Privacy Policy

1. Who we are

StageVault is a portfolio platform for young performers. We help parents and guardians organise and share photos and videos of their children's performances with agents, casting directors, and family members.

2. Information we collect

We collect: the email address and display name you use to create an account; the photos, videos, and audio you upload; information you add about performers and your activity (performer names, birth year, bios, and event, studio, and team details); messages you send to our AI assistant or to support; the email addresses of people you invite; and basic usage, device, and error data (such as page views and crash diagnostics). We do not collect payment card data directly — payments are handled by our payment processor.

For share and reel links, we log a one-way hash of the viewer's IP address and a truncated device fingerprint (derived from IP, browser, and language). These are used only to count unique viewers and are designed to reduce direct identifiability, though they may still constitute pseudonymous personal data.

3. Children's privacy (COPPA)

StageVault accounts are created and controlled only by adults (parents, guardians, or performers aged 18+). Children may not create accounts or submit information directly, and we do not knowingly collect personal information directly from children under 13.

Adult account holders may upload photos, videos, audio, and related details about minor performers. By using StageVault, you represent that you are the minor's parent or legal guardian, or are authorized by them, and you consent to our collection, use, disclosure, and retention of that minor's personal information as described in this policy — including processing by the AI providers listed below.

If you believe a child under 13 has created an account, or that a minor's information is on StageVault without the proper guardian's consent, contact us immediately at privacy@stagevault.art and we will remove the account and its data.

4. How we use your information

We use your information to operate the service: store and serve your media, send transactional emails (magic-link sign-in, invite emails), and provide analytics on who has viewed your links. Some features — automatically organizing your uploads, the AI assistant, and song detection — send the relevant content to third-party AI providers to generate those results for you (see “Sharing your information” below for the providers). Because your media may contain minors' faces and voices, that media may be analyzed by these providers to deliver those features. We do not create, sell, or share biometric identifiers, faceprints, or facial-recognition templates, and no feature matches a performer across uploads using facial recognition. We do not sell or share your personal information (as those terms are defined under California law), and we do not show you ads.

5. Sharing your information

Your content is private by default. It is only accessible to people you explicitly share a link with, or family members you invite. We share data with sub-processors necessary to operate the service: Supabase (database and authentication), Cloudflare R2 (media storage), Mux (video encoding and delivery), Vercel (hosting), Resend (email delivery), Stripe (payments), Modal (video processing), and Sentry (error monitoring and session replay; configured to mask text and block media by default). To power AI features, the relevant content is also processed by OpenAI and Anthropic (automatic organization of uploads and the AI assistant) and ACRCloud (song detection). Each sub-processor receives only the data needed for its function and handles it under its own terms; we do not control their independent data practices. We will disclose information if required by law.

6. Data retention and deletion

You may delete your account at any time from your account settings. Deletion promptly disables access and schedules your account data and uploaded media for deletion within 30 days, except for limited records we may retain for backup, security, legal, or payment purposes, and any data already held by our providers under their own retention terms. Account-data exports are currently available on request; to request an export or full deletion, email privacy@stagevault.art.

7. Cookies

We use a single session cookie set by Supabase Auth to keep you logged in. We do not use third-party tracking cookies or advertising cookies.

8. Your rights

Depending on your location you may have rights to access, correct, export, or delete your personal data. To exercise any of these rights, email privacy@stagevault.art.

9. Changes

We may update this policy before public launch. Material changes will be communicated via email to registered account holders.

10. Contact

Questions about this policy? Email privacy@stagevault.art.