Privacy Policy

Callsheet ("we," "our," or "us") is a theatre production management platform operated by Latimerart. This policy explains what information we collect, how we use it, and your rights regarding your data.

1. Information We Collect

Account information

When you create an account or sign up for an audition slot, we may collect:

• Name, email address, and phone number
• Date of birth (used to verify age and apply appropriate protections for minors)
• Organisation or production company name
• Role preferences and audition notes

Billing information

Subscription payments are processed by Stripe. We do not store your full card number or CVV — Stripe handles all payment data directly. We retain records of your subscription status and billing history.

Usage data

We collect standard server logs including IP addresses, browser type, and pages visited. This data is used to maintain service reliability and is not sold.

Cookies and local storage

Callsheet sets one essential cookie: a session token issued by Supabase Auth to keep you signed in. This cookie is httpOnly and is required for the service to function. We do not use advertising cookies, analytics tracking cookies, or any third-party behavioral tracking. Because we set only essential cookies, no cookie consent banner is displayed.

2. Children's Privacy (COPPA)

Callsheet is used in theatre productions that frequently include minors. We comply with the Children's Online Privacy Protection Act (COPPA) and take special precautions for users under 13.

Age verification and account activation

Users who indicate they are under 13 during signup cannot proceed without verifiable parental consent. Account activation is paused and no personal data is retained until a parent or guardian provides consent.

Consent method

We use email-based verifiable parental consent as our primary COPPA consent method. When a minor attempts to join Callsheet, we send a consent request to the email address their parent or guardian provides. That email:

• Identifies Callsheet and explains why we are contacting them
• Lists the specific data we will collect from their child
• Provides a unique, time-limited link (expires in 7 days) to review and approve or decline
• Explains the parent's ongoing rights to review, correct, and delete their child's data

No account is created and no data is retained if the parent does not respond within 7 days or declines. This method complies with 16 C.F.R. § 312.5(b)(3) — email combined with additional steps to provide assurance that the person consenting is the parent.

What we collect from minors

With parental consent, we collect only:

• Name, email address, and date of birth
• Show membership, rehearsal schedule, and role information for the production they are part of

We do not collect location data, payment information, or social network connections from minor accounts. We do not display advertising to any user, including minors.

School intermediary path

When minors join Callsheet as part of a school-sponsored production, the school may serve as an institutional consent intermediary consistent with COPPA's school-consent provision. This applies only where the school has formally verified student ages, obtained appropriate written authorisation on parents' behalf, and where parents retain full rights to review, correct, and delete their child's data.

Parental rights

At any time, a parent or guardian may:

• Review the personal information we hold about their child
• Request correction or deletion of their child's data
• Revoke consent, which will result in account deactivation and data deletion within 30 days

To exercise any of these rights, email privacy@callsheetcommunity.com. We will respond within 30 days. If you believe we have collected personal information from a child under 13 without appropriate consent, contact us immediately and we will delete it promptly.

3. How We Use Your Information

• To provide, operate, and improve the Callsheet platform
• To send transactional emails (booking confirmations, cast notifications, password resets)
• To process subscription payments via Stripe
• To generate AI-assisted show information using the Anthropic API (show titles and role descriptions only — no personal data is sent to Anthropic)
• To comply with legal obligations

We do not sell your personal information to third parties.

Email communications

All emails Callsheet sends are transactional — confirmations, notifications, and account management messages triggered by actions you or your production team take. We do not send marketing newsletters or promotional emails. Because our emails are transactional in nature, they are exempt from CAN-SPAM's unsubscribe requirement; however, every email includes our physical mailing address as required by law. We do not use your email address to target advertisements and we never send marketing email to accounts belonging to minors.

4. Third-Party Services

Callsheet uses the following third-party services to operate:

• Supabase — database and authentication
• Stripe — subscription billing and payment processing
• Resend — transactional email delivery
• Anthropic — AI-assisted show lookup (no personal data shared)
• Vercel — application hosting and infrastructure

Each of these services has their own privacy policy governing how they handle data.

5. Data Retention

We retain data for the following periods:

• Active accounts — profile, show membership, attendance, and scheduling data are retained for as long as your account is active.
• Deleted accounts (self-serve) — when you delete your own account, all personal data is purged immediately. A hashed, non-reversible record is written to a compliance audit log (no personally identifiable information is retained).
• Deleted accounts (parental or admin request) — data is deleted within 30 days of a verified request. The same hashed compliance log entry applies.
• Billing records — Stripe subscription and payment records are retained for 7 years to meet financial recordkeeping requirements. These records are held by Stripe and do not include payment card numbers.
• Server logs — Vercel infrastructure logs containing IP addresses and request metadata are retained for up to 90 days.
• Rate-limit records — stored transiently in our database and automatically expire; no personal data is contained in these records.

You may request deletion of your account and all associated data at any time — via account settings or by emailing privacy@callsheetcommunity.com.

6. Your Rights

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, email privacy@callsheetcommunity.com.

7. Data Security

We use industry-standard security practices including encrypted connections (HTTPS), row-level security in our database, and access controls. No method of transmission over the internet is 100% secure, but we take reasonable precautions to protect your data.

8. Changes to This Policy

We may update this policy as the service evolves. We will note the date of the last update at the top of this page. For significant changes, we will notify active users by email.

9. Contact

Questions about this policy? Email us at privacy@callsheetcommunity.com.