Privacy notice

Lineup Privacy Notice

Version dated 7 September 2026

This notice explains how Lineup handles personal data. The short version is: each Organiser is controller for its own Space Data and Lineup handles that data only as processor; Lineup is separately responsible for the limited account, security and service-administration data needed to run the service; people can find Spaces their Organisers make discoverable without sharing personal data merely by viewing them; choosing to join shares only the information shown for that choice; and we do not sell personal data or build advertising profiles.

1. Who is responsible

Lineup is operated by Carlos Montenegro, sole proprietorship, KVK 96085819, Tuigerstraat 60, 1033 PH Amsterdam, the Netherlands, at https://lineupapp.nl (Lineup, we). Privacy questions and requests can be sent through https://lineupapp.nl/contact or to carlos.montenegrovela@gmail.com.

Responsibility depends on why data is used:

• Each Space's Organiser is controller for that Space: this covers personal data submitted, imported, made available or created for the Organiser's community, group, project, network or other supported purpose. Lineup acts as processor for this Space Data under the Organiser Data Processing Terms.
• An account holder may be controller for a private professional or business workspace containing information about other people. Where data-protection law applies, Lineup acts as processor for those private records under the Organiser Data Processing Terms.
• For the limited personal data needed to operate Lineup, Lineup acts as controller only for its own service-administration purposes. This applies where Lineup independently decides the purposes and essential means: creating and securing accounts, authentication, account-wide settings, helping people navigate and choose Spaces, support, essential service administration, preventing misuse and meeting Lineup's own legal obligations. This Service Administration Data is limited to what is reasonably needed. This role gives Lineup no ownership or control over Space Data and no permission to reuse it for an unrelated purpose.

Where an Organiser makes a Space discoverable, people using Lineup may find it and choose to join. Browsing shares no personal data with the Organiser and does not make the person a Member. Before joining, Lineup shows what information will be shared. Once the person confirms, that information becomes separate Space Data for that Space; its Organiser is controller and Lineup acts as processor. Nothing is transferred from another Space.

Roles depend on who determines the purposes and essential means of each processing activity, not on who holds a physical or technical copy. Keeping information in the same account or technical system does not turn Space Data into Service Administration Data or give Lineup an independent right to use it. A Member may separately choose to provide information to another Organiser. The relevant controller is responsible for explaining its purposes, lawful basis and retention. You may contact that controller or Lineup; we will route a request where needed.

2. Data we handle and where it comes from

Depending on how you use Lineup, this may include:

• account, authentication and contact information;
• profile, professional and participation information you or an Organiser provides;
• Space membership, roles, access and visibility settings;
• content, communications, preferences, connections and activity within the service;
• records imported by an Organiser or saved in a private professional or business workspace;
• questions, feedback and privacy requests; and
• device, request, session, error and security information handled by Lineup and its service providers.

Data comes from you, from your use of the service, from an Organiser only through an agreed import, and from another controller only through the private professional or business workspace described in section 1. If an Organiser imports information about you under an agreed import, it is responsible for explaining what it imported, why it uses it and how you can exercise your rights, at the time required by law and any organiser-specific addendum.

Lineup may store essential session and interface preferences in your browser. We do not use advertising or cross-site tracking cookies.

3. Why we use it

For a Space, its Organiser decides the purposes and lawful basis for participation, access, visibility, communications and other activity it enables. The Organiser is controller for its Space Data; Lineup acts as processor and handles that data on the Organiser's documented instructions. When you separately join another Space and confirm the information shown for that choice, that Space's Organiser becomes controller only for its own Space Data and must explain its purposes, lawful basis and retention.

For the limited Service Administration Data described in section 1, Lineup uses the following purposes and legal bases:

• Providing your account and Lineup services: creating and authenticating your account, applying account-wide settings, helping you find and choose Spaces, and providing functions you request. This is necessary to perform our agreement with you or take steps you request. Space Data and controller-managed private records are handled for their respective controllers as explained in section 1.
• Security and service administration: preventing misuse, protecting accounts, diagnosing problems, maintaining the service and establishing or defending legal claims. This is based on our legitimate interests in running a safe and reliable service.
• Support: receiving and answering questions, feedback and privacy requests. This is based on your request and our legitimate interest in supporting the service.
• Legal obligations: keeping or disclosing limited information where applicable law or a valid authority request requires it.
• Product improvement: using anonymous or aggregated information that does not identify individuals to understand and improve Lineup.

