Privacy Policy

1. Who we are

shoWMe is run by Showme AB, a Swedish company. Showme AB is the controller of the personal data in this policy, except where section 2 says otherwise.

Company Name

Showme AB

Organization Number

559577-1402

Address

HETCH, Redaregatan 48, 252 36 Helsingborg, Sweden (C/O Showme AB)

Contact

info@showme.music

This policy covers the website at showme.music, the shoWMe app, and the emails we send.

2. Data you add about other people

Some data in shoWMe is about people you work with, and you add it yourself: your address book, your audience list, the crew you add to a show, and the people you invite. For that data, you (or the organisation you act for) decide why it is held, and you are its controller. We store and process it on your behalf.

You need a lawful reason to add it, and you are responsible for telling those people where the law requires it.

3. What we collect

3.1 Your account

• Your name and email address. Your password is handled by Google Firebase Authentication. We never see it.
• If you sign in with Google, Google gives us your name and email address.
• Your account kind: operator, performer, agent, or team and crew.
• Your settings, such as currency, time zone, notification choices, and whether you share your contact details on events.
• Which version of our Terms and Privacy Policy you agreed to, and when. You agree with a checkbox when you create your account.

3.2 Your profiles

What a profile holds depends on its kind.

• Operators (venues, promoters, festivals, organisers): name, address and map location, rooms and capacities, photos, a description, and documents such as riders.
• Performers: act name, genres, biography, photos, videos, links to music and social media, setlists, and documents such as riders.
• Agents: agency name, location, and the acts you represent.
• Team and crew: name, photo, main area and skills, languages, city and country, a short "about" text and, if you add it, your phone number.
• Profile members: the name, email, role and, if given, phone number of each person on a profile.

3.3 Your work in shoWMe

• Events, holds, schedules, tasks, messages and comments.
• Booking requests you send or receive.
• Agreements, budgets, settlements and invoices, including fees, costs and who paid what.
• Bank details you add so that others can pay you (IBAN, bankgiro or Swish).
• Files you upload.
• Setlists and performance reports for performing rights organisations.

3.4 People without an account

• Booking requests sent from a public profile or availability page: your name, email, what kind of sender you are, who the booking is for, the dates, your message, and optional links to your music and to a performance.
• RSVPs on a public event page: your email, your name and, if you give it, your city.
• The website contact form: your name, email, role and message.
• Shared links: if a user shares a document with you, we hold your email address so we can send you an access code.
• People added by a user: if a user adds you to a show or invites you by email, we create a profile with your name and email so the show has a place for you. You can claim it by signing up with that email address. If nobody claims it, we delete it (see section 12).

3.5 Technical data

• Server logs with your IP address, the request made, and the time. We use them to run, secure and fix the service.
• An audit log of important actions, such as who confirmed an agreement or changed a settlement.
• Data stored in your browser to keep you signed in and remember your settings. See the Cookie Policy.

4. Why we use it, and our legal basis

We do not sell personal data. We do not use it for advertising, and we do not use it to train AI models.

5. Who can see your data

• People on the same event see what their role on that event allows. An agreement is shown only to its parties. On a shared agreement, each party sees only its own line.
• Members of a profile see that profile's data, within the role its owner gave them. Bank details are shown only to the profile's owner, admins and editors.
• Anyone on the web can see a profile or event the owner has published (section 6).
• Someone you share a link with can see what you shared (section 7).
• Our service providers process data for us (section 11).
• Authorities, if the law requires us to disclose data.

6. Public profiles and public event pages

• A profile is private until its owner turns on "Publish this profile publicly". A published profile can be found on the web and by other shoWMe users. It shows what the owner added, such as name, photos, description, genres, links, videos and location, and the dates the profile is unavailable (dates only, never times).
• Crew profiles cannot be published for now.
• A confirmed event can be published as a public event page. It shows the event, the venue and the acts.
• Contact details, financial data and private notes are never shown on public pages.
• Videos on public profiles come from YouTube or Vimeo. Nothing loads from them until you press play. Then that provider receives your IP address and may set its own cookies.
• Map images on public profiles are fetched by our server from Mapbox, so your browser does not contact Mapbox.

7. Shared links

• A user can share an event document, or a crew member's own schedule, with someone by email. The link works only for the address it was sent to.
• To open it, the recipient asks for a code, which we email to that address. The code is valid for 10 minutes. Once it is entered, access lasts 24 hours on that device.
• We store codes only in hashed form. A link stops working when it expires or the sender withdraws it.
• A user can also share a link to their free dates. Anyone with that link can see those dates.

8. Crew contact details

• A crew member's phone and email are hidden by default. Only the side that added them, and the crew member, can see them.
• They are shown to everyone on an event only if the crew member agreed in Settings, or the side that added them confirms the crew member agreed.
• Either can stop sharing at any time. They are never shown to agents, on public pages, or through shared links.

