Privacy Policy

Account data: your email address, display name, and (for musicians) profile content you submit — bio, photos, sample tracks, city, fees, availability.

Booking data: event date, venue, contact details you enter on a booking form, and the messages you exchange in the chat thread tied to a booking.

Authentication data: when you sign in with Google, we receive your email, name, and Google account ID. We do not receive your Google password.

Technical data: your browser sets a session cookie or local-storage entry containing an authentication token. We do not run analytics, advertising, or tracking pixels.

To create and operate your account, show your profile to relevant counterparties, deliver booking requests and messages, and send transactional emails (booking confirmations, password resets).

To generate AI-drafted booking contracts when both parties opt in, using the chat history of that single booking as context.

To investigate abuse, prevent fraud, and comply with legal obligations.

All personal data is stored in Supabase Postgres in the EU-Central-1 (Frankfurt) region. Database access is restricted by row-level security so that only you can read your own bookings, profile, and messages.

Transactional emails are sent through Resend (resend.com). The recipient address and subject line transit through Resend's servers; we do not log email body contents.

AI contract drafting calls Anthropic's API. The prompt sent to Anthropic includes the chat thread and booking metadata for the booking you are drafting; nothing else.

Optional integrations (e.g. Gmail, Google Calendar) are mediated by Composio (composio.dev) when an admin connects them; tokens are held by Composio, not by us.

We do not sell personal data. We share booking and message content only with the counterparty of that specific booking (the artist or the venue you contacted).

We may share data with the processors listed above (Supabase, Resend, Anthropic, Composio, Google), each acting under their own terms, only to the extent needed to operate the service.

We keep account data while your account is active. Bookings and chat messages are kept for the lifetime of the booking record and for as long as needed to handle disputes.

When you delete your account, your bookings remain visible only to the counterparty as historical records; your personal profile fields are cleared.

Under GDPR you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Email us at the address below to exercise any of these.

You can sign out at any time from the user menu. Signing out does not delete your data; only an explicit deletion request does.

We use a single first-party authentication cookie/local-storage entry managed by Supabase Auth. We do not set advertising or analytics cookies. We do not embed third-party trackers in the public site.

ShowFlow is not directed at children under 16. If you believe a child has registered, contact us and we will remove the account.

We may update this policy as the product evolves. Material changes will be announced on the site and dated above.