Your information should follow your Event—not leak across it.
This notice explains the personal information Galaxy Cue collects, its sources and purposes, the people and providers that may receive it, retention, and individual choices.
Scope and legal roles
Galaxy Cue is operated by Galaxy Cue LLC, a Kentucky limited liability company. Effective August 7, 2026, this notice identifies Galaxy Cue LLC as the controller for Galaxy Cue’s own account, subscription, security, public-site, and product-communication purposes and as processor/service provider for Business-controlled Client and Event data where those roles apply. Any transfer of earlier pilot records must be documented and accompanied by notice, consent, or contractual action where required.
This notice applies to galaxycue.com, Business OS, Client Portal, Admin OS, Open Marketplace, support, and Galaxy Cue-controlled integrations. A Business generally determines the purpose of Client and Event data in its workspace; Galaxy Cue LLC processes that data through Galaxy Cue to deliver the platform. A Client Account is global and may connect to multiple Businesses. Each Event remains scoped to the selected Business and Client Account. One Business cannot see another Business’s private Event workflow.
Categories of information collected
| Category | Examples | Typical retention basis |
|---|---|---|
| Identifiers and profile | First and last name, verified email, phone, address, billing address, company, profile photo, date of birth, account identifier | Account and Client relationship |
| Business and professional | Business name, memberships, roles, service areas, capabilities, packages, plan, provider settings | Business account and legal records |
| Event and commercial | Requests, dates, time, duration, city/venue, contacts, guest count, consultation answers, quote, contract, retainer, final payment, expenses | Workflow, contract, accounting, disputes |
| Preferences and content | Music, timelines, notes, messages, documents, uploads, communication choices, marketing consent, media consent | Event, consent history, user choice |
| Technical and security | Authentication identifier, session data, device/browser details, IP/network logs, timestamps, diagnostics, audit events | Security, fraud prevention, service reliability |
| Connected-provider data | Email delivery status, social connection tokens, provider account IDs, hosted payment links and status | Integration operation and audit |
Galaxy Cue does not intentionally collect raw payment-card numbers, CVV codes, bank credentials, government identification numbers, precise geolocation, biometric templates, health diagnoses, or passwords. Do not place such information in forms, messages, files, or notes.
Sources
Information comes directly from users, Businesses, Client representatives, authorized team members, public booking links, Marketplace requests, account and Event activity, connected service providers, and technical/security logs. A Business may enter Client information during a phone or in-person meeting when it has authority to do so.
How information is used
- Create and secure accounts; verify identity and permissions.
- Connect Clients and Businesses; create, schedule, and operate Events.
- Deliver consultations, quotes, contracts, electronic signatures, retainers, planning, music, timelines, files, receipts, and messages.
- Match optional Marketplace opportunities to eligible Businesses by service and area.
- Send requested sign-in and workflow notices; send marketing only with the applicable consent.
- Provide support, maintain audit history, prevent abuse, troubleshoot, and improve reliability.
- Administer plans, accounting history, disputes, legal requests, and regulatory obligations.
Who receives information
Authorized Business members receive information for their Business’s Clients and Events. Authenticated Clients receive only client-facing information for Events linked to their account. Event Contacts or collaborators receive information only when the workflow and permissions authorize it.
Galaxy Cue uses service providers for cloud database/authentication/storage, static hosting, email, optional social publishing, and Business-selected hosted payments. See the Subprocessor List. Galaxy Cue may also disclose information to comply with law, protect safety and platform integrity, enforce agreements, handle a lawful corporate transaction, or respond to an authorized user request.
Open Marketplace disclosure
A Client must intentionally select Open Marketplace. The request may expose Event type, date, start time, duration, town/city or venue label, approximate area, requested service categories, and operational details needed for eligible Businesses to decide whether to respond. Full home address, full birth date, private messages, documents, payment credentials, and other Businesses’ workflows are not Marketplace fields.
When a Client selects a Business, that Business receives the information needed to create its separate Event workflow. This is an expected disclosure requested by the Client—not a sale of personal information.
Retention
Galaxy Cue keeps information only as long as reasonably necessary for the account, Event, consent record, security purpose, accounting obligation, dispute, or law. Cancelled incomplete operational Events use a 30-day archive period. Completed Events remain archived until authorized permanent deletion. Some non-operational accounting, consent, unsubscribe, security, and legal records may remain longer where necessary. Details appear in Storage & Retention.
Data rights and choices
Depending on applicable law, a person may have rights to confirm processing; access, correct, delete, or obtain a portable copy; opt out of sale, targeted advertising, or certain profiling; limit certain sensitive uses; withdraw optional consent; appeal a denied request; and receive non-discriminatory service. Galaxy Cue does not currently sell data, run cross-context targeted ads, or make qualifying high-impact decisions through automated profiling.
Use in-app Profile and communication controls when available. For another request, use the verified support channel and identify the affected account, Business connection, Client record, or Event ID. Galaxy Cue will verify identity and authority before acting. A Business may need to respond when it controls the Event information. See Data Rights & Deletion.
Communications and consent
Magic links, security alerts, contract notices, and Event next steps are transactional. Promotional email, birthday marketing, SMS, and media/social use are separate optional choices. Marketing email includes an unsubscribe method, and opt-outs are retained so the choice remains honored. Users may change eligible preferences per Business connection.
Security and incident response
Galaxy Cue uses authenticated access, role and tenant checks, row-level database policies on public data, private provider-secret storage, short-lived sign-in flows, audit records, typed confirmation for destructive actions, and least-necessary Client-facing views. Security controls are risk-based and continuously reviewed; no online service can guarantee absolute security.
When Galaxy Cue LLC confirms an incident affecting personal information, it will investigate, contain, restore, preserve required evidence, and notify affected Businesses, people, regulators, or providers when required by applicable law or contract. Timing and content depend on the data, protection, acquisition risk, affected jurisdictions, and the Business’s controller obligations. Review the Security Center and never submit passwords, one-time codes, API keys, raw card data, or government ID numbers.
International processing and Italy
Providers may process information in the United States and other locations described in their terms. For people in Italy or the European Economic Area, Galaxy Cue must document an applicable adequacy decision, EU Standard Contractual Clauses, or another lawful transfer mechanism before launch, together with any required transfer-impact assessment and supplemental safeguards. No transfer mechanism is represented as complete until the operator verifies and executes it.
The Italy & EU Supplement describes the intended GDPR legal bases, controller/processor roles, supervisory-authority complaint route, and remaining launch gates.
Children
Galaxy Cue is intended for adults and authorized adult Event organizers, not children. The platform should maintain an 18+ account rule unless counsel approves a guardian flow. Italy permits certain consent-based information-society processing from age 14, but that does not itself provide contractual capacity or make Galaxy Cue child-directed. Limited information about minors should be entered only by an authorized adult when genuinely necessary for an Event.
Changes and contact
Material changes receive a new effective date and notice or renewed acknowledgement when required. Before paid launch, Galaxy Cue LLC must publish its mailing address plus working privacy, security, accessibility, and support contact methods that remain available to people who cannot sign in. Until then, signed-in users should use the verified support channel in the applicable app and should never send secrets or payment credentials.