Privacy policy

1. Two kinds of information

Your account (your name, sign-in and the profile you fill in) is ours to look after, and this policy covers it.

A theatre’s records (who was cast, panel notes on an audition, ticket orders, its members) belong to the theatre. We hold them for the theatre, and the theatre decides what to keep. Questions about those records are best asked of the theatre; we will help it answer them.

2. What we collect

Only what running the service needs:

• Account: your name, email address and password (stored scrambled, never readable), or your Google sign-in.
• Profile, if you add it: phone, date of birth, pronouns, bio, photos, home area and the regions you follow.
• Household: people you apply or book for, such as a child, and who manages whose account.
• Auditions: your applications, your answers to a theatre’s questions, the times that suit you, and the time you are given.
• Shows: roles you are cast in or crew for, rehearsal calls, and your availability.
• Tickets: what you bought and your contact details for the order. Card payments go straight to the theatre’s own Stripe account; we never see your card number.
• Using the site: sign-in records, the device and browser you use, and pages you visit, kept to keep the service secure and working.
• Visits to theatres’, shows’ and auditions’ pages, counted with where they came from (a poster’s QR code, Facebook, a theatre’s website), so a theatre knows what is working. These are daily totals made from the request; nothing is stored on your device for them, and they do not follow you around the web.
• Where a ticket buyer came from, if you allow it (see Cookies): the source of your visit (a word like “facebook” or “poster”) is kept with your order, so the theatre can see which publicity sells tickets.

3. How we use it

• To run your account and the shows you take part in.
• To send the emails the service depends on: sign-in links, audition times, cast news, ticket confirmations. You choose which optional notifications you get.
• To keep the service secure, find faults and improve it.
• We do not sell your information, and we do not show advertising.

4. Who can see it

You choose how much of your profile each theatre sees, from nothing to everything, and can set it per theatre. While you are in one of a theatre’s shows (and for 90 days after it closes), or have an audition application in with it, you can share more with that theatre but not less, because the show needs to reach you. Withdraw the application, or wait out the 90 days, to share less.

A theatre you apply to sees your application. Cast and crew lists may appear on a show’s public page if the theatre publishes them.

Theatra’s own staff see information only to run and support the service.

5. Children

Each theatre sets the age under which a child’s account must be managed by a parent or guardian. A managed child’s emails go to that parent or guardian, who can see and change the child’s details and applications.

6. Services we use

Your information is stored in the United States and handled by these providers on our behalf, under their own security and privacy commitments:

• Vercel: hosting the website.
• Our database and cache hosts: storing the service’s data.
• Cloudflare: storing photos and files, and telling people from bots.
• Resend: sending email.
• Google: sign-in with Google, and the optional AI writing help (only the text you ask it to improve is sent).
• Mapbox: maps of venues.
• Stripe: payments, through each theatre’s own Stripe account.

7. Keeping and deleting

You can delete your account from your profile at any time. We wait 30 days in case you change your mind, and email you a link to undo it. After that your name, sign-in, contact details, profile, photos, audition applications and household and theatre links are removed.

Two things stay, because they are a theatre’s record rather than yours: the shows you were in, where you appear as “Former member”, and tickets, orders and payments, with the theatre that sold them, without your name or contact details. Tax records are kept for as long as the law asks.

Backups are kept for up to 30 days, after which deleted information is gone from them too. Security logs are kept for up to a year.

8. Your rights

You can ask to see the information we hold about you and to have it corrected. You can download a copy of it from your profile, and change most of it there; for anything else, email privacy@theatra.app. We will answer within 20 working days.

If you are unhappy with how we have handled your information, tell us first. You can also complain to the privacy or data protection regulator where you live.

9. Cookies

We keep only a few things on your device, and none for advertising or for following you across other websites. Most are needed for the site to work, or remember something you chose:

• Signing in (needed): a session cookie that keeps you signed in, for up to 30 days or until you sign out.
• Your choice about cookies (needed): remembers your answer to the question below, for six months.
• Settings you choose: light or dark mode in Theatre Manager, notification sounds, and an unsent audition application so it is not lost if the page closes, kept in your browser; and whether Theatre Manager’s menu is folded and which show it was showing, in small cookies so it opens the way you left it.
• Payments and spam protection (needed, set by others): Stripe sets cookies on the booking page to prevent card fraud, and Cloudflare checks you are not a bot when you sign up.
• Where you came from (only if you allow it): when you arrive from a poster, a post or another website, we remember that one word (“facebook”, “poster”, the website’s name) for seven days, so that if you book, the theatre can see which of its publicity worked. It holds nothing about you, and is not shared with anyone outside the theatre.

10. Your choice about cookies

In the European Economic Area, the United Kingdom and Switzerland, and wherever we cannot tell where you are, we ask before keeping where you came from, and keep nothing until you say yes. Elsewhere we keep it unless you say no. If your browser sends Global Privacy Control, we take that as a no everywhere.

You can change your answer at any time with “Cookie settings” at the foot of every page; saying no also removes what was kept.

11. If you are in Europe or the UK

For your account and how you use Theatra, Theatra is the controller of your personal data. For a theatre’s records (its applications, casts, members and ticket orders), the theatre is the controller, and Theatra processes them on its behalf and on its instructions.

We rely on these legal bases:

• Contract: to run your account, your applications and the tickets you buy.
• Legitimate interests: to keep the service secure and working, and to count visits in totals so theatres can see what works. These are balanced against your interests, and never used to profile you.
• Consent: to remember where you came from when you book (see Cookies). You can withdraw it at any time, without affecting what came before.
• Legal obligation: to keep records the law requires, such as those of payments.

12. Your rights in Europe and the UK

As well as seeing and correcting your information, you can ask us to delete it, to restrict or object to how we use it, and to give you a copy in a form you can take elsewhere. You can withdraw consent at any time. Ask at privacy@theatra.app; we will answer within a month.

Your information is stored in the United States. When it leaves your country, we rely on the protections the law recognises, such as the European Commission’s standard contractual clauses, the UK addendum to them, or the EU–US Data Privacy Framework where a provider is certified under it.

You can complain to the data protection authority where you live or work. In the UK, this is the Information Commissioner’s Office (ico.org.uk).

13. Security

Connections are encrypted, passwords are never stored readable, and two-step sign-in is available. No system is perfectly secure; if something goes wrong that puts you at risk, we will tell you and the regulators the law requires us to tell, as quickly as it requires.

14. Changes and contact

If we change this policy in a way that matters, we will say so on the site or by email before it takes effect.

Questions or requests: privacy@theatra.app.