9. Connected calendars (Google Calendar)

Connecting a Google Calendar is optional. If you connect one, shoWMe asks Google for two permissions and uses each for one thing only.

9.1 What we read

• Permission: see events on your calendars (calendar.events.readonly). This is read only. shoWMe cannot create, change or delete anything in your own calendars.
• We read the title, date, times and location of your events, so you can choose which of them to bring into shoWMe. Nothing is added until you choose it.
• The list of events your calendar offers is shown only to you. What you choose to bring in is shared like anything else you add to your shoWMe profile.

9.2 What we write, and where

• Permission: manage calendars that shoWMe creates (calendar.app.created). With it we create one calendar in your Google account, named "shoWMe", and can change only that calendar.
• Only if you turn on two-way sync, we put your own shows on it (pending, confirmed and played shows you host or are booked on), and update or remove them as they change or are cancelled. Drafts and holds are never written.

9.3 Disconnecting

• You can disconnect at any time under Integrations in shoWMe, or remove shoWMe from your Google account permissions.
• When you disconnect in shoWMe, we revoke our access at Google, delete your stored access token, delete the list of events your calendar offered, and delete the "shoWMe" calendar from your Google account.
• Entries you already brought into shoWMe stay, because they are now your own shoWMe entries. You can delete them like anything else.
• While you are connected, your access token is stored encrypted.

9.4 What we never do

• We do not sell Google Calendar data or share it with other users or advertisers.
• We do not use it for advertising, for profiling, or to train AI models.
• We use it only for the two purposes in 9.1 and 9.2.

shoWMe's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Emails and unsubscribing

• We send service emails only: invitations, access codes, replies to booking requests, and notices about your events. We do not send newsletters.
• If you have an account, you choose which notification emails you get in Settings.
• If you have no account, our emails to you carry an unsubscribe link. When you use it, we add your address to a list of addresses we no longer email. An access code you asked for is always sent.
• Password reset and email confirmation messages are sent by Google Firebase.

11. Service providers

These providers process personal data for us under their data processing terms.

We also fetch currency exchange rates from ExchangeRate-API. No personal data is sent to it.

11.1 Transfers outside the EU

Google, ClickUp and Mapbox are US companies, so some data may be stored in or accessed from the United States. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.

12. How long we keep data

We keep your data while your account is active and as long as it is relevant to your events. We delete it when you delete your account or ask us to, unless the law requires us to keep it. Where a fixed period applies, it is in the table below.

13. Your rights

Under the GDPR you have the right to:

• get a copy of your data;
• have wrong data corrected;
• have your data deleted;
• restrict how we use it;
• get your data in a machine-readable file;
• object to processing based on legitimate interest;
• withdraw consent at any time. This does not affect what we did before.

You can download a copy of your data and delete your account yourself in the app, under Settings, Your data. You can correct most of your data there too. For anything else, email info@showme.music, ideally from the address on your account. We may ask you to confirm who you are. We reply within one month.

13.1 Deleting your account

You can delete your account in Settings, under Your data. You type DELETE to confirm, and we email you when it is done. We then delete:

• your sign-in account, and your name, email and photo;
• profiles only you used, with their photos, links, address book, audience list, bank details and your team's contact details;
• your notifications, settings, calendar connections, and the files you uploaded that nobody else uses.

We do not delete what you share with other people, because it is theirs too: events, agreements, settlements, invoices and messages. There, your name is replaced with "Deleted user", and on other people's team lists with "Former member". The figures stay as they are, and other people keep their own records. A profile kept this way also keeps its billing details (legal name and VAT number), because other people invoice against them and bookkeeping law can require them.

If you are the only owner of a profile that other people are members of, make one of them the owner on the Team page first.

You can also ask us by email to delete your account.

If another user holds data about you in their own address book or audience list, they are its controller (section 2). We will pass your request on to them.

13.2 Complaints

You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority where you live.

14. Automated decisions

We do not make decisions about you by automated means alone that have legal or similarly significant effects. One automatic rule exists: if three different profiles report your booking requests as spam within 90 days, your profile cannot send new requests while that is the case. Contact us if you think this is wrong.

15. Children

shoWMe is a professional tool and is not meant for children. Accounts are for people aged 18 or over.

16. Security

All traffic is encrypted. Every request is checked against what that person is allowed to see. Calendar tokens are stored encrypted, and access codes are stored hashed. No system is completely secure, so tell us at once if you suspect misuse of your account.

17. Cookies

See our Cookie Policy.

18. Changes to this policy

When we change this policy, we post the new version here with a new date. If a change matters to you, we tell you by email or in the app before it takes effect, and the app asks you to agree to the new version. Anything based on your consent stays based on your consent. We never treat continued use as consent.

19. Contact

Email

info@showme.music

Address

HETCH, Redaregatan 48, 252 36 Helsingborg, Sweden