Privacy Policy

Account data: email address, display name, phone number, password (stored only as a hash), and the language you choose.

Artist profile data (Artists only): stage name, bio, photos, sample tracks, city, genres, fees, availability calendar, and the bank account (IBAN) used for payouts.

Booking data: event date, city, event type, venue address, contact details entered on the booking form, the quote, the booking summary, and the messages exchanged in the booking chat.

Payment data: the amount, date, status, and the bank's transaction reference for each card payment and refund, plus the last four digits and card brand as returned by the bank. We never receive or store the full card number, expiry date, or CVV; those are entered on the bank's secure payment page.

Sign-in data: when you sign in with Google, we receive your email, name, and Google account ID. We never receive your Google password.

Technical data: the authentication token in your browser's local storage, IP address and browser type in server logs (kept for 30 days for security), and error reports. We do not run advertising trackers.

Agreement records: when you accept our Terms, Privacy Policy, and Refund & Cancellation Policy, we record the date and time, the version, your account and email address, your IP address, and your browser.

Visitor statistics (only if you accept analytics cookies): the pages you visit, how you arrived (the referring website or campaign link), your approximate city and country, your device and browser type, and these actions: searching, viewing an artist, sending a booking request, paying for a booking, and signing up. They are collected by Google Analytics under a random identifier, never with your name, email, or phone number.

To perform the contract with you: creating your account, showing Artist profiles to Clients, delivering booking requests and messages, processing deposits, refunds, and payouts, issuing invoices, and sending transactional emails (confirmations, password resets, payout notices).

To comply with legal obligations: accounting and tax records, responding to lawful requests from authorities, and anti-fraud checks required by our acquiring bank.

For our legitimate interests: keeping the Platform secure, preventing abuse, resolving disputes between Clients and Artists, keeping proof that you accepted our Terms, and improving the service. We do not profile you for advertising.

With your consent: drafting a booking contract with our AI assistant (both parties opt in per booking), optional integrations that you or an administrator connect, and measuring visits with Google Analytics cookies (only if you click "Accept" in the cookie banner).

Database and authentication: Supabase (Postgres), hosted in the EU (Frankfurt, Germany). Access is restricted by row-level security so that you can only read your own bookings, profile, and messages.

Hosting: our application server is operated by DigitalOcean in the EU.

Card payments: Bank of Georgia (and, where enabled, TBC Bank) as acquiring bank. Card data is processed entirely by the bank under its own privacy policy and PCI DSS certification.

Transactional email: Resend (resend.com). The recipient address, subject, and message body transit through Resend's servers.

AI contract drafting: Anthropic's API. The prompt contains only the chat history and booking details of the single booking being drafted. Anthropic does not use API data to train its models.

Optional integrations (for example Google Calendar or Gmail) are connected through Composio (composio.dev) by an administrator; access tokens are held by Composio, not by us.

Visitor statistics: Google Analytics 4 (Google Ireland Limited and Google LLC), loaded only after you accept analytics cookies. Google Analytics does not store IP addresses; advertising features and Google signals are switched off. Google may process the data in the United States under its data-processing terms, which contain contractual data-protection guarantees.

International transfers. Supabase and our application server are in Germany (EU). Resend and Anthropic are companies in the United States, and DigitalOcean is a US company hosting us in the EU. The United States is not on Georgia's list of countries with adequate data protection, so these transfers are made under written data-processing agreements containing contractual data-protection guarantees, as permitted by Articles 37 and 38 of the Law of Georgia on Personal Data Protection. Only the minimum data needed for each service is transferred (an email address and message for Resend; one booking's chat for Anthropic).

The other party to your booking: a Client sees the Artist's public profile and the details the Artist shares in chat; an Artist sees the Client's name, contact details, and event details for that booking only.

The processors listed above, each only to the extent needed to provide their service to us.

Public authorities, courts, or our bank when required by law or to investigate fraud or a payment dispute.

We do not sell personal data and do not share it with advertisers.

Account and profile data: for as long as your account is active, and up to 30 days after you close it.

Booking, chat, and payment records: for the life of the booking and afterwards for the period required by Georgian accounting and tax law (currently 6 years), because they are financial records. They are then deleted or anonymised.

Server logs: 30 days.

Records of your acceptance of our legal documents: for as long as your account exists, and afterwards for as long as claims relating to it can be brought under Georgian law.

Visitor statistics in Google Analytics: 14 months, then deleted automatically.

When you close your account, your name and contact details are removed from the Platform; the other party to a completed booking keeps the booking record as their financial document.

You have the right to access your data, receive a copy of it, correct it, delete it (subject to the retention required by law), restrict or object to certain processing, withdraw consent where processing is based on consent, and not be subject to solely automated decisions with legal effects. We do not make such automated decisions.

To exercise any of these rights, email kikvadzedata47@gmail.com. We respond within 10 business days and never charge for a first request.

If you believe we have processed your data unlawfully, you may complain to the supervisory authority for personal data protection in Georgia, which since 2 March 2026 is the State Audit Office of Georgia (sao.ge). EU residents may also complain to their local supervisory authority.

Strictly necessary: one first-party authentication token (managed by Supabase Auth) and local-storage entries for your language and your cookie choice. They are needed for the service to work and do not require consent.

Analytics (optional): Google Analytics cookies (_ga and _ga_<id>, kept up to 2 years) are set only if you click "Accept" in the cookie banner. If you click "Decline", they are not set. You can change your choice at any time under "Cookie settings" at the bottom of every page; if you withdraw consent, we delete those cookies.

We set no advertising cookies. The bank's payment page may set its own cookies under the bank's policy.

All traffic to showflow.ge is encrypted (HTTPS). Passwords are hashed. Database access is limited by row-level security and server-side keys that are never sent to the browser. Card data never touches our systems. We review access and dependencies regularly, and we will notify you and the supervisory authority of a data breach that affects you as the law requires.

The Platform is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has registered, contact us and we will remove the account.

We may update this policy as the service evolves. Material changes will be announced on the Platform or by email. The date at the top of this page shows the current version.