Privacy policy.

1. Scope and responsibilities

This notice explains personal information used by Venue True and Advance True. The operator named on this page is responsible for account administration, platform security and its own communications. A venue or other organisation that uploads contacts, riders or show records also has responsibilities for the information it chooses to collect and share.

Where we handle an organisation’s show data solely on its instructions, that organisation may be the controller and we may be its processor. The data-processing provisions in our Terms apply to that work. We act as a separate controller for our own account, billing, security and legal records. Ask the relevant venue about its own use of information, as well as contacting us about the platform.

2. Information we collect and its sources

• Accounts: name, email, organisation, role, login credentials in protected form, account status, access claims and acceptance of the Terms.
• Venue and artist records: names, locations, addresses, business contact details, capacities, technical specifications and the history of section checks.
• Show collaboration: dates and times, participant roles, invitations, contacts, guest names and party sizes, riders, technical documents, notes and advancing decisions. Other users may supply your work contact details, add your name to a guest list or invite you to a show.
• Chat safety: when a member reports a team-chat message, we retain the reported text, its author, the reporter, the team, the selected reason and any context supplied so an authorised administrator can review and record the outcome.
• Finance and reporting: show costs, settlements, ticket-count summaries, setlists, songwriter information, membership declarations and PRS-related records. Uploaded files may contain additional information chosen by the uploader.
• Availability requests: your name, email, organisation, requested room/date, proposed show, preferred doors time and message; the venue’s decision is also recorded.
• Technical records: session identifiers, IP address and browser/device information available to the application or server for authentication, security and troubleshooting.

Information comes from you, authorised collaborators, imported calendar or spreadsheet files, and your use of the service. Avoid uploading health information or other sensitive personal information unless it is necessary and you have an appropriate legal basis. The platform does not require ticket purchasers’ individual customer lists for ticket-count reporting.

Fields marked required are needed to create the requested account or handle the request. You can choose not to provide them, but we may be unable to provide that function. Optional fields can be left blank.

3. Why we use information

For legitimate-interest activities we consider the purpose, whether the use is necessary, and its effect on individuals. You can object to processing based on legitimate interests. Where consent is used, you can withdraw it without affecting the lawfulness of earlier processing.

4. What other people can see

Venue and artist names and towns can appear in the shared directory. A venue can opt to share a room summary, including capacity, sound-console and access information. Private specification contacts are not included in directory results.

Show information and uploaded documents are available to authorised show participants. Guest-list names are limited to the venue team and the relevant artist team. Private finances are limited to the authorised venue, artist or promoter roles and applicable Premium access. Other show participants do not automatically receive access to guest names or private finances. Site administrators may access information where necessary for administration, support or security.

A calendar link exposes only the fields selected by the venue: availability, and optionally titles and public doors times. Requester messages and contact details remain with the venue team. A link can be forwarded; optional passwords are shared secrets rather than identity checks.

Exports and downloads create copies outside our access controls. Removing a participant or revoking a link cannot recall those copies. We do not sell personal information or make private contact lists available to advertisers.

5. Suppliers and external services

We use the following services where relevant to your use of the platform. They receive the information needed for their function; they are not all given access to every workspace.

• Laravel Cloud: application hosting, database, private uploads, operational logs and recovery facilities. Our application and database are configured in London; object storage and supporting infrastructure are not represented as UK-only. See Laravel's privacy information.
• Cloudflare: hosting network delivery and protection against malicious traffic, processing connection and security information. Its security script can run before optional analytics consent. See Cloudflare's privacy policy.
• Resend: outgoing account and service emails, including recipients, message content and delivery records. Our sending domain uses the Ireland region; that does not mean every support or account-processing activity is limited to Ireland. See Resend's privacy policy.
• Mailgun: incoming ticket-count emails at tickets.venuetrue.co.uk, using its EU service. It receives the sender, recipient, subject, message content and delivery information and forwards reports for review in the appropriate show. Forward counts, not ticket purchasers' personal records. See Mailgun's privacy information.
• Stripe: hosted payments, subscriptions, billing portal, fraud prevention and payment records. We send account email, billing references and selected plan, and keep customer/payment/subscription references, status and access dates. We do not store card numbers. Stripe also acts as a controller for some regulatory and payment purposes. See Stripe's privacy policy.
• Google Fonts: Manrope and DM Sans are requested by your browser, disclosing connection information such as IP address and browser details. This is separate from Google Analytics. See Google Fonts privacy information.

UK2 provides our domain/DNS services. Bitbucket stores application source code for development and deployment; it is not used as the workspace database or upload store. Support messages are also processed by the email service used for our business mailbox. Contact us if you need information about the suppliers relevant to a particular request.

No Google Analytics or advertising integration is currently enabled. If analytics is introduced, optional consent controls will apply before it loads and this notice will identify the actual configuration. Search Console is planned; domain verification alone does not install a visitor analytics script. We do not treat accepting our Terms as consent to either analytics or marketing.

