Privacy Policy

1. Introduction

CueCall ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our theatre production management platform (the "Service").

Operating Entity: CueCall is owned and operated by Daily Evolution LLC, a limited liability company. All references to "CueCall," "we," "us," or "our" in this Privacy Policy refer to Daily Evolution LLC.

By using CueCall, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using the Service, including:

• Account Information: Email address, name, and password when you create an account
• Profile Information: Organization name, role, contact details, and profile photos
• Production Data: Show details, scenes, character information, notes, schedules, and tasks
• People Information: Cast and crew names, contact information, roles, availability, assignments, and — where a production records them — date of birth, parent/guardian details, emergency contacts, skills, documents such as resumes, and costume measurements. Measurements can also be submitted by the person themselves through a private link a costumer sends them, with no account required
• Inventory Data: Props, costumes, sets, equipment descriptions, photos, ownership status, and rental information
• Financial Information: Budget details and expense records (we do not store payment card information)
• Hours and Compensation: Where a production uses the hours feature, the hours each person logs, their activity, approval status, and any hourly rate or stipend the production records for them. Rates and amounts are visible only to production leadership with budget access, and to the person themselves
• Marketplace Records: Rental listings, requests, messages between organizations, condition photos, and — when a renter accepts an owner’s rental terms — the time of acceptance, IP address, and browser, kept as a record for both parties
• Files and Documents: Production files, scripts, images, and other documents you upload
• Communications: Messages, notes, and other communications within the platform
• Audition Registration Information: If you register for an audition through a public signup page (no account required), the name, email, phone number, role preferences, schedule conflicts, headshot, resume, and — when the organization requests them — date of birth, parent/guardian and emergency contact details you provide. Date of birth is collected only when the organization running the audition turns that question on (typically youth and school productions, so they know which performers are minors), and parent/guardian name and email are required whenever a guardian completes the form on a minor's behalf
• Other Public Forms: A volunteer signup sheet collects your name, email, and phone. A membership signup collects your name, email, phone, date of birth, parent/guardian details where the program requires them, and whether you consent to appear on the organization’s public member list; if the program collects dues, payment happens on Stripe’s pages (Section 4.5). A webinar registration collects your name, email, organization, and role. A blog subscription collects your email address and is confirmed by a second email before anything else is sent
• Feedback and Support: When you send feedback from inside the Service, we record what you wrote, the page you were on, your browser type, an optional screenshot, and your name and email so support can reply. See Section 9 for the automated handling this receives
• Fundraising Records: If an organization connects its fundraising platform account, we store the donation records that platform provides — donor name, email, and amount — and any gifts the organization records by hand, so they appear on its member accounts

2.2 Automatically Collected Information

When you access the Service, we automatically collect certain information, including:

• Usage Data: Pages viewed, features used, time spent on the platform, and interaction data
• Device Information: Browser type, operating system, device identifiers, and IP address
• Log Data: Access times, error logs, and referring URLs
• Cookies and Tracking: Session tokens and preferences (see Section 8 for details)

2.3 Information from Third Parties

We use Supabase as our authentication and cloud storage provider. When you create an account, Supabase processes your authentication credentials and manages your session. We do not receive or store your password directly.

Sign in with Google: Where it is offered, you can sign in with a Google account. We ask Google only for your name, email address, and profile picture — never for access to your Google Drive, Calendar, Classroom, or other data. Google receives the fact that you signed in to CueCall and applies its own privacy policy to that.

Organizations that add you: Most people in the Service are added by the theatre organization they work with, not by themselves — a stage manager imports a cast list, a director invites a collaborator, an organization connects its fundraising account. That organization decides what it records about you; see Section 11 for how to direct a request to it.

Prospective customers: We sometimes contact theatre organizations that have not used CueCall to tell them about it. The contact details we use come from public sources and business contact lists, are limited to business contacts, and are imported only where the recipient is in the United States or where we have recorded a lawful basis for the contact. Every such email says it is an advertisement, carries our postal address, and has an unsubscribe link; unsubscribing places a permanent do-not-contact marker on the address. If you have received one and want to know where we got your details, email privacy@cuecall.app.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Provision: To create and manage your account, provide access to features, and deliver the Service
• Production Management: To store and organize your production data, facilitate collaboration, and enable workflow management
• Communication: To send service notifications, updates, and respond to your requests
• Marketplace: To facilitate rental listings, requests, and communications between users
• Improvement: To analyze usage patterns, improve features, and develop new functionality
• Security: To protect against fraud, unauthorized access, and other security threats
• Legal Compliance: To comply with legal obligations and enforce our Terms and Conditions

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Within Your Organization

Information you create and share within the Service (productions, scenes, people, inventory, notes, files) is accessible to other members of your organization who have been granted access.

