Privacy Policy

Effective date: August 19, 2026

This Privacy Policy explains how Atrium Music Ltd collects and uses personal data when you use the Atrium website and its iOS and Android apps (together, the "Platform").

1. Controller and contact

The controller responsible for the processing described in this Privacy Policy is:

Atrium Music Ltd, 86 North View Road, London, England, N8 7LP Email: contact@atrium.music

2. Who may use Atrium

Atrium accounts are intended only for people aged 18 or over. We do not knowingly allow children to create an account. If you believe that a person under 18 has provided personal data through an account, contact us.

3. Personal data we process

Depending on how you use the Platform, we process the following categories of personal data:

3.1 Account and profile data

  • name, email address, profile image, and authentication identifiers;
  • optional profile details such as bio, location, tags, and linked artist or social profiles;
  • your acceptance of the Terms and your analytics preference; and
  • account role and status information.

Authentication is provided by Clerk. Atrium does not store your password in its own database. Clerk processes login credentials and authentication data according to its own security and privacy terms.

3.2 Venue contributions

  • new venue suggestions and proposed changes to existing venue information;
  • comments and source information supplied with a suggestion;
  • venue reviews, ratings, answers, and information used to verify that a review describes a genuine experience; and
  • venue photographs, captions, categories, upload records, and internal moderation information.

Contributions are reviewed by Atrium administrators before publication. Verification and moderation information is not made public unless this is necessary and lawful.

3.3 Feedback and communications

When you send product feedback or contact us, we may process your message, email address if supplied, the page from which feedback was sent, language, user agent, and information needed to respond.

3.4 Technical and usage data

Our systems and service providers may process IP addresses, timestamps, browser and device information, operating system, security logs, requested pages, and similar technical information needed to deliver and protect the Platform.

If you enable notifications, we may store a device or web-push token needed to deliver them. We do not use advertising identifiers for behavioral advertising.

3.5 Analytics data

Identified product analytics through PostHog are optional and disabled by default. If you actively consent, we may associate product usage and error diagnostics with your Atrium account. We do not intentionally send private messages or form contents to PostHog. You can withdraw this consent in your profile at any time.

If you do not consent, Atrium does not enable identified PostHog analytics for your account.

4. Why we process personal data

We use personal data to:

  • create, authenticate, and manage accounts;
  • provide the venue directory on the website and apps;
  • receive and review venue suggestions, proposed changes, reviews, and photographs;
  • verify reviews and protect the reliability of the venue database;
  • communicate about submissions, support requests, safety, rights claims, and important service changes;
  • prevent misuse, investigate security incidents, and enforce our Terms;
  • operate, maintain, troubleshoot, and improve the Platform; and
  • comply with legal obligations and establish, exercise, or defend legal claims.

We do not currently use account data to administer a paid Atrium subscription or send marketing newsletters.

5. Legal bases

Depending on the processing activity and applicable law, we rely on:

  • performance of a contract where processing is necessary to provide your account and requested Platform features;
  • legitimate interests in operating a reliable venue directory, reviewing contributions, securing the Platform, responding to users, and improving our services;
  • consent for optional identified analytics and where consent is otherwise required; and
  • legal obligations and legal claims where information must be processed or retained by law or to protect legal rights.

Where we rely on legitimate interests, we consider the effect on your rights and interests. You can contact us for more information or object where applicable.

6. Publication and sharing

6.1 Public information

Approved venue information, reviews, and photographs may be published on the Platform. Reviews can be published without displaying the reviewer's identity. Venue photographs uploaded by users are normally displayed without a public photographer credit.

6.2 Service providers

We use service providers to operate the Platform. Depending on the feature, these include:

  • Clerk for authentication and account management;
  • Convex for application databases, backend functions, and file storage;
  • Vercel for web hosting and delivery;
  • PostHog for optional product analytics and error diagnostics;
  • Resend for transactional email and support communications; and
  • Google Maps Platform for maps, place information, and map-related functionality.

These providers process data according to our instructions or under their own applicable terms, depending on their role. They may use additional subprocessors.

6.3 Legal and organizational disclosures

We may disclose personal data when required by law, to protect a person's safety or rights, to investigate misuse, or in connection with a merger, financing, reorganization, or sale of all or part of the business. We do not sell personal data.

7. International transfers

Some service providers process data in the United Kingdom, the European Economic Area, the United States, or other countries. Where required, we rely on an adequacy decision, the UK International Data Transfer Agreement or Addendum, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. You can contact us for more information about safeguards relevant to your data.

8. Cookies and similar technologies

The Platform may use strictly necessary cookies or local storage for authentication, security, language preferences, and essential functionality.

PostHog analytics linked to your account are enabled only after you provide optional consent. You can withdraw that consent in your profile. Browser or device settings may allow you to control other cookies and local storage, but disabling essential technologies can prevent parts of the Platform from working.

9. Moderation and unpublished information

Venue suggestions, proposed changes, reviews, and photographs are placed in an administrative review queue before publication. Atrium may retain a moderation record long enough to review the contribution, prevent repeated abuse, document publication decisions, and handle legal or safety concerns. We do not promise that a contribution will be reviewed within a particular period.

10. Retention and account deletion

10.1 Account data: We retain account and profile data while your account is active. When your account is deleted, we delete or anonymize this data unless it must be retained for security, fraud prevention, legal obligations, or legal claims.

10.2 Venue data and reviews: Contributions to the shared venue database, including accepted venue suggestions, venue changes, and venue reviews, may remain after account deletion. We remove the association with the deleted account and retain the contribution in anonymized form.

10.3 Photographs: Venue photographs may remain available after account deletion under the continuing license granted in the Terms. We remove the association with the deleted account from the published and operational record, except for limited internal evidence needed to document the upload and image rights.

10.4 Verification data: Non-public contact and verification information is deleted or anonymized when it is no longer needed for moderation, rights documentation, fraud prevention, a dispute, or a legal obligation.

10.5 Technical records: Security, access, email, and operational logs are retained only as long as reasonably necessary for their purpose, subject to provider settings and legal requirements.

11. Your rights

Depending on where you live and the applicable law, you may have the right to:

  • request access to your personal data;
  • correct inaccurate or incomplete data;
  • request deletion of personal data;
  • restrict or object to processing;
  • receive certain data in a portable format;
  • withdraw consent at any time, without affecting earlier lawful processing; and
  • complain to a competent data protection authority.

These rights may be subject to legal limitations. For example, deleting an account does not require Atrium to remove anonymized venue information, reviews, or photographs that we are entitled to retain under the Terms and that no longer identify you.

To exercise a right, contact contact@atrium.music. We may need to verify your identity before completing a request.

12. Security

We use technical and organizational measures intended to protect personal data, including authenticated access, access controls, encrypted transmission, managed hosting, and administrative review of public contributions. Convex, our application database and storage provider, states that it is SOC 2 Type II compliant.

No online service can guarantee absolute security. Please protect your account credentials and contact us if you believe your account or personal data has been compromised.

13. Changes to this Privacy Policy

We may update this Privacy Policy when the Platform, our providers, or legal requirements change. We will publish the updated version and its effective date. We will communicate material changes in an appropriate way and request new consent where required.

14. Contact

Questions, requests, and complaints concerning personal data can be sent to:

Atrium Music Ltd, 86 North View Road, London, England, N8 7LP Email: contact@atrium.music