AVG) — you can withdraw in Settings or via unsubscribe links |
| Optional new event notification emails | Consent (Art. 6(1)(a) AVG) — you can withdraw in Settings or via unsubscribe links |
| Security, abuse prevention, and service debugging logs | Legitimate interests (Art. 6(1)(f) AVG) — protecting the service and users, with minimal metadata and short retention |
| Email open and click metrics | Legitimate interests (Art. 6(1)(f) AVG) — measuring service email quality, not for targeted advertising |
| Google Places city autocomplete on signup and Settings | Performance of a contract (Art. 6(1)(b) AVG) — needed to set your performance city |
AI and automated processing
Estelle uses artificial intelligence to search for venues, verify contact paths, and prepare booking-related content. Inputs may include your city, performer type, and related profile context. Outputs may be inaccurate or incomplete.
- You choose which venues Estelle may pursue; outreach is not sent to venues you have not approved.
- We use OpenAI via API. Under OpenAI's API terms, data submitted through the API is not used to train OpenAI's public models unless you separately opt in to such use with OpenAI.
- We do not make solely automated decisions that produce legal or similarly significant effects about you (Art. 22 AVG).
Sharing and subprocessors
We share personal data only as needed to run Estelle:
- Supabase — hosting, database, authentication. Privacy policy
- Mailgun — transactional email delivery and engagement tracking. Privacy policy
- OpenAI — AI scouting and verification. Privacy policy
- Google — Places city autocomplete on signup and Settings. Privacy policy
- Cloudflare — content delivery and security (if used for hiestelle.com). Privacy policy
- Venues and bookers — when you approve outreach, we may share relevant profile fields (such as your name, email, performer type, and pitch context) with the venue or organizer you selected.
Subprocessors act on our instructions under data processing agreements where required.
International transfers
Some subprocessors are located outside the European Economic Area (including the United States). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and, where applicable, participation in the EU-US Data Privacy Framework by the recipient.
Data retention
- Account and profile data — until you delete your account or ask us to erase it, unless a longer period is required by law.
- Product logs — up to 30 days, after which they are purged automatically.
- Email engagement events — stored in product logs for up to 30 days.
- Authentication sessions — for the lifetime of your session and as configured by our auth provider.
- After account deletion — profile and booking data are removed; some log records may be anonymized rather than deleted where needed for aggregate security analysis.
Your rights
Depending on your location, you may have the right to access, rectify, erase, restrict, or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time without affecting prior processing.
You can:
- Update profile and email preferences in Settings
- Delete your account in Settings (permanent)
- Unsubscribe from optional emails via links in those emails or Settings
- Contact us at amitay@hiestelle.com for access, export, or other requests
If you are in the EU or EEA, you may lodge a complaint with your local supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (AP).
Security
We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, database row-level security, and logging practices that avoid storing passwords, tokens, or full email content in application logs.
Cookies and similar technologies
- Strictly necessary — browser storage for authentication session (localStorage), signup draft (sessionStorage), and anonymous log session identifiers. These are needed for the service you request.
- Google Places — when you use city autocomplete on signup or Settings, Google may process data such as your IP address and search input under its own terms (see Google’s privacy policy).
- No targeted advertising cookies — we do not use cookies for cross-context behavioral advertising.
Children
Estelle is not directed at anyone under 18. Do not use the service if you are under 18.
California residents
We do not sell or share personal information for cross-context behavioral advertising as defined by the California Consumer Privacy Act (CCPA/CPRA). California residents may contact us to exercise applicable rights. We do not require a "Do Not Sell or Share My Personal Information" link at our current scale.
Changes
We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated date. If changes materially affect how we use your data, we will notify active users by email where required by law.
Contact
Questions about this Privacy Policy? Email amitay@hiestelle.com.