4.2 Audition Organizers

Information submitted through a public audition signup page is collected on behalf of the theatre organization that published the page and is shared with that organization's casting team. The organization uses it to run its audition and casting process and is responsible for its own handling of that information, including any waiver or agreement documents it asks registrants to acknowledge. Registrants can review, update, or cancel their registration at any time using the personal management link sent in their confirmation email.

4.3 Content Your Production Publishes

Some features let a production publish a page that anyone with the link can open without an account — a show program, a costume slideshow, an audition signup page, or a volunteer signup sheet. Only content someone with edit access has placed in that page is published. A show program, for example, renders only the cast, production team, musical numbers, bios, donor and sponsor names entered into it; contact details, emergency contacts, measurements and other profile information are never included. Signup sheets do not display the names of people who have already signed up. The organization publishing the page decides what goes on it and is responsible for obtaining any consent its participants require, including for minors, and can unpublish it at any time.

4.4 Marketplace

When you list items in the Marketplace or make rental requests, your organization name and contact information may be visible to other users for the purpose of facilitating rentals.

4.5 Service Providers

We share information with trusted third-party service providers who assist in operating the Service:

• Supabase: Authentication, database hosting, and file storage
• Vercel: Application hosting and aggregate web analytics. The analytics receive counts of which features are used and whether actions succeed — never production content, names, email addresses, file names, or record identifiers
• Stripe: Payment processing. Card details are entered on Stripe’s own checkout pages; we never receive or store them
• Resend: Email delivery on our behalf. Receives recipient names and email addresses, and the content of the message being sent
• Google: AI features. Content you submit to an AI feature — such as a photo, document, script, or schedule — is processed by Google’s Gemini API to produce the result. See Section 9 (AI Features)
• Apple: Push notification delivery for the iOS app
• Anthropic and GitHub: Handling of feedback and operational alerts. What you write in the in-app feedback form, with email addresses and record identifiers removed, is recorded as an issue in our private GitHub repository and read by an automated Claude routine that proposes a fix for our engineers to review. Your name and email never go to either. Error reports from the Service go the same way and can quote text a user typed

Two further services receive limited information in specific features. When an organization enters its postal code for the Marketplace, that postal code — nothing else — is sent to a geocoding service (Zippopotam.us) to place the organization on a map. When an organization connects its fundraising account, CueCall reads from that platform (GiveButter) using the organization’s own credentials; that relationship is the organization’s, and its terms govern the donations.

Some pages embed content hosted elsewhere — a Loom, YouTube, or Vimeo video a production has linked, or an image on our blog served from a content delivery network. When such content loads, that host sees your browser’s request, including your IP address, under its own privacy policy.

These providers are contractually obligated to use your information only as necessary to provide services to us and to protect your information. A current list, with the purpose and data categories for each, is published on our sub-processor page.

4.6 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to:

• Comply with legal process
• Protect the rights, property, or safety of CueCall, our users, or others
• Prevent fraud or security issues
• Enforce our Terms and Conditions

4.7 Business Transfers

If Daily Evolution LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Service of any change in ownership or use of your information.

5. Data Storage and Security

Storage Location: Your data is stored securely using Supabase's cloud infrastructure, which uses industry-standard data centers with robust physical and digital security measures.

Security Measures: We implement reasonable administrative, technical, and physical safeguards to protect your information, consistent with the New York SHIELD Act and industry best practices, including:

• Encryption of data in transit using HTTPS/TLS
• Encrypted storage of sensitive data at rest
• JWT-based authentication with secure session management
• Row-level security policies on database tables
• Regular security updates and monitoring
• Incident response procedures for potential data breaches

Data Retention: We retain account information for as long as your account is active or as needed to provide the Service. You may delete your account at any time from your profile; deletion scrubs your personal information, including audition registrations and signup responses made with your email address and documents attached to your person records, and ends your sign-in. Records an organization holds about you in its own roster or inventory remain with that organization (Section 11), and feedback you sent to support is kept as a support record. Payment records stay in our billing ledger and with Stripe for as long as tax and accounting law require.

Retention for people without accounts: Information submitted through public forms is kept only as long as the event it serves. Audition registrations from applicants who are not cast — including any headshots, resumes, recordings, and parent/guardian and emergency contact details — are automatically deleted 120 days after the audition ends. A registration you cancel yourself is deleted 30 days after cancellation. Registrants can also review, update, or cancel their information at any time using their personal management link.

Log retention: First-party activity logs (see Section 8) are deleted after 12 months; AI usage records (which contain no prompt or content text) are deleted after 24 months.

No Guarantee: While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Access and Correction

You can access and update most of your information directly through your account settings and the Service interface.

6.2 Data Export

You can export your production data, files, and other content at any time through the Service. Contact us if you need assistance with data export.

