Privacy notice.

Who operates this website

AUB Music Club, through its current Cabinet, operates this student-run club website and is responsible for handling the personal information collected through it. The club is based at the American University of Beirut in Beirut, Lebanon.

This website supports club activities. It does not replace the University's official systems. AUB's own privacy statement explains its institutional practices.

Information we use and why

• Accounts: your name, account email and authentication information let you register, sign in and recover access. A name, email and password are required to create an account. Authentication is handled through Supabase Auth.
• AUB status and membership: an AUB email, verification status, official membership-roster information, membership requests and review notes help establish eligibility. Creating an account does not itself grant club membership. AUB verification is optional for a general account, but some services require verified status or membership.
• Optional profiles: a photo, instruments, genres and a short bio help members connect. You can leave these fields empty and control which optional fields appear in the member directory.
• Club activities: event registrations, artist applications and demo links, room bookings, equipment reports and support requests contain the details you submit, their status and any review information. We use them to organize activities, allocate club resources and respond to requests. Fields marked required are needed to submit that particular request.
• Account administration and security: access roles, suspension reasons, activity audit records, verification attempts and technical request information help administer accounts, enforce permissions and prevent misuse.
• Communication: the newsletter preference records whether you want occasional club announcements. It is off by default. Emailing the club also provides your address and message so we can respond.

Please include only information needed for the activity or request. Avoid sensitive personal information about yourself or others in bios, notes, booking titles and uploaded content.

Who can see information

Authorized club managers can access records relevant to their responsibilities. Administrators have broader account and operational access.

Active, unsuspended members can see other active members' names in the member directory. Your name is not hidden by the optional visibility controls. Your photo, instruments, genres and bio follow their separate sharing choices; your account email is not a directory field.

The member room calendar shows reserved times and the booking's shared title. Other members do not receive the booking owner or private purpose through that calendar. Avoid putting private information in the shared title.

Membership notes and membership-request review notes are accessible to the person they concern. A suspension reason is shown to the account holder. Public events, announcements and published Cabinet profiles can be viewed without signing in.

Service providers and countries

• Supabase provides the database, authentication and file storage. Our primary production project is in Seoul, South Korea. Supabase privacy information.
• Netlify hosts the website and runs its server functions, processing requests to deliver and secure the service. Netlify privacy information.
• Cloudflare Turnstile checks browser and connection signals on protected account forms to detect automated abuse. Cloudflare also uses signals to improve its bot detection. Turnstile privacy information.
• Google/Gmail handles the support mailbox and secondary AUB verification email. Account confirmation and recovery email are delivered through Supabase Auth and its configured mail service. Messages may remain in the relevant mailboxes. Google privacy information.

These providers may process information outside Lebanon, including outside the primary database region. External sites, such as Instagram, event registration forms and music-demo services, have their own privacy practices when you open their links.

Cookies and browser storage

We use authentication cookies to keep you signed in and refresh your session. Short-lived cookies remember the email entered during confirmation or password recovery; those expire after 15 minutes or are cleared when that step completes. Draft form values are kept in the current form's memory, rather than saved in browser storage.

Cloudflare may use security cookies depending on its challenge configuration. The website currently has no advertising or analytics tracking integration. Blocking necessary cookies or the security check can prevent account functions from working.

Your choices and requests

You can update your profile, change optional directory sharing and remove your profile photo from your account. To stop optional announcement emails, clear the newsletter option and save your profile. Account verification and recovery messages are separate from that choice.

You can contact the club to request a copy of your personal information, correction, erasure or to raise an objection to its use. There is currently no self-service account-deletion or full-data download button. A request is handled by the club and may require verification that it concerns your account.

The club must assess requests under applicable law. Any need to retain particular information for a lawful purpose should be explained in its response; the absence of an automatic deletion button does not remove your rights.

How long information remains

Account and club activity records currently remain stored without an automatic retention schedule. Operational records, audit entries, roster data and email copies do not all disappear when an activity ends. Retention periods and a complete deletion process are still being established.

Contact the club if information is no longer needed, is incorrect or should be erased. This notice will be updated when the retention and deletion arrangements change.