Privacy Policy

For your account information and this website, we decide how data is handled — we're the controller. For everything inside a company's workspace (rosters, travel details, registrations, documents), the company that runs the workspace decides why the data is there; we process it on their instructions. If you're a dancer, parent, staff member, or studio whose information lives in a workspace, the company running that workspace is your first point of contact for privacy requests, and we support them in honoring those requests.

• Account information: name, email address, role, and sign-in records for each user.
• Workspace content: whatever your company puts in — events, staff profiles (including travel details like home airports), schedules, rooming lists, registrations, uploaded documents, and financial records.
• Payment information: handled by Stripe. Card numbers never touch our servers; we see only what's needed to manage your subscription (plan, status, invoice history).
• Usage and log data: technical basics like IP address, browser type, pages viewed, and actions taken — used for security, debugging, and understanding what to build next.

• We don't sell personal information. To anyone. Ever.
• We don't run third-party advertising or ad-tracking cookies on the site or in the product.
• We don't use your workspace content to market to your customers or staff.
• We don't let AI providers train their models on your content (see section 5).

To run the Service: hosting your workspace, sending the emails you trigger (invites, notifications, sign-in codes), processing subscriptions, and keeping tenants strictly isolated from each other. To keep it safe: detecting abuse, debugging, and maintaining audit trails your admins rely on. To improve it: aggregate, de-identified usage patterns guide the roadmap. And to talk to you: service announcements and replies to things you send us. We only email marketing to people who asked for it.

Some features send relevant content — a document you drop in, a question you ask the AI assistant, roster facts a staffing run needs — to AI model providers through their business APIs. Those APIs are used under terms that prohibit the provider from training models on your content. AI features run when you invoke them; usage-priced AI features show their meter before anything is spent.

We use a short list of subprocessors to run the Service, each bound by data-protection terms:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and delivery.
• Stripe — subscription billing, and payment processing for companies using the Registration module.
• Resend — transactional email delivery.
• AI model providers — processing for the AI features described above, via no-training business APIs.

We'll update this list as it changes; materially new subprocessors get a mention in the changelog or by notice to workspace admins.

Companies running competitions routinely enter participant information, which can include minors' names, ages, and event details. That data belongs to the company's workspace: the company is responsible for collecting it lawfully and with the right consents, and we process it solely to provide the Service to them. Our website and product accounts are not directed at children, and we don't knowingly collect personal information directly from children.

We use essential cookies only: keeping you signed in and keeping the site secure. No advertising cookies, no cross-site tracking, no cookie banner theatrics required.

Data is encrypted in transit and at rest. Workspaces are isolated with row-level security enforced in the database itself, finance visibility is gated per person, and changes are recorded in audit trails. No system is perfectly secure, but security decisions here are structural, not bolted on — if you find a weakness, tell us at MeowCaniHelpYou@tryherdingcats.com and we'll act on it fast.

Workspace data is retained while the workspace is active. Close your account and we delete Customer Data from production systems within a reasonable period, with backup copies expiring on their fixed schedule. You can export your data in standard formats at any time first — we'd rather you leave with your data than feel locked in by it.

Depending on where you live (GDPR, UK GDPR, CCPA, and similar laws), you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to complain to a supervisory authority. For account data, email us and we'll handle it. For data inside a company's workspace, we'll route your request to that company and support them in honoring it. We don't discriminate against anyone for exercising privacy rights.

Our infrastructure is hosted in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the US under appropriate safeguards with our subprocessors.

When this policy changes materially, we'll notify workspace admins in the product or by email before the change takes effect. The “Last updated” date above reflects the current version.