Privacy Policy.

1. Who we are, and two different roles we play

This Privacy Policy explains how Prompter Solutions Limited ("Prompter", "we", "us"), a company registered in New Zealand (company number 9447782, NZBN 9429053847911), handles personal information in connection with the Prompter platform at get-prompter.app and related subdomains.

Prompter handles personal information in two distinct roles, and which one applies changes your rights and our obligations:

• As a controller — for information about our own users and customers: the people who create accounts and run organisations, including their account, billing, and support information. We decide how and why this information is used.
• As a processor — for the information an organisation ("Org") uploads about its people (cast, crew, applicants, and contacts) to run its productions. The Org decides what to collect and why; we process it on the Org's behalf and on its instructions.

In plain terms: if you are a theatre company using Prompter, you are responsible for the personal information you hold about your cast and crew, and we look after it for you securely. If you are a cast or crew member asking how your information is used, the organisation that added you to Prompter is the right first point of contact, and this policy explains how we handle it on their behalf.

2. Information we collect

Account and organisation information (we are controller):

• your name and email address, used to create and secure your account;
• organisation details you provide;
• billing information — processed by Stripe; we receive limited details such as subscription status and the last digits/brand of a card, not full card numbers;
• support communications and feedback;
• if you register your interest before public sign-up opens, the name, email address, and any details you give us on that form.

Organisation content (we are processor): information an Org uploads to manage productions, which may include, for the Org's people:

• names, email addresses, and phone numbers;
• department, role title, and notes;
• emergency contact details;
• headshots and other images;
• audition files submitted by applicants (for example, audition videos, CVs, and headshots).

An Org's public pages also collect information from members of the public — again with the Org as controller and us as processor:

• audition applicants who sign up through an Org's public audition form;
• ticket buyers, where an Org sells tickets through Box Office — name, email address, and order and ticket details (card details go to Stripe, not to us);
• event registrants, where an Org collects RSVPs for an event — name, email address, and optional phone number.

Bard AI interactions (see section 6): the questions you ask the Bard assistant and the related production context it uses to answer.

Technical and usage information: information collected automatically to operate and secure the platform, such as device and browser data, IP address, and server log data.

Page analytics. We measure how our pages are used with our own first-party, cookieless analytics — no third-party analytics service is involved, and nothing tracks you across other websites. For each page view we record the page, the type of surface (marketing site, app, an Org's public site, or an audition page), and a coarse country derived from network routing. We deliberately do not store your IP address, do not set an analytics cookie, and do not store any account identifier. To count returning visits within a single day we store a one-way salted hash of your IP address and browser type, which changes daily and cannot be reversed or linked across days. Paths inside the app are normalised before they are recorded (for example /productions/:id/budget), so we record which feature was used, never which organisation's record.

3. How and why we use information

We use personal information to:

• provide, maintain, and secure the Services;
• create and administer accounts and organisations;
• process subscriptions and ticketing payments;
• send service communications, including account, billing, and security messages, and invitations sent on an Org's behalf;
• provide the Bard AI assistant when enabled;
• respond to support requests and improve the Services; and
• comply with our legal obligations.

For information we hold as a processor, we use it only to provide the Services to the Org and on the Org's instructions — not for our own independent purposes, and not to train AI models.

4. The processor relationship in more detail

When an Org uploads information about its people, the Org is responsible for:

• having a lawful basis and any necessary notices and consents for collecting and uploading that information — including, where a person is under 18, any consent required from a parent or guardian;
• the accuracy of that information; and
• responding, in the first instance, to requests from those people about their information.

We will assist an Org to meet its privacy obligations where the Services allow (for example, by enabling correction and deletion of records), and we will act on an Org's reasonable instructions about the information we process for it.

5. Who else processes information (sub-processors)

We use trusted third-party providers to run the Services. Each processes personal information only as needed to provide its service to us. All of them are based outside New Zealand, which means your information is stored or processed overseas (see section 11).

• Supabase — database, file storage, and authentication. Hosted in Tokyo, Japan. This is where organisation content lives, including people records, emergency contacts, headshots, and audition files.
• Vercel — application hosting and content delivery. United States, with a global edge network.
• Cloudflare — domain name service for get-prompter.app. United States / global.
• Stripe — subscription billing and Box Office ticketing payments. United States / global.
• Resend — sending transactional email (invitations, confirmations, rehearsal calls, tickets, notifications). United States.
• Zoho — our own email inboxes, so anything you send us at an @get-prompter.app address is stored there. Australia.
• Anthropic — the AI model ("Claude") behind the Bard assistant. United States.

