Privacy & Cookie Policy

This Privacy & Cookie Policy explains how Showappy (“Showappy”, “we”, “us” or “our”) collects, uses and shares personal information when you use showappy.com and associated applications (the “Services”).

• Operator: [LEGAL ENTITY TBA], trading as Showappy
• Postal address: [TRADING ADDRESS TBA]
• Company number: TBA
• VAT number: TBA
• ICO registration: TBA
• Privacy / support contact: support@showappy.com
• Legal contact: contact@showappy.com

We are based in the United Kingdom and offer the Services globally. Additional representative or DPO details will be published here when available (TBA).

This policy covers the Showappy suite, including (as available):

• Projects
• Schedule
• Signage (Now & Next screens)
• Speaker Content Manager
• Social Wall
• Live Captions
• Takeaways & Q&A
• North
• AV Brief
• Live Translation
• Toolbox
• Destinations
• DJ Requests
• related hub pages and downloadable products such as Live Captions Offline (where applicable)

Some products may also display short product-specific notices (for example, participant photo consent or recording notices). Those notices apply in addition to this policy.

Depending on the activity, Showappy may act as a controller or a processor.

We typically act as controller for account registration, authentication, billing, support, security, abuse prevention and suite administration.

Where an event organiser, producer or business customer (“Organiser”) uses the Services to manage shows, speakers, crew, delegates, attendees, transcripts or uploaded event materials, the Organiser is typically the controller of that event-related information and Showappy acts as a processor on the Organiser’s instructions. Business customers may be asked to enter into a separate Data Processing Agreement (TBA).

If you are a speaker, delegate or attendee and have questions about how your information was collected for a specific event, please contact the Organiser first. You may also contact us and we will help where we can.

Depending on the Service you use, we may process:

• Account and authentication data: email address, user ID, optional name, one-time codes, and session information.
• Collaboration and project data (Projects): projects, tasks, notes, deadlines, collaborators and invitation emails.
• Show and people data (Schedule / Speaker Content Manager): speaker and crew profiles (name, email, phone, company, title, notes, photos), schedules, rooms, invitations, permissions, and related production information.
• Speaker assets (Speaker Content Manager): presentations, biographies, headshots, video and other uploaded files, including version history.
• Briefs (AV Brief): contact and company details, venue and technical requirements, budgets and exported rider documents.
• Audio, captions and translation (Live Captions, Takeaways & Q&A, Live Translation): live audio streams, speech-to-text output, translations, recaps, usage metering, and related session metadata.
• Audience / participant interactions: Social Wall messages and optional photos; Takeaways & Q&A questions, ratings and optional asker details; pseudonymous device or delegate IDs; language preferences.
• Uploads and conversions: logos, sponsor images, banners, PDFs submitted to Toolbox, and exported files.
• Payments: order references, product purchased, amounts, billing status and limited payment metadata processed via Stripe. We do not normally receive full card numbers.
• Communications: emails sent for sign-in codes, invitations, upload reminders, retention warnings, booking notices and support.
• Marketing subscription data: email address and consent details (when and how you opted in) if you subscribe to tips, hints and product updates via our website form. We use double opt-in: you confirm via email before we add you to the list.
• Technical and security data: IP address (for rate limiting / security), user agent, approximate usage timestamps, and infrastructure logs (retention TBA).
• AI inputs / outputs: prompts, transcripts, images or other content submitted to AI-enabled features, and generated results.

We use personal information to:

• provide, secure and improve the Services;
• authenticate users and manage accounts;
• enable collaboration, event operations and exports;
• process payments and entitlements;
• send transactional messages;
• send optional tips, hints and product updates where you have subscribed (consent);
• detect abuse, spam and security threats;
• comply with law; and
• respond to support and rights requests.

Depending on the context, our lawful bases may include performance of a contract, legitimate interests (for example security and product operation), consent (for example marketing emails and certain participant photo or recording features), and legal obligation. Exact purpose-to-basis mapping for enterprise DPAs is TBA.

You can unsubscribe from marketing emails at any time via the link in each email or by contacting support@showappy.com. Unsubscribing does not affect transactional messages needed to operate your account.

We use strictly necessary cookies and similar technologies for authentication, session management and security. We also use limited functional storage such as:

• theme or UI preferences in localStorage;
• OTP / request rate-limit cookies;
• audience language or device identifiers for live sessions;
• delegate identifiers for engagement features; and
• short-lived submission rate-limit cookies (for example Social Wall).

We do not use tracking or marketing cookies.

More detail is also summarised on our Cookies page.

Some Services use bearer links, event codes or tokens (for example speaker portals, tech consoles, moderator links, signage pages and public walls). Anyone with a valid link or code may access the associated content or controls.

