Privacy Policy

From DJs (REQ mobile app users)

• Email address and authentication credentials (Supabase Auth).
• Stage name, slug, profile image URL, minimum request amount, Instagram handle.
• Stripe Connect account identifier and payout status flags (no banking details are stored on REQ servers — Stripe handles them).
• Device push notification token (Expo) for incoming-request alerts.
• Session history (requests received, accepted, declined).

From requesters (audience scanning the QR)

• Email (optional, used for receipt and waitlist if you opt in).
• Song title and artist you typed in the request form.
• Payment information: handled directly by Stripe Checkout. REQ never sees your card number, CVC, or expiry — only the resulting payment intent ID and amount.
• Anonymised technical data (IP, device type) via Vercel logs and Stripe.

• Operate the request flow (display the DJ, route requests, send push notifications).
• Process payments through Stripe (authorise, capture on DJ accept, cancel on decline or 60-minute timeout).
• Pay out DJs via Stripe Connect.
• Prevent fraud, debug issues, comply with legal obligations.
• Send opt-in product updates if you joined the newsletter.

• Supabase — database & authentication (privacy).
• Stripe — payments & Connect payouts (privacy).
• Vercel — web hosting & logs (privacy).
• Expo — push notification delivery for the mobile app (privacy).
• Airtable — newsletter list storage when you opt in (privacy).

REQ does not sell your data. We do not run third-party advertising trackers.

When you request a song, your card is authorised but not charged immediately. The amount is captured only after the DJ accepts your request. If the DJ declines or does not respond within 60 minutes, the authorisation is automatically cancelled — your bank releases the hold and no funds leave your account.

We publish a chart of the most requested tracks on reqdj.com. It is built from requests that were paid for and accepted by a DJ, and it is aggregated and anonymous.

The chart contains only the track title, the artist name and the number of times it was requested. It never contains the identity of the person who requested it, the DJ, the venue, the amount paid, or the date and time of the request.

A track only appears above a threshold: at least 3 requests, spread across at least 2 different DJs. That threshold exists so that no row in the chart can be traced back to a particular night, DJ or person.

Legal basis: our legitimate interest (GDPR art. 6(1)(f)) in promoting the service and documenting how music is requested. The published result is aggregated and therefore no longer personal data.

Track titles are free text typed by the audience. We automatically exclude entries containing a web address, an email address or a run of digits. If you nonetheless find personal information in the chart, email contact@dirtylab.fr and we will remove it.

Account data is retained for as long as your REQ account exists. Request and payment records are retained for accounting and legal obligations (typically 10 years in the EU) — but the first name, message and e-mail address left with a request are automatically erased 90 days after it: only the track, the amount and the payment references remain. Push tokens are deleted as soon as the device unregisters or the token becomes invalid.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, rectify, port, restrict, or delete your data, and to lodge a complaint with your local data protection authority (in France, CNIL).

To exercise any of these rights, email us at contact@dirtylab.fr.

REQ is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has used REQ, contact us and we will delete the data.

We may update this policy. Material changes will be flagged on this page and, for DJs, communicated via in-app notice. The "last updated" date at the top reflects the current version.

Questions? Email contact@dirtylab.fr.