We do not sell personal data, use it for third-party advertising or make solely automated decisions that produce legal or similarly significant effects. Any recommendation, connection or discovery tools are intended to assist people; people decide whether to participate or connect.

Information identified as required is needed for the relevant account, Space or function. Other information and visibility outside a Space are optional unless an Organiser lawfully makes them a condition of participating in its Space. If required information is not provided, the related service may not be available.

4. Who can see data

• Within a Space, information is available only according to that Space's configuration, the Organiser's lawful instructions and the choices shown to the person.
• You can discover and view another Space without sharing personal data with its Organiser. If you choose to join or share information, the separate-Space rule in section 1 applies. Lineup does not automatically reuse Space Data between Spaces.
• If a Space supports visibility beyond its signed-in Members, that visibility follows the Organiser's configured purpose and the separate choice presented to the person. Consent-based visibility can be withdrawn.
• Private communications, choices and controller-managed records are available only to their intended recipients or authorised controller, subject to security, support and legal access described in this notice.
• Each Organiser may access and export all personal data processed for its Space that is reasonably needed to fulfil its controller duties, including relevant fields not shown to ordinary Members where this is lawful and explained. An export does not include account credentials, security-sensitive information, another Organiser's Space Data or unrelated Service Administration Data.

We may disclose information where reasonably necessary to protect the service or people, investigate misuse, establish or defend legal claims, comply with law or respond to a valid authority request.

5. Service providers and safeguards

We use managed providers for database and authentication infrastructure, application hosting, operational logs, contact forms and service email. Current main providers are Supabase, Netlify and Resend.

The primary Lineup database is hosted in Frankfurt, Germany. The providers named above are used only to run Lineup and do not receive permission from Lineup to use personal data for unrelated purposes. If an identified provider needs to handle personal data outside the European Economic Area to provide the service, Lineup uses a GDPR transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, together with supplementary measures where required. Contact us for the provider, location and safeguard relevant to your data.

6. How long data is kept

We keep data only while needed for the relevant purpose:

• Account and authentication data normally remains while the account exists and is deleted when the account is deleted, subject to protected backups and limited records required for security, law or claims. Controller-managed private records follow that controller's lawful instructions and the Organiser Data Processing Terms.
• Leaving one Space closes access to that Space but does not by itself delete the Lineup account or data held for another Space or controller. Records shared with other people may remain where their rights or the relevant controller's lawful instructions require this.
• Space Data follows the relevant Organiser's lawful retention instructions and is returned or deleted when its processing ends. Active Lineup-held copies are deleted within 30 days after that Organiser's processing ends; backups remain protected and are deleted under documented retention schedules, whether managed by Lineup or its authorised providers.
• Contact-form and support messages are ordinarily deleted within 12 months after the request is closed, unless they remain needed for a continuing dispute, security issue, legal duty or claim.
• Essential security and operational logs are kept for up to 90 days unless a specific incident, investigation, legal duty or claim requires the relevant record for longer.

We may retain limited information for longer until the relevant legal duty is met or a claim and its applicable limitation period have ended. Anonymous information that no longer identifies anyone may be kept for product statistics.

7. Your choices and rights

Available settings may let you edit information, manage visibility, join or leave Spaces, obtain a copy of data or delete your account. Some requests must be handled by the relevant Space Organiser, and an Organiser may need to transfer or close its Space before deleting its own account so other people are not silently affected.

Depending on the circumstances, GDPR rights include access, correction, deletion, restriction, objection and data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing. Rights are not absolute; for example, information may need to be retained for another person's rights, a legal obligation or a legal claim.

Use https://lineupapp.nl/contact or email carlos.montenegrovela@gmail.com. We may ask for information needed to verify that the request concerns you. You may also complain to the Dutch Autoriteit Persoonsgegevens at https://www.autoriteitpersoonsgegevens.nl/en or bring a claim before a competent court.

8. Security, adults and changes

Lineup uses proportionate authentication, role- and Space-based access controls, encrypted connections and managed hosting and database services. No online service can promise absolute security. Please protect your sign-in codes and report suspected misuse.

Lineup is intended for adults. Organisers must not provide children's data, special-category data or criminal-offence data unless appropriate safeguards have first been agreed in writing.

We may update this notice when the service, providers or law changes. The current version and date will remain available at https://lineupapp.nl/privacy. Material changes will be highlighted where reasonably appropriate.