Ember Shores 2026 — "Vote The Lineup"

The Site and Campaign are intended only for individuals 18 years of age or older. You must affirm that you are 18 or older to create an account and vote. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it promptly. If you believe a minor has provided us information, contact privacy@tourq.co.

To create your account and process your votes, we collect and use the following. This processing is necessary to participate — if you vote, this is the baseline that applies.

Partial form data. If you begin signing up — as a fan or an artist — and enter information into the form (such as your name, email, artist name, or Instagram handle) but do not complete registration, we may retain what you entered so that we can follow up with you and improve the service. We never capture or store your password in this way.

Account and sign-in information

You may create your account by entering your name and email directly, or by signing in with Google or Spotify. When you use a sign-in provider, we receive only the basic profile information that provider returns for identity and account creation:

• Google: your name, email address, and account identifier.
• Spotify: your display name, email address, and Spotify account identifier.

We do not access your Google contacts, files, or calendar, and we do not access your Spotify listening history, private playlists, library, or playback unless you give us separate, explicit permission through a clearly labeled request (see Section 4). If you never grant that separate permission, we never collect that data. Our use of Google and Spotify sign-in is also governed by those providers' API terms and policies. Separately, we use our own Spotify API credentials to look up artist profiles in Spotify's public catalog from our servers (for example, to populate artist search on the apply-to-perform page); those lookups do not access your Spotify account.

If you apply as an artist

If you submit an application through our apply-to-perform page, we additionally collect: the Spotify artist name and Spotify artist identifier of the act you represent, the Instagram handle you provide, the contact email for the application, and a one-time verification code issued by us. An administrator reviews this information to verify that the person submitting the application controls the Instagram account they claim, before approving the artist for the ballot. We may also retain notes about the approval, rejection, or revocation of the application.

Voting data

The artists you select and how you allocate your votes. Each verified participant starts with 5 votes and can unlock up to 15 additional votes (20 total) by completing optional challenges — see Section 4A. You may distribute your votes across artists however you choose, including placing multiple votes on a single artist, up to the number of votes you have earned.

Technical and security data

IP address, device type, browser, operating system, and usage events such as pages visited and vote timestamps. We use this strictly to operate the Site, prevent fraud and duplicate voting, and secure the Campaign.

Submissions you choose to make

Content from optional features such as referrals, artist suggestions, "share your vote," or support requests.

How we use this information

We use the information in this Section to:

• Create and verify your account
• Tally your votes in real time
• Generate the public leaderboard described in Section 6
• Detect and prevent fraud, abuse, and security threats
• Operate and improve the Site
• Meet our legal obligations

Account creation includes a tourQ participant record. Creating an account to vote means a participant record exists within tourQ's systems. By itself, this record is used only to run the Campaign and the functions above. It is not used to send you marketing, and it is not shared with artists, unless you opt in under Section 3 or 4.

We will send you marketing or promotional messages only if you affirmatively opt in by checking the relevant box(es) at the time you vote. Opting in is not required to vote, and your vote counts the same either way.

When you opt in, you choose what you want:

• Ember Shores / festival news (ticket access, lineup announcements, festival updates).
• tourQ platform updates (news about the platform that helps artists manage their live careers).
• SMS / text messages — available only if you provide a mobile number and separately check the SMS consent box. By checking it, you give express written consent to receive automated marketing texts at that number; consent is not a condition of voting or any purchase; message and data rates may apply; reply STOP to opt out.

You can withdraw any marketing consent at any time using the unsubscribe link in any email or by replying STOP to texts, or by contacting privacy@tourq.co. Withdrawing marketing consent does not remove your vote from the tallies or leaderboard, and does not by itself delete your account.

The following happen only with your separate, explicit opt-in:

Sharing with artists you voted for

If you choose, we will share your name and email with the specific artists you voted for (and their management or label) so those artists can add you to their fan list and contact you directly. This is off by default. If you do not opt in, your identity is never shared with any artist. Once an artist receives your information, their own privacy policy governs how they use it.

