Privacy & Cookie Policy

Effective date: 16/07/2026 · Version 1.0

This policy should be read with our Terms of Service.

1. Who we are

This Privacy & Cookie Policy explains how ShowStackLive (“ShowStackLive”, “we”, “us” or “our”) collects, uses and shares personal information when you use showstack.live and associated applications (the “Services”).

We are based in the United Kingdom and offer the Services globally. Additional representative or DPO details will be published here when available (TBA).

2. Services covered

This policy covers the ShowStackLive suite, including (as available):

  • StackTask
  • CueFlow
  • ShowPack
  • iWOZ
  • StackCap
  • StackBurst
  • North
  • ShowSpec
  • StackTranslate
  • StackConvert
  • StackRadar
  • CueUp
  • related hub pages and downloadable products such as Air-Gap-Cap (where applicable)

Some products may also display short product-specific notices (for example, participant photo consent or recording notices). Those notices apply in addition to this policy.

3. Controller and processor roles

Depending on the activity, ShowStackLive may act as a controller or a processor.

We typically act as controller for account registration, authentication, billing, support, security, abuse prevention and suite administration.

Where an event organiser, producer or business customer (“Organiser”) uses the Services to manage shows, speakers, crew, delegates, attendees, transcripts or uploaded event materials, the Organiser is typically the controller of that event-related information and ShowStackLive acts as a processor on the Organiser’s instructions. Business customers may be asked to enter into a separate Data Processing Agreement (TBA).

If you are a speaker, delegate or attendee and have questions about how your information was collected for a specific event, please contact the Organiser first. You may also contact us and we will help where we can.

4. Information we collect

Depending on the Service you use, we may process:

  • Account and authentication data: email address, user ID, optional name, one-time codes, and session information.
  • Collaboration and project data (StackTask): projects, tasks, notes, deadlines, collaborators and invitation emails.
  • Show and people data (CueFlow / ShowPack): speaker and crew profiles (name, email, phone, company, title, notes, photos), schedules, rooms, invitations, permissions, and related production information.
  • Speaker assets (ShowPack): presentations, biographies, headshots, video and other uploaded files, including version history.
  • Briefs (ShowSpec): contact and company details, venue and technical requirements, budgets and exported rider documents.
  • Audio, captions and translation (StackCap, StackBurst, StackTranslate): live audio streams, speech-to-text output, translations, recaps, usage metering, and related session metadata.
  • Audience / participant interactions: iWOZ wall messages and optional photos; StackBurst questions, ratings and optional asker details; pseudonymous device or delegate IDs; language preferences.
  • Uploads and conversions: logos, sponsor images, banners, PDFs submitted to StackConvert, and exported files.
  • Payments: order references, product purchased, amounts, billing status and limited payment metadata processed via Stripe. We do not normally receive full card numbers.
  • Communications: emails sent for sign-in codes, invitations, upload reminders, retention warnings, booking notices and support.
  • Marketing subscription data: email address and consent details (when and how you opted in) if you subscribe to tips, hints and product updates via our website form. We use double opt-in: you confirm via email before we add you to the list.
  • Technical and security data: IP address (for rate limiting / security), user agent, approximate usage timestamps, and infrastructure logs (retention TBA).
  • AI inputs / outputs: prompts, transcripts, images or other content submitted to AI-enabled features, and generated results.

5. How we use information

We use personal information to:

  • provide, secure and improve the Services;
  • authenticate users and manage accounts;
  • enable collaboration, event operations and exports;
  • process payments and entitlements;
  • send transactional messages;
  • send optional tips, hints and product updates where you have subscribed (consent);
  • detect abuse, spam and security threats;
  • comply with law; and
  • respond to support and rights requests.

Depending on the context, our lawful bases may include performance of a contract, legitimate interests (for example security and product operation), consent (for example marketing emails and certain participant photo or recording features), and legal obligation. Exact purpose-to-basis mapping for enterprise DPAs is TBA.

You can unsubscribe from marketing emails at any time via the link in each email or by contacting support@showstack.live. Unsubscribing does not affect transactional messages needed to operate your account.