6. Bard and AI processing

The Bard assistant is powered by Claude, an AI model provided by Anthropic, accessed through Anthropic's commercial API. When you use Bard, the questions you ask and the related production information needed to answer them are sent to Anthropic to generate a response.

Based on Anthropic's published terms for commercial/API use as at the date of this policy:

• Anthropic does not use commercial/API inputs or outputs to train its models. (This differs from Anthropic's consumer products.)
• Anthropic automatically deletes API inputs and outputs from its systems within 30 days, except where content is flagged under its Usage Policy (retained for up to 2 years, with trust-and-safety classification scores kept for up to 7 years) or where retention is required by law.

We do not use your Bard interactions to train any AI model.

7. How long we keep information, and deletion

We keep personal information only as long as needed for the purposes described in this policy, or as required by law.

• Account and billing information is kept while your account is active. After closure we keep the limited billing and transaction records we are required to hold for 7 years, to meet legal, accounting, and dispute-resolution obligations (including New Zealand business and tax record-keeping requirements).
• You can export your data at any time while your account is open — a personal export, or a full organisation export if you are an Org owner. We recommend taking one before you close anything, because closure is not reversible.
• Closing a user account deletes that account and its personal records immediately.
• Organisation content is kept while the Org uses the Services and is handled on the Org's instructions. If an owner deletes an Org, it is frozen for 30 days — recoverable by the owner during that window — and then permanently deleted, including its stored files.
• Audition files: an applicant who is not cast shared their material for a single audition, for a single show. When the Org closes and archives that production, files those applicants uploaded through the public audition form are permanently deleted 30 days later — the 30 days being a window in which the Org can restore the production if it was archived by mistake. Files belonging to applicants who were cast are kept as part of the production record, and files an Org's own team uploaded are Org content rather than applicant material, so neither is affected. The applicant's registration itself (their name and contact details) is kept as part of the production's history; it is the uploaded files that are deleted.

8. How we protect information

We use technical and organisational measures to protect personal information, including encryption in transit, access controls, and tenant isolation so that one organisation cannot access another's data. No system is perfectly secure, but we work to protect information in line with good industry practice and our obligations under the Privacy Act 2020.

If a notifiable privacy breach occurs, we will act in accordance with the notification requirements of the Privacy Act 2020.

9. Your rights

If you are a Prompter account holder or customer, you may ask us to:

• access the personal information we hold about you; and
• correct it if it is wrong.

We will respond in accordance with the Privacy Act 2020.

If you are a member of an organisation (cast, crew, or applicant) whose information was added by an Org, please contact that organisation first, as it controls that information. We will support the organisation in responding to your request.

Where the GDPR applies (for example, if an organisation or its people are in the EU/EEA or UK), you may have additional rights, including rights to erasure, restriction, portability, and objection. Prompter is established in and operated from New Zealand and is not currently directed at the EU/EEA or UK market. Where the GDPR nonetheless applies, contact us at privacy@get-prompter.app and we will respond consistently with those rights.

10. Children's information

Account age requirements (set out in our Terms of Service):

• You must be 18 or older to create and own an organisation (the billing account).
• A person invited to an organisation may create a member or cast login from age 13.
• Children under 13 do not create their own account. They may take part in a production as a person record held by the organisation, with a parent or guardian as the contact.

Organisations may hold information about people under 18 as part of running a production — for example, young cast members or auditionees for a youth show. Where they do, the organisation is responsible for having any consent required from a parent or guardian and for handling that information appropriately. We process children's information only as part of providing the Services to the organisation, with the same protections as other organisation content, and we do not knowingly use it for any other purpose. We do not knowingly allow a child under 13 to create their own account; if we learn that one has, we will remove it.

11. Sending information overseas

Some of our providers (section 5) store or process information outside New Zealand, including in the United States. Where we disclose personal information to an overseas provider, we take reasonable steps to ensure it is subject to comparable safeguards, consistent with Information Privacy Principle 12 of the Privacy Act 2020.

12. Cookies and similar technologies

We use only cookies and similar technologies that are necessary to operate the Services — for example, to keep you signed in and to remember your preferences.

We set no analytics cookies, no advertising cookies, and no third-party tracking cookies. Our page analytics (section 2) are first-party and cookieless by design, which is why you are not asked to accept cookies to use Prompter.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will give reasonable notice. The "last updated" date above shows when it was last changed.

14. How to contact us, and how to complain

Prompter Solutions Limited, New Zealand (company number 9447782, NZBN 9429053847911).

For privacy questions or to exercise your rights, contact us at privacy@get-prompter.app.

If you are in New Zealand and are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz). If you are outside New Zealand, you may also be able to complain to the privacy or data-protection regulator where you live.