Privacy Policy

1. Who We Are

CurtainCall (“we”, “us”, “our”) operates a production management platform for performing arts organizations. This policy explains what personal data we collect, how we use it, and your rights in relation to it.

2. Data We Collect

We collect the following categories of information:

• Account data: name, email address, organization name, and password (hashed).
• Performer data: names, emails, and payment details of performers and contractors you add to the platform.
• Usage data: pages visited, features used, browser type, IP address, and timestamps — collected automatically via logs.
• Payment data: billing information processed by Stripe. We do not store raw card numbers.
• Communications: any messages or support requests you send us.

3. How We Use Your Data

• To provide, maintain, and improve the Service.
• To authenticate users and secure accounts.
• To process billing and send receipts.
• To send transactional emails (confirmations, invites, magic links).
• To respond to support requests.
• To detect and prevent fraud or abuse.
• To comply with legal obligations.

We do not use your data to train AI models or sell it to third parties.

4. Third-Party Services

We share data with the following processors only to the extent necessary to operate the Service:

• Supabase — database and authentication hosting.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Vercel — application hosting and edge infrastructure.

Each processor is bound by their own privacy policies and data processing agreements.

5. Data Retention

We retain your account data for as long as your account is active. After account termination, data is retained for 30 days before permanent deletion, except where longer retention is required by law. You may request earlier deletion by contacting us.

6. Cookies

We use session cookies solely to maintain your authenticated session. We do not use tracking cookies or third-party advertising cookies.

7. Your Rights

Depending on your location, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Data portability (receive your data in a machine-readable format).

To exercise any of these rights, contact us at privacy@curtaincall.app. We will respond within 30 days.

8. Security

We implement industry-standard security measures including encryption in transit (TLS), encrypted storage, and strict access controls. No system is perfectly secure; we will notify you promptly in the event of a breach affecting your data.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by posting a notice in the Service. The “effective date” at the top indicates when this version took effect.

11. Contact

Questions or concerns about this policy may be sent to privacy@curtaincall.app.