# Privacy Policy
**Effective Date:** April 1, 2026
**Last Updated:** April 1, 2026
---
## 1. Introduction
Auditions Manager, LLC ("Auditions Manager," "we," "us," or "our") operates a SaaS audition management platform used by performing arts organizations. This Privacy Policy explains what personal information we collect, how we use it, and what rights you have.
This Policy applies to:
- **Company Administrators** — staff and team members at organizations that subscribe to Auditions Manager
- **Actors** — individuals who submit audition materials through portals hosted on our platform
**A note on data responsibility:** Subscribing theater companies and organizations ("Companies") control the data they collect from actors through their audition portals. Auditions Manager processes that data on their behalf as a **data processor**. If you are an actor with questions about how a specific company uses your data, please contact that company directly.
---
## 2. Information We Collect
### 2.1 Company Administrator Data
When a company creates an account, we collect:
| Data Type | Examples |
|-----------|---------|
| Account information | Company name, company address, contact name, work email |
| Login credentials | Username (login identifier) and hashed password (we never store plaintext passwords). Team members use email as their login identifier. |
| Billing information | Payment method details (processed and stored by Stripe — we do not store card numbers or CVVs). We store the last 4 digits of your card and the expiration date in our database for display purposes only. |
| Usage data | Login activity, features used, pages viewed, session duration |
| Communications | Support requests, emails sent through the platform |
### 2.2 Actor Data
When actors register for an audition through a Company's portal, we collect the following categories of information **on behalf of and as directed by the Company**:
| Data Type | Examples |
|-----------|---------|
| Identity | First name, last name |
| Contact | Email address, phone number, mailing address |
| Professional | Equity membership status, union affiliations |
| Submitted materials | Headshot photos, resume documents |
| Audition responses | Answers to custom questions configured by the Company |
| Guardian information | Guardian name (collected when the actor is a minor — see Section 9 on minors) |
| Technical metadata | IP address, device type, browser type at time of submission |
We collect only the data that Companies configure their audition forms to request. We do not independently add data fields beyond what the Company configures.
### 2.3 Automatically Collected Data
When any user accesses the platform, we automatically collect:
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and time spent
- Referring URLs
This data is used for security monitoring, error diagnosis, and improving the platform.
---
## 3. How We Use Your Information
### 3.1 Company Administrator Data
- To create and maintain your account
- To process payments and manage your subscription
- To send transactional communications (receipts, renewal notices, feature updates)
- To respond to support requests
- To detect and prevent fraud or unauthorized access
- To comply with legal obligations
### 3.2 Actor Data
- To operate the audition platform and present actor submissions to the subscribing Company
- To pre-fill registration forms for returning actors (reducing friction)
- To send confirmation emails for audition registrations
- To notify actors of audition status changes as configured by the Company
- We do **not** use actor data for advertising, cross-company marketing, or sale to third parties
### 3.3 Platform Improvement
We may use aggregated, de-identified analytics data (with no personally identifiable information) to understand how the platform is used and to improve our product.
---
## 4. How We Share Your Information
We do not sell personal information. We share information only as described below.
### 4.1 With Subscribing Companies
Actor data submitted through a Company's audition portal is shared with that Company. This is the core purpose of the platform.
### 4.2 With Service Providers (Sub-processors)
We engage the following third-party service providers, each of whom processes data only as directed by us:
| Provider | Purpose | Location |
|----------|---------|---------|
| **Stripe, Inc.** | Payment processing and subscription billing | United States |
| **Postmark (Wildbit LLC)** | Transactional email delivery (receipts, confirmations, notifications) | United States |
| **Cloudflare, Inc. (R2)** | File storage (headshots, resumes, videos) and CDN delivery | United States (with global edge network; EU storage option available) |
| **Hetzner Online GmbH** | Cloud server hosting for application and database | Germany (EU) |
Each sub-processor is bound by data processing agreements requiring them to protect personal data in accordance with applicable law.
### 4.3 Legal Requirements
We may disclose personal information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Auditions Manager, our users, or the public.
### 4.4 Business Transfers
If Auditions Manager is acquired, merged, or involved in a sale of assets, personal data may be transferred to the successor entity. We will notify you via email or platform notice before your data is transferred and becomes subject to a different privacy policy.
---
## 5. Cookies and Tracking
### 5.1 Cookies We Use
We use a minimal set of cookies:
| Cookie Type | Purpose | Retention |
|-------------|---------|----------|
| **Session cookie** | Maintains your login session | 7 days from last login |
| **CSRF token** | Prevents cross-site request forgery attacks | Per-session |
We do **not** use advertising cookies, cross-site tracking cookies, or behavioral profiling cookies.
### 5.2 Third-Party Cookies
We do not currently use any third-party cookies. Our cookies are strictly first-party and functional.
### 5.3 Your Cookie Choices
Because our cookies are strictly functional (required for the platform to work), opting out of them will prevent you from using the Service. We do not use optional or advertising cookies that require consent banners.
---
## 6. Data Retention
| Data Category | Retention Period |
|---------------|----------------|
| Company account data | While subscription is active |
| Actor data | While at least one Company that collected it has an active subscription |
| Post-cancellation data (all types) | 90 days after subscription ends, then permanently deleted |
| Backups | Rotated and overwritten on a rolling basis (typically 30 days) |
| Application logs (local) | 30 days (rotated locally — not sent to third-party services) |
Upon request, we will delete personal data sooner than the standard retention period where technically feasible and not required by law. See Section 7 for how to make such requests.