Extended Spotify or Google data

If you want personalized features that rely on your music taste, we will ask for separate, clearly labeled permission before accessing any Spotify listening or taste data. You can use the entire Campaign without ever granting this, and you can revoke it at any time in your Google or Spotify account settings.

Because sharing your information with artists (and their management and labels) for their own marketing may be considered a "sale" or "share" under certain U.S. state laws, we treat it that way and give you control over it — see Section 8.

You start with 5 votes and can unlock up to 15 additional votes (20 total) by completing optional challenges. Participating in challenges is voluntary; you can use your 5 base votes without completing any. Depending on the challenge, completing it may involve:

• Social sharing. Sharing the Campaign on social platforms. When you share, the relevant social platform's own privacy policy governs what it collects from that action; we receive only confirmation that the share occurred and basic referral attribution.
• Referrals. Inviting friends to participate. If a challenge asks you to refer someone, only provide contact information for people who have agreed to hear from you. When you submit a referral, we collect the referred person's name and/or email solely to send a one-time invitation to participate and to attribute your referral. We do not add referred people to marketing or artist lists unless they themselves participate and opt in. A referred person can decline the invitation and request deletion of their information at any time by contacting privacy@tourq.co. You are responsible for having permission to share another person's contact information with us.
• Account or follow actions. Some challenges may ask you to follow an artist or the festival on a connected platform (e.g., Spotify, Instagram). Where a challenge involves connecting Spotify or Google, we access only the basic profile information described in Section 2; we do not access listening history, playlists, or other extended data unless you grant separate permission under Section 4. Completing these actions is subject to the relevant platform's terms.

Unlocked votes are tied to your verified participant account. We use fraud-prevention controls to enforce the 20-vote cap and to detect duplicate accounts, automated voting, and abuse of the challenge system. Votes have no cash value, are not transferable, and confer no ownership or guarantee that any artist will be booked.

tourQ uses aggregated and de-identified voting and demand signals (information that does not identify you personally) to power its fan-intelligence, demand-forecasting, and booking-recommendation features. We do not use your identifiable personal information for these platform features unless you have opted in under Sections 3 or 4. Public leaderboard outputs (Section 6) are aggregate counts only.

Vote totals contribute to a real-time public leaderboard that shows aggregate results by artist. Your name and email are never publicly displayed. Only anonymized, aggregated counts appear. Your individual selections are not shown to other participants.

Beyond the opt-in artist sharing in Section 4, we share information only as follows:

• Service providers / processors. Vendors who host the Site, deliver email/SMS, run analytics, and provide fraud detection and support. They are bound by contract to use your data only to provide services to us and to protect it. Our key sub-processors are:
  • Supabase — database, authentication, and file storage that hold participant accounts, ballots, and artist applications.
  • Spotify Web API — server-side lookups against Spotify's public artist catalog (no access to your Spotify account); also the optional Spotify sign-in described in Section 2.
  • Our transactional email service — sends Campaign emails from notify.embershores.vote, including sign-in confirmations, artist-application updates, and any marketing you opt into.
  • Lovable — the application platform on which the Site is built and hosted.
  Where artist verification asks an applicant to send a direct message to our Instagram account, that is a manual action taken by the applicant on Instagram; we do not transfer your data to Instagram as part of that step.
• Ember Shores organizers and production partners. To coordinate the festival, lineup decisions, and Campaign execution, on a need-to-know basis.
• Legal and safety. When required by law, subpoena, court order, or government request, or to protect the rights, safety, or property of the Organizers or others.
• Business transfers. In a merger, acquisition, financing, reorganization, or asset sale, your information may transfer as part of that transaction; the successor will be bound by this Policy or will provide notice.

We do not sell your personal information for money. We treat the optional artist-sharing in Section 4 as a "share/sale" for the purposes of state privacy law and let you control it (Section 8).

