Privacy Policy

This Privacy Policy explains how Showrunner ApS ("Showrunner", "we", "us") handles personal data under the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven).

1. Identity & Contact Details

• Data Controller / Processor: Showrunner ApS
• CVR Number: DK46298020
• Address: Tornerosevej 106, 2730 Herlev, Denmark
• Email: info@showrunner.it

2. Dual Roles: Controller vs. Processor

Who controls personal data within Showrunner depends on the context:

Showrunner as Data Controller — Scope: account management, billing, login credentials, and direct B2B communication. Data subjects: venue account managers, billing contacts, workspace administrators.

Showrunner as Data Processor — Scope: data inside venue workspaces — ingested emails, uploaded artist contracts, tour manager contacts, promoter details, and ticket-buyer personal data. The Controller for this data is the Customer (the Venue / Event Promoter).

3. List of Approved Subprocessors

To deliver our cloud service, Showrunner engages vetted third-party vendors:

4. Marketing Sandbox Processing

Showrunner.it's public landing page includes an optional "Paste your own" sandbox that lets a visitor paste a booking email to see it extracted into a production record — no account required. Text pasted into the sandbox is sent to our AI subprocessor (Anthropic, see the subprocessor list above) solely to run that extraction and return the result to the visitor's browser.

• Never stored as a record: a sandbox run never creates a production record and is never associated with any venue's workspace.
• Never used for training: the same contractual non-training commitment covering every other use of Anthropic's API applies here.
• Transient only: the extraction job exists in the ingestion service's memory for a short window (minutes) to let the browser poll for the result, and is not written to any database.

5. Retention Policy (Trial, Archived & Cancelled Venues)

GDPR Article 5(1)(e) (storage limitation) requires that personal data be retained no longer than necessary.

• Active workspace data: retained for the duration of the commercial subscription (or active trial).
• Expired trial workspaces: an unused trial workspace is deactivated after 30 days of inactivity (with prior warning — see the Terms of Service). Its data is permanently erased within 90 days of deactivation.
• Lapsed/archived paid workspaces: when a venue cancels or a subscription lapses, the workspace transitions to a Read-Only archive. Data is retained for 90 days to allow the Venue to export records or renew service, following a 14-day email notice sent in advance of archiving.
• Permanent erasure: archived workspaces (whether from an expired trial or a lapsed paid subscription) are permanently hard-deleted after a further 90 days of archiving — the database records and ingested files are removed from production databases, and backup references expire within standard 30-day rotation cycles.
• Invoicing and accounting records: our own local subscription-billing mirror is deleted along with the rest of the workspace on the schedule above. The durable financial record — invoices, subscription and payment objects — is held by our payment processor (Stripe) and retained for 5 years as required by the Danish Bookkeeping Act (bogføringsloven), independent of and unaffected by the workspace-data erasure schedule above.
• Right to Erasure: regardless of the schedule above, an explicit Right to Erasure request under GDPR Art. 17 submitted by the Venue is honored within 30 days.

6. Cookies & Tracking Technologies

Showrunner operates without invasive tracking, analytics, or third-party marketing cookies.

Functional cookies used:

• sb-auth-token (session): essential for user authentication and security.
• user_locale: essential for maintaining UI language preferences.

Consent banner status: because Showrunner only uses strictly necessary functional cookies required for system operation, no cookie consent banner is required under the Danish Business Authority (Erhvervsstyrelsen) guidelines and the ePrivacy Directive.