Organisers must treat private links as confidential credentials and revoke or replace them if disclosed. Link leakage is outside Showappy’s control once a valid link has been shared.

We use trusted service providers to operate the suite. Depending on the product, these may include:

• Supabase — authentication, database and some file storage
• Vercel — application hosting
• Cloudflare R2 — private object storage for some uploads
• Stripe — payments
• Resend — transactional and marketing email (including subscription lists)
• Upstash — rate limiting / caching where used
• Speech-to-text providers such as AssemblyAI, Gladia and Deepgram (product-dependent)
• Translation / AI providers such as Google Cloud Translation, Microsoft Azure Translator, OpenAI, Google Gemini and Anthropic (product-dependent)

Provider regions, contractual transfer mechanisms (UK IDTA / SCCs) and a published subprocessor register are TBA and will be updated here.

Some Services send content to AI or speech providers to generate captions, translations, summaries, risk/advisory text, avatars or other outputs. Those providers process the content only as needed to deliver the feature, subject to their terms and our configuration.

AI outputs may be inaccurate. Organisers must provide appropriate notices before recording, transcription, translation or AI image features are used with participants.

We keep your work for as long as you need it, and the same rules apply in every app. Purchase validity (how long paid capacity can be used) is separate from how long event data is kept after an event.

• While your account is open: your work stays, apart from the rules below.
• When you delete something: a project, show, brief, event, room, wall or team member disappears straight away. We keep it for 30 days in case it was a mistake: write to support@showappy.com within that time and we can bring it back. After 30 days it is erased for good, with its files.
• After a show (Projects, Schedule & Signage, Speaker Content Manager): a show is erased 12 months after its last day, so last year's show is still there to copy. We email the owner 30 days before, with ways to keep a copy. Projects task lists that aren't tied to a show don't expire.
• After an event (Live Captions, Live Translation, Takeaways & Q&A, Social Wall, DJ Requests): an event is erased 90 days after its last day, with an email to the owner 14 days before, reminding them to download what they need. That includes what guests sent: wall posts and photos, music requests and selfies, questions, and transcripts.
• Briefs (AV Brief): a brief is erased 90 days after it was started, finished or not, with an email to the owner 14 days before, reminding them to export it.
• Items without a date: where a show or tracker has no dates, we count from its last change instead.
• Inactive accounts: an account that hasn't been used for 12 months is deleted, as below. We email 30 days and 7 days before. Signing in once keeps everything.
• When you delete your account: your own work is deleted straight away. Work you share with others is kept for 7 days and they are emailed, then it is deleted. What you added to other people's work stays there, without your name.
• Payment records: kept for 6 years for tax and accounting, with your name and email address removed once the work they paid for is deleted.
• Backups: deleted data can remain in our database backups for up to 7 days.
• Technical records: Live Translation clears its caption logs and duplicate checks after 14 days. Toolbox deletes uploaded PDFs after conversion.
• North and Destinations: Destinations keeps no account data. North will follow these rules once it uses your Showappy account (TBA).

We are UK-based. Some providers may process data in the UK, EEA, United States or other countries. Where personal data is transferred internationally, we will use appropriate safeguards required by UK GDPR (for example UK IDTA / SCCs) once documented (TBA).

Account holders must be at least 18. The Services are primarily intended for professional and event-production use.

If an Organiser allows young people to participate in an event, the Organiser is responsible for suitability, notices, permissions and safeguarding. Organisers must not enable participant photographs, public contributions or AI image features for children unless they have established a lawful and appropriate process.

Under UK GDPR and related laws, you may have rights to access, correct, delete, restrict or object to certain processing, and to data portability, subject to legal exceptions.

To exercise rights relating to your Showappy account, contact support@showappy.com. If your request relates to event data controlled by an Organiser, we may redirect you to that Organiser or handle the request jointly.

You may also complain to the UK Information Commissioner’s Office (ICO). Our ICO registration number is TBA.

We use industry-standard measures appropriate to our hosting providers, including encrypted transport (HTTPS), access controls, row-level security where configured, signed or private storage URLs for sensitive uploads, webhook verification for payment events, and rate limiting for authentication and public endpoints.

No method of transmission or storage is completely secure. Organisers remain responsible for securing secret links, exports and on-site devices.

We may update this policy from time to time. We will identify the effective date at the top. Material changes may be notified by email or through the Services where practicable. Continued use after the effective date constitutes acceptance where permitted by law.

• Privacy / support: support@showappy.com
• Legal: contact@showappy.com
• Postal address: [TRADING ADDRESS TBA]