Privacy Notice

This notice explains how we collect and use personal information in ShowFlow, the tool we use to build the running order and cue sheets for our live shows.

Who we are

Who this notice is for

ShowFlow holds information about:

• Our team — staff who log in to build running orders and cue sheets.
• Performers and crew — the people who appear in a running order (for example performers, MCs and crew), including the real person behind a tribute act.
• People who fill in a running order — anyone we send a share link to, so they can add their song list or cues.

What information we collect

• Identity and contact details — name and, for performers and crew, a phone number, so the show team can reach the right people on the day.
• Running-order content — segments, song lists, sound-effect and pyro cues, timings and notes, and — where someone fills in a list via a share link — the name they give so we know who submitted it.
• Account and security data (team members only) — one-time sign-in codes (never stored in plain text) and session records.
• Records of our contact with you — the sign-in emails we send team members.

We do not ask for special-category information (such as health data) through ShowFlow. Please don't submit that kind of information in free-text fields.

Why we use it, and our lawful basis

What we do	Why	Lawful basis (UK GDPR)
Run team member accounts and keep the tool secure	So authorised staff can do their jobs safely	Legitimate interests / performance of a contract
Build the running order and hold performer/crew contact details	To plan and deliver the show and reach the right people on the day	Legitimate interests / performance of a contract
Let people fill in song lists and cues via a share link	So the running order is complete and accurate	Legitimate interests
Produce and share cue sheets and output sheets with the show team	So everyone has what they need to run the show	Performance of a contract / legitimate interests
Send sign-in emails via our email provider	To let team members log in securely	Legitimate interests

Who we share it with

We only share information with people who need it to deliver the event, and we limit what each party sees:

• Our own team, according to their role.
• People given a share link, who only ever see the one show's running order the link is for — via a unique, unguessable link — never anything else in the system.

We use a small number of trusted service providers ("processors") who handle data on our instructions only, under contract:

• Railway — secure hosting of the application and database.
• Brevo — sending our sign-in emails.
• Google — where a team member connects their Google account, ShowFlow saves a show's visuals to that person's Google Drive on their instruction.

We do not sell personal information or use it for advertising.

Where your information is held

Our application and database are hosted on Railway. Where a provider processes some data outside the UK/EU (for example a globally operated email or file-storage service), we rely on the appropriate safeguards required by law, such as UK-approved contractual clauses or an adequacy / "data bridge" arrangement.

How long we keep it

We keep personal information only as long as we need it to plan and deliver our shows and keep our records straight, then remove or anonymise it. Short-lived security items (like sign-in codes) expire automatically. You can ask us to remove your details at any time and we will do so unless we're required to keep them.

How we protect it

Access to the tool requires a login, and permissions are limited by role. Sign-in codes are hashed, sessions use secure browser cookies, all traffic is encrypted (HTTPS), the database is queried safely against tampering, and the share links we send are unguessable.

Your rights

You have the right to: access a copy of your information; ask us to correct it if it's wrong; ask us to delete it; withdraw consent or object to / ask us to restrict certain uses; and, where relevant, receive it in a portable format. To make a request, contact us at beth@groovebox.co.uk. We will respond within one month.

If you're unhappy with how we've handled your information, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to put things right first.

This notice may be updated from time to time; the date at the top shows the current version.