6. Cookies and similar technologies

We use strictly necessary cookies and similar technologies for authentication, session management and security. We also use limited functional storage such as:

  • theme or UI preferences in localStorage;
  • OTP / request rate-limit cookies;
  • audience language or device identifiers for live sessions;
  • delegate identifiers for engagement features; and
  • short-lived submission rate-limit cookies (for example iWOZ).

We do not use tracking or marketing cookies.

More detail is also summarised on our Cookies page.

7. Secret links and token access

Some Services use bearer links, event codes or tokens (for example speaker portals, tech consoles, moderator links, signage pages and public walls). Anyone with a valid link or code may access the associated content or controls.

Organisers must treat private links as confidential credentials and revoke or replace them if disclosed. Link leakage is outside ShowStackLive’s control once a valid link has been shared.

8. Recipients and subprocessors

We use trusted service providers to operate the suite. Depending on the product, these may include:

  • Supabase — authentication, database and some file storage
  • Vercel — application hosting
  • Cloudflare R2 — private object storage for some uploads
  • Stripe — payments
  • Resend — transactional and marketing email (including subscription lists)
  • Upstash — rate limiting / caching where used
  • Speech-to-text providers such as AssemblyAI, Gladia and Deepgram (product-dependent)
  • Translation / AI providers such as Google Cloud Translation, Microsoft Azure Translator, OpenAI, Google Gemini and Anthropic (product-dependent)

Provider regions, contractual transfer mechanisms (UK IDTA / SCCs) and a published subprocessor register are TBA and will be updated here.

9. AI and automated processing

Some Services send content to AI or speech providers to generate captions, translations, summaries, risk/advisory text, avatars or other outputs. Those providers process the content only as needed to deliver the feature, subject to their terms and our configuration.

AI outputs may be inaccurate. Organisers must provide appropriate notices before recording, transcription, translation or AI image features are used with participants.

10. Retention

Retention varies by product. Purchase validity (how long paid capacity can be used) is separate from how long event data is kept after an event.

  • ShowPack: stale shows are warned and purged after short post-event windows (around 14 days after the last room date, with a shorter grace period for manual deletes).
  • StackCap: transcript segments/exports are deleted around 14 days after the relevant live day; billing/account metadata may be retained longer.
  • StackTranslate: event/session content is hard-deleted around 14 days after the last event day.
  • iWOZ: free events may be auto-deleted around 14 days after the event date; paid/pro retention TBA.
  • ShowSpec: briefs are intended to expire after about 14 days (automated purge status TBA).
  • StackConvert: staging PDFs are deleted after successful conversion; failed/abandoned upload cleanup TBA.
  • StackTask, CueFlow, StackBurst, North, StackRadar: retention / automated purge schedules TBA; organisers should export important data before deleting workspaces.
  • Payments and legal records: retained as required for accounting, fraud prevention and legal compliance (period TBA).

11. International transfers

We are UK-based. Some providers may process data in the UK, EEA, United States or other countries. Where personal data is transferred internationally, we will use appropriate safeguards required by UK GDPR (for example UK IDTA / SCCs) once documented (TBA).

12. Children

Account holders must be at least 18. The Services are primarily intended for professional and event-production use.

If an Organiser allows young people to participate in an event, the Organiser is responsible for suitability, notices, permissions and safeguarding. Organisers must not enable participant photographs, public contributions or AI image features for children unless they have established a lawful and appropriate process.

13. Your rights

Under UK GDPR and related laws, you may have rights to access, correct, delete, restrict or object to certain processing, and to data portability, subject to legal exceptions.

To exercise rights relating to your ShowStackLive account, contact support@showstack.live. If your request relates to event data controlled by an Organiser, we may redirect you to that Organiser or handle the request jointly.

You may also complain to the UK Information Commissioner’s Office (ICO). Our ICO registration number is TBA.

14. Security

We use industry-standard measures appropriate to our hosting providers, including encrypted transport (HTTPS), access controls, row-level security where configured, signed or private storage URLs for sensitive uploads, webhook verification for payment events, and rate limiting for authentication and public endpoints.

No method of transmission or storage is completely secure. Organisers remain responsible for securing secret links, exports and on-site devices.

15. Changes

We may update this policy from time to time. We will identify the effective date at the top. Material changes may be notified by email or through the Services where practicable. Continued use after the effective date constitutes acceptance where permitted by law.

16. Contact

See also our Terms of Service.

← Back to ShowStackLive