1. Data we may process
- Account data such as name, email, user ID, language and settings.
- Sign-in and security data such as security logs, IP address and device/browser information where necessary.
- Project and membership data such as project names, roles, invitations and access rights.
- User content such as audio files, stems, song data, show data, stage setups and metadata.
- Technical data such as error reports, operational logs and performance data.
- Payment and subscription data. Full card details are normally handled by the payment provider.
- Support communication and rights-related correspondence.
2. Purposes and legal bases
We process account, project and usage data where necessary to perform the agreement. Security and limited operational data may be processed on the basis of the agreement and/or legitimate interests. Payment and accounting data are processed to perform the agreement and comply with legal obligations. Optional analytics or marketing that requires consent will not be enabled before valid consent is obtained.
3. User content is private by default
Audio files and other project material are not published to the general public as part of the normal Showbank service. Content is made available to users, project members and devices you authorize.
Staff or subprocessors should not access user content unless required for operation, security, support requested by the user, legal obligations or a specific legal claim.
4. Suppliers and recipients
We may use suppliers for hosting, network/domain security, email, payments, error logging, backup and support. They receive access only to the extent needed to provide their service.
Where a supplier processes personal data on our behalf, a data processing agreement is used where required. Transfers outside the EEA must have a valid transfer mechanism.
For subscriptions through Stripe Managed Payments, Stripe/Link receives the information needed for payment and invoicing, such as billing email, name, billing address and payment method. Stripe/Link processes this information in its own role in the sale. See Stripe's privacy policy through the link below.
Showbank records the link between the project and its Stripe customer/subscription, subscription status and paid periods to provide the correct project access. The billing email may differ from the Showbank sign-in email. Complete card data is not stored in Showbank, and project audio is not sent to Stripe as part of payment.
5. Retention
- Active account and project data are stored while the account or project is in use.
- Deleted data are removed or anonymized within a reasonable period; backups may persist temporarily until normal rotation.
- Operational and security logs are not retained longer than necessary.
- Accounting and payment documentation is retained for the period required by law.
- Data required for a specific legal claim may be retained while the claim can be pursued.
6. Your rights
- Access
- Correction
- Erasure where the legal conditions are met
- Restriction of processing
- Data portability where applicable
- Objection to processing based on legitimate interests
- Withdrawal of consent where consent is the legal basis
- Complaint to the Norwegian Data Protection Authority (Datatilsynet)
7. Showbank as processor
In some cases an organisation or project customer may be the controller for personal data they add to Showbank, while Showbank processes the data on the customer’s behalf. In those situations Showbank processes the data under the customer’s documented instructions and applicable data processing terms.
For ordinary account data, subscriptions, security and our own customer administration, Showbank is the controller.
8. Cookies and local storage
Showbank may use cookies and local storage strictly necessary for sign-in, security, sessions and functions explicitly requested by the user. Non-essential analytics or marketing requiring consent will not be enabled before consent is obtained.
9. Security and incidents
We use technical and organisational measures such as access control, encrypted transport, secure sign-in mechanisms, logging and backups where relevant. No online service can guarantee absolute security.
Personal-data breaches are documented and, where required, reported to Datatilsynet and affected individuals.
10. Contact
Privacy requests may be sent to [email protected]. Controller: ULLTANG BYGG- OG HANDVERKARTENESTER, org. no. 993 993 085 MVA, Førdefjordvegen 312, 6815 Førde, Norway.