Privacy notice
Who we are
- Trading name
- StagePath
- Registered name
- Needed: registered business name, for the legal pages
- Company number
- Needed: company registration number, for the legal pages
- Registered address
- Needed: registered business address, for the legal pages
- Contact
- Needed: the contact email address
Our two roles
StagePath is software that venues use to run their shows. That means we handle personal data in two different ways, and it matters which one applies to you.
- Venue data: the venue is in charge, we are the processor. A venue puts its own staff, volunteers, promoters, hirers, mailing-list contacts and ticket buyers into StagePath. For that data the venue decides what is collected and why (the "controller"), and we only store and process it on the venue's instructions (the "processor"). If you are one of those people, the venue's own privacy notice is the one that applies to you, and you should ask the venue about your data. We will pass on anything sent to us. The terms we work under are thedata processing addendum in our Terms.
- Our own customers: we are in charge. For the people who create a StagePath account, for people who use this website, and for billing and support, we decide what is collected and why, so we are the "controller". The rest of this notice is about that.
What we collect about people with an account
- Your first and last name, your email address and your password. We never store the password itself, only a one-way hash of it.
- Which venues you belong to and your role in each, and when you last signed in.
- When you accepted our Terms and Privacy notice, and which version.
- For the person who sets a venue up: the venue's name, address, phone number, email and website, and your role there.
- Billing details. Payments go through Stripe, so your card details are entered on Stripe's pages and never reach our servers. We keep your email address, plan, and the invoice and payment status Stripe sends back.
- Messages you send us, and anything you send through the in-app feedback form (including the page you were on).
- Technical records: our server keeps a record of requests (the time, the page address without anything after a question mark, and whether it worked), and an error log that stores the error, the page address and the account involved. Where a StagePath administrator acts on a venue's account to help with a problem, we keep an audit record of what they did.
While you set up a venue, the address you type is sent to OpenStreetMap's Nominatim service to suggest matching addresses. It receives the text you type and your IP address.
Visitors to this website
This website does not use analytics, advertising or tracking, and sets no cookies. It loads nothing from other companies: its fonts and everything else come from us. The pricing page asks our own server for the current plan prices. Our web server keeps ordinary access records (the time, your IP address, the page and the result) for security and to fix faults. The sign-in, create-account and public form pages use Cloudflare Turnstile, a bot check. It receives your IP address and information from your browser. The cookies page lists everything that is stored on your device or loaded from elsewhere.
Why we use it
| What we do | Our lawful basis (UK GDPR) |
|---|---|
| Create and run your account, and provide the service | Contract: we need to, to do what you signed up for. |
| Take payment and keep invoices | Contract, and legal obligation (accounting and tax records). |
| Send service emails (verify your email, reset your password, security and billing notices) | Contract, and legitimate interests in keeping accounts secure. |
| Bot checks, error logs, audit records and security | Legitimate interests: keeping the service safe and working. |
| Answer your messages and support requests | Legitimate interests, and contract. |
We do not use consent for any of this, because we do not use non-essential cookies or send marketing emails about StagePath itself. If that changes we will update this notice first and ask for consent where the law requires it.
Drafting note: check these bases with a solicitor, and decide whether StagePath will ever send its own marketing emails (none exist in the product today).
Who else handles it
We use these companies to run StagePath. Some are used for every account, and the last group only if a venue chooses to connect them. The venue is told about changes through the terms (see the addendum).
