Privacy Policy

1. Information We Collect

Account information

When you register, we collect your name, email address, and password (stored as a cryptographic hash). You may optionally provide a profile photo, bio, location, and social links.

Troupe and production data

Content you create within the Service — troupe profiles, productions, cast lists, rehearsal schedules, recordings, announcements, audition results, volunteer sign-ups, marketplace listings, and fundraising campaigns — is stored on our servers.

Payment information

We use Stripe to process all payments. We do not store your full payment card details. Stripe may share tokenized payment references with us. For Stripe Connect sub-merchants (troupes), Stripe collects and processes identity verification and bank account information directly. See Stripe's Privacy Policy.

Usage and device data

We collect server logs including IP addresses, browser type, referring URLs, and pages visited. Mobile apps collect device identifiers and push notification tokens. We use this data to diagnose issues and improve the Service.

Communications

When you contact us or send messages within the Service, we retain those communications. We send transactional emails (verification, invitations, ticket confirmations) and, with your consent, product updates and announcements.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process payments and manage subscription billing
• Send transactional emails (account verification, password resets, ticket confirmations, rehearsal reminders)
• Send product updates and announcements, where permitted under applicable law
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Respond to your support requests
• Generate aggregated, anonymized analytics about Service usage

We do not sell your personal information to third parties. We do not use your data for behavioral advertising to third-party platforms.

3. Sharing Your Information

We share your data only in the following circumstances:

• Service providers: We share data with Stripe (payments), Microsoft Azure (cloud infrastructure and media storage), and Resend (email delivery) solely to provide the Service. Each is bound by data processing agreements.
• Troupe members: Information you share within a troupe (your name, profile, cast assignments, attendance, etc.) is visible to other members of that troupe according to their role permissions.
• Public content: Content you choose to make public (troupe profile, production pages, cast list, fundraising page, reel) is accessible to anyone.
• Legal requirements: We may disclose information when required by law, court order, or government authority, or to protect the rights and safety of Staje, our users, or the public.
• Business transfers: If Staje is involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your personal information becomes subject to a different privacy policy.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. After account termination, we retain data for 30 days before deletion, unless a longer retention period is required by law (e.g., financial records required for tax purposes are retained for 7 years).

Server logs are retained for 90 days. Anonymized, aggregated analytics are retained indefinitely.

5. Security

We implement industry-standard security measures including TLS encryption in transit, encryption at rest for sensitive data, cryptographic password hashing, and regular security reviews. No system is perfectly secure; we cannot guarantee absolute security and are not responsible for unauthorized access resulting from factors outside our reasonable control. Report security vulnerabilities to security@staje.app.

6. Cookies

We use cookies and similar technologies to maintain sessions, remember preferences, and analyze Service usage. See our Cookie Policy for details and opt-out options.

7. Children's Privacy (COPPA)

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Users aged 13–17 may use the Service with parental permission.

Staje is used by theater organizations that may include minors as performers. Recordings featuring minors are subject to guardian approval before publication. Troupes are responsible for obtaining appropriate consent from guardians of minor members in accordance with applicable law.

If you believe we have collected information from a child under 13 without appropriate consent, please contact us at privacy@staje.app and we will delete it promptly.

8. Your Rights (GDPR — EU/EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we restrict processing of your data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise these rights, contact privacy@staje.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

The legal bases we rely on for processing are: (a) contract performance (providing the Service you signed up for); (b) legitimate interests (security, fraud prevention, product improvement); (c) consent (marketing communications); and (d) legal obligation.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) / CPRA:

• Know: Request disclosure of the categories and specific pieces of personal information we collect about you.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Correct: Request correction of inaccurate personal information.
• Opt out of sale/sharing: We do not sell or share personal information for cross-context behavioral advertising.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a request, email privacy@staje.app with the subject line "California Privacy Request."

10. International Data Transfers

The Service is operated from the United States. If you are accessing the Service from outside the US, your information may be transferred to, stored, and processed in the US. For transfers from the EEA/UK, we rely on Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by posting a notice in the Service at least 14 days before they take effect. The "Effective date" at the top of this page reflects the date of the most recent revision.

12. Contact

For privacy questions, data subject requests, or concerns, contact us at privacy@staje.app.