6.3 Account Deletion

You may request deletion of your account at any time. Upon account deletion, we will delete or anonymize your personal information, except where we are required to retain it for legal or regulatory purposes.

6.4 Communication Preferences

You can opt out of promotional emails by following the unsubscribe instructions in those emails. You cannot opt out of service-related communications (e.g., account verification, updates to our Terms or Privacy Policy).

6.5 California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request information about the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: We do not sell or share your personal information for cross-context behavioral advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Categories of Information Collected: In the preceding 12 months, we have collected: identifiers (name, email, IP address), commercial information (transaction history), internet activity (usage data), and professional information (organization, role).

To Exercise Your Rights: California residents may submit requests by contacting us through the support channels in the Service or emailing privacy@cuecall.app. We will verify your identity before processing requests.

Shine the Light: California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct marketing. We do not disclose personal information to third parties for their direct marketing purposes.

6.6 Other State Privacy Rights

Washington Residents: Washington residents may have additional rights under Washington state privacy laws. You may exercise rights similar to those described above by contacting us.

New York Residents: We maintain reasonable safeguards to protect your personal information in compliance with the New York SHIELD Act, including administrative, technical, and physical safeguards appropriate to the size and scope of our business.

7. Children's Privacy and Educational Institutions

Accounts are not offered to children under 13 years of age, and children under 13 may not submit information through our public forms on their own behalf. A child under 13 can still take part in a production: a parent or legal guardian creates and holds the account, completes the audition or signup form, and the child participates through it.

7.1 Children Under 13 (COPPA)

Account creation requires an attestation that the person signing up is at least 13 years old. Public audition and signup forms require the person completing them to state whether they are an adult registering for themselves or a parent or legal guardian registering on a minor's behalf; where a guardian completes the form, their name and email address are required. Organizations running productions that involve minors may also enable date-of-birth collection on their audition forms; where they do, we store the date itself and calculate age from it, and it is treated as contact-level information — visible only to production leadership, not to other cast members. Where a date of birth shows that a cast member is under 13, the Service sends that person's collaborator invitation only to the parent or guardian email on their profile, so the account belongs to the adult.

A production may also give a young performer a cast page: a read-only page, reached by a private link, that shows their character, scenes, rehearsal calls, announcements and costume pieces as the production chooses to share them. There is no account behind it and nothing to fill in. The link is sent to the parent or guardian on the performer's record, who decides whether to hand it on. The page collects no information from whoever opens it: no sign-in, no form, no cookies that identify them, no analytics, and no record of when or how often it was opened. The link itself only serves the page, and the production can replace or withdraw it at any time.

The Children's Online Privacy Protection Act (COPPA) also permits a school to consent on parents' behalf for school-authorized educational activities. CueCall does not currently rely on that pathway — the guardian-held account described above applies to school productions as it does to any other. If we learn that we have collected personal information from a child under 13 other than as described here, we will delete it — please contact us at privacy@cuecall.app.

7.2 FERPA and Educational Institutions

When CueCall is used by educational institutions (K-12 schools, colleges, universities), we understand that student information may constitute "education records" under the Family Educational Rights and Privacy Act (FERPA). In such cases:

• We act as a "school official" with a legitimate educational interest when providing services to schools
• We use student data solely for the educational purposes specified by the school
• We do not use student data for advertising or marketing purposes
• We do not disclose student information to third parties except as directed by the school or permitted by law
• Schools retain control over their student data and may request deletion at any time

Educational institutions may request a Data Protection Agreement (DPA) by contacting us at privacy@cuecall.app.

7.3 Productions Involving Minors

Public audition signup pages require acceptance of our Terms and this Privacy Policy at the point of registration; where the person registering is under 18, that acceptance must be provided by a parent or legal guardian. Organizations using the Service to manage productions involving minors are responsible for:

• Obtaining appropriate consents from parents or guardians
• Complying with applicable laws regarding collection and use of children's information
• Ensuring that minors' personal information is collected and used appropriately
• Maintaining appropriate safeguards for sensitive information

If you believe we have inadvertently collected information from a child under 13 without appropriate consent, please contact us immediately so we can delete the information.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain your session and improve the Service:

• Essential Cookies: Required for authentication and core functionality
• Preference Cookies: Remember your settings and preferences
• Session Tokens: Secure authentication tokens to maintain your login session

We use two kinds of usage measurement, and they differ in what they record:

• Third-party web analytics (Vercel) are cookieless and aggregate: they record that a feature was used, not who used it, they never receive names, content, or record identifiers, and they do not build a profile of you across other websites.
• First-party activity logs record how signed-in users move through the Service — which pages and features an account used, and the names of items it created. These stay on our own infrastructure, are visible only to CueCall administrators for support and product improvement, are never sold or used for advertising, and are deleted after 12 months or when the account is deleted, whichever comes first.