Calendar import uses an uploaded file; it does not sign in to your Google, Apple or Microsoft calendar account. External sites and email recipients have their own privacy practices.

6. International processing

Some suppliers and their support teams operate internationally, including in the EEA and United States. London application hosting and EU email regions do not make all processing UK-only. For restricted transfers we must use a valid UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, with the assessment and additional measures required by law. Contact our privacy email for the arrangements applying to your information and a copy or explanation of the relevant safeguards.

7. Retention and deletion

We retain information only for the service, legal, security and dispute purposes described here. The following is our retention and review schedule; reviews and deletion requests are handled by our team, not an automatic account-erasure timer.

• Active accounts and workspaces: held while needed to provide the account and its ongoing show history. Workspace owners should remove obsolete contacts and documents. We review accounts after 24 months without meaningful activity. Before deleting an inactive workspace, we normally give the owner at least 30 days to retain or export it. An ongoing paid subscription or a valid legal hold prevents routine inactivity deletion.
• Expired Premium: Premium records remain stored but are inaccessible through Premium tools until access is repurchased. The same inactivity review and deletion rules apply. Expiry alone does not erase data and does not prevent a free statutory personal-data request.
• Account closure/deletion: an in-app request disables the login immediately and is completed within seven days. For other privacy requests, after verifying the request and identifying any shared or legally required records, we aim to remove or anonymise eligible live records within 30 days. We explain any exception or lawful extension. Another organisation may need to retain its own show record; closing your login does not give us permission to destroy that organisation's records.
• Billing, tax and contractual evidence: normally six years after the end of the relevant financial year or resolution of the contract/dispute, as applicable. We retain only what is needed and may retain longer where a specific legal requirement or live claim requires it.
• Routine support: normally up to 24 months after resolution; complaint, rights-request and dispute evidence may be held for up to six years where needed to demonstrate how the matter was handled. Unneeded identity-check material is removed promptly after verification.
• Riders and show contacts: owners should review sensitive dietary/accessibility details within 30 days after the show and remove them when no longer needed. Reusable artist profiles can be kept current for future shows; do not leave obsolete sensitive details in archived riders.
• Operational logs and backups: the production database currently has daily automatic backups with a one-day retention setting. Manual backups are retained until separately removed. Other supplier-managed logs and recovery copies follow the applicable service's retention cycle. We do not promise immediate deletion from every backup. Copies awaiting expiry are restricted, and an approved deletion must be reapplied if a backup is restored. Records needed to investigate an incident are retained only while justified. Ask us for the applicable cycle when making a deletion request.

Cookie expiry is described in the Cookie policy and is separate from deletion of server-side records. Files downloaded by other people and emails already delivered are outside our ability to recall.

8. Your rights, requests and complaints

You can ask for access, correction, erasure, restriction or portability of your personal information and object to processing based on legitimate interests. Rights depend on the circumstances; personal-data access is not an entitlement to another person's confidential information or every commercial workspace record.

You can request deletion of your True account from the Account screen in either iOS app. The app signs you out immediately and we complete the request within seven days. Shared show and financial records may be retained in anonymised form where another team still needs them or the law requires retention.

1. Email hello@venuetrue.co.uk, preferably from your account email, saying what you need and which account, venue or show it concerns. “Privacy request” is a helpful subject, but no special wording or form is required. You can ask for a readable copy and, where portability applies, a commonly used machine-readable export.
2. We aim to acknowledge within five working days. We verify identity proportionately, normally through the existing account or email; do not send passports, payment-card details or passwords unless a specific justified identity check has been agreed. A representative can act with appropriate authority.
3. We normally respond within one calendar month of receiving the request, subject to legally permitted identity/clarification rules. If complexity or the number of requests permits an extension of up to two further months, we explain why within the initial month. Requests are normally free; any lawful refusal or fee is explained, together with your challenge rights.
4. We provide information securely, redact other people's information where necessary, and explain any data we must retain. If a venue or promoter is responsible for the processing, we identify that controller and help route the request appropriately. Premium access is not required to exercise these rights.

For a privacy complaint, use the same email and explain the concern. We acknowledge promptly and no later than 30 days, investigate without undue delay, keep you informed and explain our outcome and available remedies. You can complain to the Information Commissioner's Office; the ICO normally asks you to raise the matter with the organisation first.

Accounts are adult-managed. Younger band members can be represented, but their information should be limited to what the show needs and shared only with appropriate people. Contact us about a child's information or an account created by someone under 18 so we can assess the situation and protect their rights. We do not use solely automated decisions with legal or similarly significant effects about individuals; calculations and matching support human decisions.

9. Security and changes

Access permissions restrict workspace functions and private documents. Account passwords and calendar-link passwords are hashed. These measures do not eliminate every risk; choose strong passwords and check recipients before sharing files or links.

This notice will change as the service and suppliers change. Its version date appears above. Material new uses of information will be explained, and consent requested where required, before those uses begin.