8.1 Everyone

You may request to access, correct, or delete your personal information, and you may withdraw consent to optional processing at any time. To exercise any right, email privacy@tourq.co or use the in-Site controls. We will verify your identity before acting on a request. We may retain limited data where the law allows (e.g., fraud records, legal compliance). Withdrawing consent does not affect processing that already occurred and does not remove votes from historical tallies or the aggregate leaderboard.

8.2 California Residents (CCPA/CPRA)

You have the right to:

• know the categories and specific pieces of personal information we collect;
• know whether we disclose, "sell," or "share" it;
• opt out of the "sale" or "sharing" of your personal information;
• correct or delete your information;
• limit the use of sensitive personal information;
• and not be discriminated against for exercising these rights.

"Do Not Sell or Share My Personal Information." Because optional artist-sharing (Section 4) may qualify as a "sale" or "share," we provide a "Do Not Sell or Share My Personal Information" link on the Site and honor opt-out preference signals (such as Global Privacy Control) where required. Because artist-sharing is opt-in, you are not in it unless you choose to be — and you can opt back out at any time.

Categories collected (see Section 9), the business purposes for each (Sections 2–7), and the categories of recipients (Section 7) are disclosed in this Policy.

You may use an authorized agent to submit requests with proper authorization.

8.3 EU/UK/EEA Residents (GDPR/UK GDPR)

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. Our legal bases are:

• Consent — for marketing, SMS, artist-sharing, and any extended Spotify/Google data access (Sections 3–4).
• Performance of a contract — to create your account and process your votes (Section 2).
• Legitimate interests — fraud prevention, security, operating/improving the Site, and following up on abandoned signups by retaining partial form data for a limited period, balanced against your rights. You may object to the abandoned-signup follow-up at any time by emailing privacy@tourq.co and we will delete the partial record without further conditions.
• Legal obligation — where we must comply with law.

You may lodge a complaint with your local supervisory authority. For international transfers, see Section 11. For data-protection inquiries, contact privacy@tourq.co.

We do not intentionally collect government IDs, financial account numbers, precise geolocation, or special-category/sensitive data. If you voluntarily submit such information (e.g., in a support message), please don't — we don't need it.

We retain personal information only as long as needed for the purposes in this Policy or as the law requires:

• Account and voting records: retained for the duration of the Campaign and a reasonable period afterward for auditing, dispute resolution, and fraud records, then deleted or de-identified.
• Marketing contact data: retained until you unsubscribe or withdraw consent, then suppressed/deleted.
• Artist-shared data: once shared at your request, retention by that artist is governed by the artist's own policy.
• Partial form data: retained for up to 90 days from the last update, then deleted, unless you complete signup. Completed accounts then fall under "Account and voting records" above.
• Aggregated/de-identified data: may be retained indefinitely because it no longer identifies you.

Your information may be processed in the United States and other countries where the Organizers, artists, or service providers operate, which may have different data-protection laws than your home country. Where required, we use appropriate safeguards such as Standard Contractual Clauses to protect transferred data.

We use cookies and similar technologies — including your browser's localStorage — to operate the Site, prevent fraud, analyze usage, and improve the Campaign. The localStorage keys we set are essential to the Site's function and include:

• Session continuity — a per-browser session identifier so we can recognize you across page loads while you sign up or vote.
• Draft preservation — your in-progress vote selections and in-progress apply-to-perform application, so a refresh doesn't lose your work.
• Referral attribution — the referrer code that brought you to the Site, so we can credit the right person if you complete signup.

You can manage non-essential cookies through your browser settings. Clearing localStorage will discard any in-progress draft and require you to sign in again, but won't affect ballots already submitted.

We use reasonable administrative, technical, and physical safeguards to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and regulators as required by law.

We may update this Policy. For material changes, we will post the revised Policy on the Site, update the "Last Updated" date, and — where the change affects how we use information you already provided — seek fresh consent or give notice before applying it to you.

tourQ Privacy Team — privacy@tourq.co

For Ember Shores festival inquiries: official channels at embershores.com.

California "Do Not Sell or Share" and other rights requests: use the Site link or email privacy@tourq.co.