Privacy Policy

What we collect

When you create an account, we collect your name, email address, and role (venue operator, artist, promoter, or production). Depending on your role, we also collect your venue name and address, or your company or artist name — whatever you fill in during setup.

Beyond that, we collect the operational data you actually enter into VenueCircuit. That means show records, financial ledger entries, settlement figures, contacts, documents, tasks, guest lists, advances, and riders. If you typed it in or uploaded it, we have it — and it belongs to the organization, not us.

We also collect basic account activity data (login timestamps, session tokens) that we need to keep the platform running securely. We don't collect anything beyond what you give us or what the platform needs to function.

How we use it

Your data is used for exactly one thing: running VenueCircuit. It powers your dashboard, show records, financial tracking, team coordination, and everything else the platform does. That's it.

We won't sell your data. We won't share it with data brokers. We won't use show records or ledger entries to train models, run ads, or build profiles. This operational data isn't a product we're monetizing — it's information you trusted us to hold while you run your business.

Where it's stored

VenueCircuit runs on Supabase, which uses PostgreSQL hosted in the United States. Your organization's data lives in an isolated partition — it's not mixed in with other organizations. Authentication is handled by Supabase Auth, which manages login security, session tokens, and password hashing on our behalf.

Supabase is our infrastructure provider, and like any infrastructure provider, they have access to the systems your data sits on. They operate under their own security and compliance standards. We chose them because they're serious about data security and we're not trying to run our own database infrastructure.

Who sees this data

Within the organization, access is role-based. People added to an org can see what their role allows — nothing more. When you bring in collaborators from another organization (a co-promoter, a touring production team, a venue partner), their access is scoped to the specific shows or records you share with them.

We don't browse show records. The VenueCircuit team doesn't look at ledger entries or guest lists. We may access your account data if you contact support and specifically ask us to help with something — but that's reactive, not routine. We treat this data as if we were your accountant: we hold it, we don't read it for fun.

Integrations

VenueCircuit is designed to connect with third-party tools — ticketing platforms, point-of-sale systems, calendars, and others. When you authorize one of these integrations, data flows through those services' APIs according to the permissions you grant.

We don't store your third-party credentials. If you connect a ticketing platform, we use OAuth or an API key you provide — we don't save that credential in plain text, and we don't reuse it for anything beyond the sync you authorized. The sync data we pull in (ticket sales, door counts, etc.) lives in your VenueCircuit org just like anything else you enter manually.

Each third-party service has its own privacy policy that covers how they handle data on their end. We can't speak for them — check their policies before connecting.

Your rights

You can request an export of your data or ask us to delete your account and everything associated with it. Email us at hello@venuecircuit.app and we'll take care of it.

We're building self-serve export tooling — it's on the roadmap for during beta. Until then, reach out and we'll do it manually. We won't make you file a ticket and wait three weeks. This is a small team and we respond like humans.

Cookies & analytics

We use Plausible Analytics — a privacy-focused, cookie-free analytics tool that collects no personal data and sets no tracking cookies. Plausible only records aggregate page view counts (which pages were visited and from which country, roughly). There is no fingerprinting, no cross-site tracking, no ad networks, no pixel trackers. You don't need to consent to anything because nothing identifying about you is collected.

The only cookies we set are session tokens issued by Supabase Auth — they're what keep you logged in. They're first-party, they expire, and they're not shared with anyone.

Contact

Questions about this policy, your data, or anything else: hello@venuecircuit.app