Privacy Policy

This Privacy Policy explains how Showrunner ApS ("Showrunner", "we", "us") handles personal data under the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven).

1. Identity & Contact Details

• Data Controller / Processor: Showrunner ApS
• CVR Number: DK46298020
• Address: Tornerosevej 106, 2730 Herlev, Denmark
• Email: info@showrunner.it

2. Dual Roles: Controller vs. Processor

Who controls personal data within Showrunner depends on the context:

Showrunner as Data Controller — Scope: account management, billing, login credentials, and direct B2B communication. Data subjects: venue account managers, billing contacts, workspace administrators.

Showrunner as Data Processor — Scope: data inside venue workspaces — ingested emails, uploaded artist contracts, tour manager contacts, promoter details, and ticket-buyer personal data. The Controller for this data is the Customer (the Venue / Event Promoter).

3. List of Approved Subprocessors

To deliver our cloud service, Showrunner engages vetted third-party vendors:

AI processing location. Automated extraction of ingested emails, attachments and images, and the optional in-app AI support assistant, both run on Amazon Bedrock in AWS's Frankfurt region (eu-central-1) using an EU-geography inference profile, which routes requests only to AWS Regions inside the European Union. Per AWS: “With Amazon Bedrock, your content is not used to improve the base models and is not shared with any model providers.” Model providers — including Anthropic, whose model Showrunner uses through Bedrock — do not have access to the AWS accounts in which Amazon Bedrock inference runs, and therefore have no access to Amazon Bedrock's logs or to Customer prompts and completions. Anthropic PBC therefore does not itself receive your data as part of this processing. Each workspace can additionally switch AI extraction off entirely in Settings; inbound mail is then received, stored and filed with its attachments, and no model call is made.

4. Marketing Sandbox Processing

Showrunner.it's public landing page includes an optional "Paste your own" sandbox that lets a visitor paste a booking email to see it extracted into a production record — no account required. Text pasted into the sandbox is sent to our AI subprocessor (Amazon Web Services, Amazon Bedrock in Frankfurt — see the subprocessor list above) solely to run that extraction and return the result to the visitor's browser. It does not leave the European Union.

• Never stored as a record: a sandbox run never creates a production record and is never associated with any venue's workspace.
• Never used for training: Amazon Bedrock does not use prompts or completions to train any model, and does not share them with the model provider — the same commitment that covers every other AI processing Showrunner performs.
• Transient only: the extraction job exists in the ingestion service's memory for a short window (minutes) to let the browser poll for the result, and is not written to any database.

5. Retention Policy (Trial, Archived & Cancelled Venues)

GDPR Article 5(1)(e) (storage limitation) requires that personal data be retained no longer than necessary.

• Active workspace data: retained for the duration of the commercial subscription (or active trial).
• Expired trial workspaces: an unused trial workspace is deactivated after 30 days of inactivity (with prior warning — see the Terms of Service). Its data is permanently erased within 90 days of deactivation.
• Lapsed/archived paid workspaces: when a venue cancels or a subscription lapses, the workspace transitions to a Read-Only archive. Data is retained for 90 days to allow the Venue to export records or renew service, following a 14-day email notice sent in advance of archiving.
• Permanent erasure: archived workspaces (whether from an expired trial or a lapsed paid subscription) are permanently hard-deleted after a further 90 days of archiving — the database records and ingested files are removed from production databases, and backup references expire within standard 30-day rotation cycles.
• Invoicing and accounting records: our own local subscription-billing mirror is deleted along with the rest of the workspace on the schedule above. The durable financial record — invoices, subscription and payment objects — is held by our payment processor (Stripe) and retained for 5 years as required by the Danish Bookkeeping Act (bogføringsloven), independent of and unaffected by the workspace-data erasure schedule above.
• Right to Erasure: regardless of the schedule above, an explicit Right to Erasure request under GDPR Art. 17 submitted by the Venue is honored within 30 days.

6. Cookies & Tracking Technologies

Showrunner operates without invasive tracking, analytics, or third-party marketing cookies.

Functional cookies used:

• sb-auth-token (session): essential for user authentication and security.
• user_locale: essential for maintaining UI language preferences.

Consent banner status: because Showrunner only uses strictly necessary functional cookies required for system operation, no cookie consent banner is required under the Danish Business Authority (Erhvervsstyrelsen) guidelines and the ePrivacy Directive.