Privacy Policy

1. Who we are

StagePlot Live ("we", "us", "our") is operated by Insanely Awesome Productions LLC, registered at Sharjah Media City, Sharjah, United Arab Emirates. For privacy questions, contact [email protected].

2. What we collect

• Account data: email address, sign-in identifiers, optional display name.
• Project content: stage plots, input lists, uploaded images, and other content you create. This content may itself contain personal data about third parties (e.g. performer or crew names) that you choose to enter — see "Content about other people" below.
• Collaboration data: if you share a project, we store the email address you invite (to manage access) and show your display name to the people you collaborate with while you're in a shared project.
• Billing data: we do not store payment cards. Our merchant of record (Lemon Squeezy) processes payments and stores the necessary records on its own infrastructure.
• Operational & security data: request logs, diagnostic error reports (via Sentry), anonymized usage statistics via Plausible (no cookies, no cross-site tracking), and asset-access logs tied to your account (for abuse detection and to protect our content — see "Content protection" below).

3. Why we process it

• To run your account and deliver the service (contractual basis under GDPR Art. 6(1)(b)).
• To bill subscriptions, prevent fraud, and meet tax obligations (legitimate interest / legal obligation).
• To improve the product based on aggregate usage patterns (legitimate interest).

4. Sub-processors

• Supabase — authentication, database, and edge functions; hosts your account and project data. (Confirm the project's hosting region before publishing.)
• Cloudflare — hosting/CDN for the marketing site and the application (Cloudflare Pages), plus email routing for our support address.
• Lemon Squeezy — merchant of record: payment processing, billing records, and tax remittance. We never receive or store your card details.
• Resend — transactional email delivery (sign-up confirmation, password recovery, account notices).
• Sentry — application error monitoring; receives diagnostic error reports that may include limited technical context.
• Plausible Analytics — privacy-respecting, cookieless aggregate analytics on the marketing site.

5. Retention

Account and project data are retained while your account is active and for up to 90 days after account deletion to accommodate undelete requests. Backups are kept for 30 days. Aggregated, non-identifiable analytics may be retained longer.

6. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, port, or object to processing of your data, plus the right to lodge a complaint with your supervisory authority.

• EU / UK (GDPR / UK GDPR): full set above.
• California (CCPA / CPRA): right to know, delete, correct, and opt out of "selling/sharing" — we do not sell or share personal information for cross-context behavioral advertising.
• UAE (PDPL): comparable rights of access, correction, and deletion.

Email [email protected] to exercise any of these rights. We respond within 30 days.

7. International transfers

Where data is transferred outside the European Economic Area or the UK, we rely on standard contractual clauses (SCCs) with our sub-processors and apply appropriate technical safeguards.

8. Cookies and local storage

Our marketing site uses no cookies. The application (app.stageplot.live) does not use advertising or tracking cookies either; to keep you signed in it stores a strictly-necessary authentication token in your browser's local storage. Because there are no non-essential cookies, no cookie-consent banner is required.

9. Sharing and collaboration

If you share a project, the people you invite can view (and, with edit access, change) that project's content, and can see your display name while present in it. We store the email address you invite so we can grant and manage that access. We do not otherwise disclose your projects to other users.

10. Content about other people

Stage plots and input lists you create may contain personal data about third parties — for example performer, crew, or contact names. For that content you are the data controller and we act as your processor: we store and process it only to provide the Service to you. You are responsible for having a lawful basis to include such data and for responding to those individuals' requests; we will assist where required by law.

11. Content protection

To protect our intellectual property (the asset library) and detect abuse, we keep access logs associated with your account (including IP address and browser user-agent) and may embed a marker tied to your account in assets and exports we deliver to you. This lets us trace unauthorized redistribution. These markers identify the account, not the people shown in your plots, and we use them only for security and enforcement.

12. Changes

We will update this page when our practices change and notify existing users by email when changes are material. The "last updated" date at the top of this page reflects the most recent change.