Most web browsers allow you to control cookies through settings. However, disabling cookies may limit your ability to use certain features of the Service.

9. AI Features

Some features use artificial intelligence — for example generating scene or character suggestions, drafting inventory descriptions, extracting details from a resume or schedule you upload, and generating images or video for backdrops and posters.

What is sent, and to whom: when you use one of these features, the content it operates on is sent to Google’s Gemini API for processing. Depending on the feature that may include text you typed, a document, script, or schedule you uploaded, or an image or photo you selected. Nothing is sent to an AI provider unless you invoke an AI feature, with two exceptions you should know about. First, when you send feedback from inside the Service, the text, page, and screenshot are read by Gemini to draft a reply and a technical summary, and the scrubbed text also goes to Anthropic and GitHub as Section 4.5 describes. The reply you receive is labelled as automated and pending human review, and a person follows up. Second, a production can turn on automatic drafting of rehearsal reports, which sends that production’s rehearsal notes to Gemini on a schedule rather than on a button press; leadership chooses that in the production’s settings and can turn it off.

Documents: A large document you submit for analysis (for example a script) may be uploaded to Google’s file service for the duration of the analysis. We delete it there when the analysis finishes, and Google deletes it automatically within 48 hours in any case.

Bring your own key: if you or your organization supply a Google API key in settings, AI requests run against that key and your relationship with Google governs them.

Accuracy: AI output is generated automatically and may be inaccurate or unsuitable. Review it before relying on it. We keep a record of AI usage (which feature, which model, token counts and cost) for billing and troubleshooting; these records contain no prompt or response text and are deleted after 24 months.

Connecting an AI assistant to your account

You can connect an AI assistant you use, such as Claude or ChatGPT, to your CueCall account so you can ask it about your productions. Nothing is connected unless you do it yourself: the assistant sends you to a CueCall page where you sign in and press Allow.

• What it can read: the productions you can open in CueCall, with the same limits your role has there. If your role does not let you see contact details, budgets, costs, or notes that do not tag you, the assistant cannot see them either. It reads what you would see on screen, including scripts and documents you can open, and nothing more.
• It acts as you: anything the assistant changes is done under your account and your role, and is recorded as yours. If you tick “Read-only” when connecting, it can read but cannot change anything. An assistant connection never emails your production, never spends AI credits, and never sends anything on your behalf except feedback you ask it to send, which is handled exactly like feedback sent from the app.
• Where the data goes: what the assistant reads is sent to the company that runs it (for example Anthropic or OpenAI), and that company’s privacy policy and your settings with them govern how it is kept and used. That company is not our service provider; you choose it. We do not receive your conversations with the assistant, only the requests it makes to CueCall.
• What we keep: the assistant’s name, what you allowed it to do, and when the connection was made and last used. The access tokens themselves are stored only in scrambled (hashed) form, so a copy of our database cannot be used to reach your account.
• How to disconnect: open Settings, then Connected apps, and press Disconnect. It takes effect on the assistant’s next request. You can also remove CueCall from the assistant’s own settings, and deleting your CueCall account removes every connection.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

11. International Data Transfers

CueCall is operated by Daily Evolution LLC in the United States, and the providers listed on our sub-processor page process data there. If you use the Service from outside the United States, your information is transferred to, stored, and processed in the United States, which may not provide the same level of data protection as the laws of your country.

Organizations in the EEA, UK, or Switzerland. When a theatre company, school, or other organization uses CueCall to manage its productions, that organization is the controller of the personal data it puts into the Service, and CueCall acts as its processor. For those customers we make available a data processing agreement that incorporates the European Commission’s Standard Contractual Clauses (and, for the United Kingdom, the ICO’s International Data Transfer Addendum) as the transfer mechanism, together with the security and sub-processor terms Article 28 requires. Request it from privacy@cuecall.app.

Individuals. If you are in the EEA, UK, or Switzerland and your information was provided to CueCall by an organization — for example, because you auditioned for or work on one of its productions — that organization decides how your information is used, and requests about it are usually best directed to them. You may also contact us at privacy@cuecall.app and we will assist, or route your request to the responsible organization.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons.

We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice within the Service

Your continued use of the Service after changes are posted constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices — including a request to access, correct, or delete your information — contact us at privacy@cuecall.app or through the support channels available within the Service.

You have the right to file a complaint with a data protection authority if you believe we have not addressed your concerns appropriately.

14. Data Protection Summary

Your data belongs to you. We are committed to:

• Collecting only the information necessary to provide the Service
• Using your information solely for the purposes described in this policy
• Never selling your personal information to third parties
• Protecting your information with industry-standard security measures
• Giving you control over your data through export and deletion options
• Being transparent about our data practices