---
## 7. Your Rights and Choices
Depending on your location, you may have the following rights regarding your personal information:
### 7.1 For All Users
- **Access:** Request a copy of the personal data we hold about you
- **Correction:** Request that inaccurate data be corrected
- **Deletion:** Request deletion of your personal data (subject to legal retention obligations)
### 7.2 California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- **Know** what personal information we collect, use, disclose, and sell about you
- **Delete** your personal information (with certain exceptions)
- **Correct** inaccurate personal information
- **Opt-out of sale or sharing** — We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of
- **Non-discrimination** — We will not discriminate against you for exercising your rights
To exercise these rights, contact us at **privacy@auditionsmanager.com** with "California Privacy Rights" in the subject line.
### 7.3 European Economic Area, UK, and Switzerland (GDPR)
If you are located in the EEA, UK, or Switzerland, you have the following rights under applicable data protection law:
- **Right of access** (Article 15 GDPR)
- **Right to rectification** (Article 16 GDPR)
- **Right to erasure / right to be forgotten** (Article 17 GDPR)
- **Right to restriction of processing** (Article 18 GDPR)
- **Right to data portability** (Article 20 GDPR)
- **Right to object** to processing (Article 21 GDPR)
- **Right to withdraw consent** at any time (where processing is based on consent)
- **Right to lodge a complaint** with your local supervisory authority
**Legal bases for processing:** We process personal data on the following legal bases:
- **Contract performance** (Article 6(1)(b)): To provide the Service to subscribing companies
- **Legitimate interests** (Article 6(1)(f)): For security, fraud prevention, and platform improvement
- **Legal obligation** (Article 6(1)(c)): Where required by applicable law
- **Consent** (Article 6(1)(a)): Where we have obtained your explicit consent (e.g., optional communications)
**International transfers:** Personal data may be transferred from the EEA to the United States and other countries. We rely on Standard Contractual Clauses (SCCs) adopted by the European Commission to ensure adequate protection for such transfers.
To exercise your rights, contact us at **privacy@auditionsmanager.com**.
### 7.4 How to Submit Requests
Email **privacy@auditionsmanager.com** with:
- Your full name and email address
- The nature of your request
- If you are an actor, the name of the theater company whose audition you participated in
We will respond within **30 days** (or sooner as required by applicable law). We may need to verify your identity before processing your request.
---
## 8. Data Security
We implement the following security measures to protect personal data:
- **Encryption in transit:** All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
- **Encryption at rest:** Database and file storage are encrypted at rest
- **Password hashing:** Passwords are hashed using bcrypt with appropriate cost factors — we never store plaintext passwords
- **Access controls:** Internal access to personal data is limited to personnel with a legitimate need
- **Security monitoring:** We review application logs locally for anomalous activity (no third-party error tracking service is used at this time)
- **Vendor security:** All sub-processors are contractually required to maintain appropriate security standards
Despite these measures, no system is 100% secure. If you believe your data has been compromised, contact us immediately at **security@auditionsmanager.com**.
**Breach notification:** In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected parties and, where required by law, relevant regulatory authorities, within the timeframes required by applicable law (72 hours under GDPR where applicable).
---
## 9. Children and Minors (COPPA)
### 9.1 Platform Scope
The Auditions Manager platform is designed for use by organizations (theater companies, casting offices) and is **not directed at children**. Company administrators must be at least 18 years of age.
### 9.2 Minor Actors
The performing arts industry regularly involves individuals under 18. Our platform supports the collection of a **guardian name** field for actor registrations, and Companies may configure their audition portals to collect data from minor actors (those under 18, and in particular those under 13).
### 9.3 COPPA Compliance for Actors Under 13
The **Children's Online Privacy Protection Act (COPPA)** requires verifiable parental consent before collecting personal information from children under 13.
**Companies are responsible for COPPA compliance** when operating audition portals that may be accessed by children under 13. Specifically:
- Companies must obtain **verifiable parental or guardian consent** before collecting personal information from any actor under 13
- This means including appropriate age-gate language and consent mechanisms on audition registration pages where minors may register
- Companies should not configure portals to collect more information from minors than necessary
As a data processor, Auditions Manager provides the guardian name field and supports the technical capability to collect guardian information. However, **the Company is the data controller** and bears primary legal responsibility for obtaining appropriate consents.
Auditions Manager does not knowingly collect personal information directly from children under 13 for its own purposes. If we become aware that personal information has been submitted by a child under 13 without appropriate parental consent, we will work with the relevant Company to address the situation.
If you are a parent or guardian and believe your child's information has been collected without your consent, please contact us at **privacy@auditionsmanager.com**.
---
## 10. International Users
Auditions Manager is operated from the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States and other countries where our sub-processors operate (including Germany, where our primary hosting provider Hetzner is located).
We take appropriate safeguards to ensure that personal data transferred across borders receives adequate protection, including Standard Contractual Clauses for transfers from the EEA/UK.
---
## 11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least **30 days' notice** by email to the primary contact on your account and/or by posting a notice in the platform. The "Last Updated" date at the top of this Policy indicates when it was last revised.
Your continued use of the Service after any change constitutes acceptance of the revised Policy. If you do not agree to the revised Policy, you may cancel your subscription.
---
## 12. Contact Us
For privacy-related questions, requests, or complaints:
**Auditions Manager, LLC — Privacy Team**
Email: **privacy@auditionsmanager.com**
General: **legal@auditionsmanager.com**
*Note for Founder: Please add the company mailing address before publication. If you appoint a Data Protection Officer (DPO) for GDPR purposes, add their contact information here.*