| Company | What they do and what they receive | Where |
|---|---|---|
| Hostinger (virtual private server) | Runs StagePath and its database. Everything we store is on this server. | Data centre location not yet confirmed. |
| Amazon Web Services S3 | Stores uploaded files (documents, forms attachments, training PDFs, certificates, images) when file storage is switched on. | London (eu-west-2). |
| Stripe | Takes payment for subscriptions. Card details go to Stripe and never reach our servers. We send the account holder's email address and receive the plan, invoice and payment status. | Stripe processes in several countries. Transfer terms to be confirmed. |
| ZeptoMail (Zoho) | Sends the service emails: verify your email, reset your password, shift and rota emails to staff, task and document reminders. | EU endpoint (api.zeptomail.eu). |
| Mailtrap | Sends mailing-list emails (campaigns and automations) that venues choose to send to their own contacts. | Not yet confirmed. |
| Cloudflare (Turnstile) | The bot check on sign-in, sign-up and public forms. Our server also asks Cloudflare whether a check passed. | Cloudflare processes in many countries. Transfer terms to be confirmed. |
| OpenStreetMap (Nominatim) | Suggests addresses while a venue is being set up. It receives the address text typed and the visitor's IP address. | Run by the OpenStreetMap Foundation. Location not confirmed. |
| Eventbrite (only if a venue connects it) | Only if a venue connects its own account: ticket orders (including buyer name and email) are pulled into that venue's StagePath. | Run by the ticketing company. |
| Ticket Tailor (only if a venue connects it) | Only if a venue connects its own account: ticket orders (including buyer name and email) are pulled into that venue's StagePath. | Run by the ticketing company. |
| Dice (only if a venue connects it) | Only if a venue connects its own account: ticket orders (including buyer name and email) are pulled into that venue's StagePath. | Run by the ticketing company. |
| TicketSource (only if a venue connects it) | Only if a venue connects its own account: ticket orders (including buyer name and email) are pulled into that venue's StagePath. | Run by the ticketing company. |
| TryBooking (only if a venue connects it) | Only if a venue connects its own account: ticket orders (including buyer name and email) are pulled into that venue's StagePath. | Run by the ticketing company. |
| Spektrix (only if a venue connects it) | Only if a venue connects its own account: ticket orders (including buyer name and email) are pulled into that venue's StagePath. | Run by the ticketing company. |
We do not sell personal data. We do not use it to advertise. We do not use analytics or advertising services.
Transfers outside the UK
Our own server and file storage are in the UK as far as we know (see the table for what is confirmed). Some of the companies above, such as Stripe and Cloudflare, process data in other countries. Where they do, the transfer has to be covered by an approved safeguard such as the UK's adequacy regulations, or the standard contract terms approved by the Information Commissioner's Office.
Drafting note: confirm the hosting location and, for each company, which transfer mechanism applies, then say so here.
How long we keep it
- Sign-in sessions: 24 hours, or 30 days if you tick "Keep me logged in". Expired sessions are cleared out every hour.
- Your account and the records above: for as long as the account exists.
- Invoices and payment records: as long as the law requires us to keep accounting records.
- Venue data: the venue controls it. For example, a venue's retention settings delete unconverted enquiries after a period the venue sets (24 months unless it changes it), and anonymise contacts who have been unsubscribed for a period the venue sets.
Drafting note: the product does not yet delete account records, audit logs, error logs or support messages automatically, and there is no self-service way to delete an account. Decide the periods, build them, and update this section (tracked as a separate ticket).
Your rights
You can ask us to give you a copy of your personal data, correct it, delete it, limit how we use it, or move it to another service, and you can object to uses based on legitimate interests. Email us at the address at the top of this page. The law gives us one month to reply. Because deleting an account is not a self-service button yet, ask us and we will do it for you.
If your data is in a venue's StagePath (as a member of its staff, a promoter or a contact on its mailing list), ask the venue first. People on a venue's mailing list can also use the unsubscribe and preferences links in the emails.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put it right first.
Security
Passwords are stored as one-way hashes. The sign-in cookie is not readable by scripts on the page. Connections to StagePath use HTTPS. Access to venue data is limited by role inside each venue. No system is perfectly secure, and if a breach affects personal data we will tell the people and venues affected without undue delay.
Changes to this notice
The version and date are at the top of the page. If we make a change that matters, we raise the version number and signed-in users see a notice in the app asking them to accept the updated terms.