Privacy Policy
Effective 10 October 2026 · Version 2026-10-10
In short
- We collect only what we need to run Show Day HQ: your login, your company workspace and basic technical logs.
- We never sell your data, show you ads, track you across websites or use your data to train AI.
- Nobody at The Right Management, including our developers, looks at your data unless you ask us to, the law requires it, or there is a security incident.
- The data your company puts in (clients, artists, crew) belongs to your company. We only process it for you.
- Delete your account or company and it is deleted immediately. If your subscription ends, everything is deleted after 30 days.
- You can access, correct or delete your data, withdraw consent, nominate someone, and complain to us or to the Data Protection Board of India.
1. Who we are and what this covers
Show Day HQ (the "Service") is operated by The Right Management, a GST-registered business in India ("we", "us"). This Privacy Policy explains how we handle personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the rules made under it.
We handle personal data in two roles:
- As Data Fiduciary for your account data: the people who sign up and use the Service, including on-ground managers, crew and others who create a Show Day login after being invited to a show. This policy covers that data.
- As Data Processor for Customer Data: the information a company puts into its workspace about its clients, artists, crew and other contacts. The company is the Data Fiduciary for that data and decides how it is used. We process it only on the company's instructions, under our Data Processing Terms. If you are a client, artist or crew member of one of our customers, please contact that company first. We will help them respond.
This policy does not apply to self-hosted copies of the Service that an Enterprise customer runs on its own servers. That customer is responsible for them.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, password (stored only as a one-way encrypted hash that we cannot read), the date and version of the terms you accepted | You, at sign-up |
| Workspace details | Company name, web address (slug), your role, team membership, branding (logo, colours) | You and your team |
| Billing details | Plan, billing status, invoices, GST details you give us. Card and bank details are handled by the payment provider and never stored by us | You and our payment provider |
| Technical and security data | IP address, browser and device type, sign-in times, error and security logs | Your device, automatically |
| Support messages | Emails and messages you send us | You |
We do not ask for sensitive personal data such as health information or bank and card numbers, and you should not put it into the Service. If a company uploads identity documents to a show (for example for travel or venue access), it does so as Data Fiduciary for that person, should limit them to managers and delete them after the show. People who only open a public proposal or show link are not asked for any personal data. Our servers may log their IP address and browser for security.
3. Why we use it
| Purpose | Data used | Legal basis under the DPDP Act |
|---|---|---|
| Creating your account, signing you in and running your workspace | Account, workspace | Your consent, given at sign-up |
| Plan limits, billing and GST invoices | Workspace, billing | Your consent, and compliance with tax law |
| Keeping the Service secure, preventing abuse and investigating incidents | Technical and security data | Your consent, and compliance with the DPDP Rules and IT Act |
| Essential service emails (sign-up confirmation, password reset, security and billing notices, changes to these terms) | Email address | Your consent |
| Answering your support requests | Support messages, and only the data needed for the request | Your consent |
| Giving invited team members access to the shows they were added to | Account details, show assignment | Your consent, given when you accept the invite |
| Meeting legal obligations and responding to lawful requests | Only what the request requires | Legitimate use under section 7 of the DPDP Act |
We do not use your data for advertising, profiling, selling, or training artificial intelligence. If we ever want to send marketing emails, we will ask for separate consent first, and you can say no without affecting your account.
4. No access by our staff
No one at The Right Management, including our developers, opens, reads or reviews your account data or Customer Data, except: (a) when you, or an owner or admin of your workspace, ask us to in writing for a specific support request, and only for that request; (b) when Indian law, a court order or a government authority with legal power requires it; or (c) to investigate and fix a security incident or a serious breach of our Terms. Where the law allows, we tell the workspace owner when this happens. The admin tools we use to manage subscriptions can change plans but are not built to browse customer data.
5. Who we share it with
We never sell personal data. We share it only with the service providers that run the Service for us, under contracts that require them to protect it and use it only to provide their service:
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | Data stored in India (Mumbai region) |
| Railway | Hosting the web app that serves pages and processes requests | Servers may be outside India |
| Email delivery provider | Sending sign-up, password and service emails | May be outside India |
| Payment provider (when online payments are enabled) | Taking subscription payments | India |
We may also disclose data when Indian law requires it, to protect the rights and safety of users or the public, or as part of a reorganisation or sale of the business (in which case this policy continues to apply and we will tell you). WhatsApp messages are sent from your own device and WhatsApp account. We do not send them on your behalf, and Meta's privacy policy applies to them.
6. Transfers outside India
Our database and files are stored in India. Some providers listed above may process data on servers outside India while serving a request. We transfer personal data outside India only as permitted under section 16 of the DPDP Act, and never to a country the Central Government has restricted.
7. How long we keep it
| Data | How long |
|---|---|
| Account and workspace data, Customer Data | While your account and subscription are active |
| After you delete your company or account | Deleted immediately |
| After your subscription ends (part-way or at the end of a billing period) | Kept for 30 days so you can download it or come back, then permanently deleted |
| Copies in rolling backups | Removed within 30 days of deletion |
| Security and access logs | At least one year, as required by the DPDP Rules, 2025, then deleted |
| Invoices and payment records | For the period required by GST and tax law |
Logs and invoices that we must keep do not contain your Customer Data.
8. How we protect it
Every company's data is kept separate by rules enforced inside the database itself. Data is encrypted in transit and at rest, passwords are hashed, and access is limited by role. Read more on our Security page.
9. Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of the personal data we hold about you and how we use it, and the providers we have shared it with.
- Correct and update: fix inaccurate or incomplete data. Most details can be changed directly in the app.
- Erase: delete your account in Settings → Account & data, or ask us to.
- Withdraw consent: as easily as you gave it, by deleting your account or writing to us. Withdrawal does not affect processing already done. Because your account cannot work without the data in section 2, withdrawing consent means closing the account.
- Nominate someone to exercise these rights for you in the event of your death or incapacity.
- Grievance redressal: complain to us, and if you are not satisfied, to the Data Protection Board of India.
To use any of these rights, email info@therightmanagement.in from the email address on your account. We may need to confirm your identity. We acknowledge requests within 24 hours and respond within 15 days, and in every case within the time the DPDP Rules allow.
10. Personal data breaches
If a personal data breach affects you, we will tell you without delay through your registered email: what happened, the likely impact, what we are doing about it and what you can do. We will also report it to the Data Protection Board of India as the DPDP Rules require. For Customer Data, we notify the affected company, as set out in our Data Processing Terms.
11. Cookies
We use only the cookies needed to keep you signed in and secure. We do not use advertising or analytics cookies and we do not track you across other websites. Blocking these cookies will stop you from signing in.
12. Children
The Service is for businesses and adults only. We do not knowingly collect personal data of anyone under 18. If you believe a child has signed up, contact us and we will delete the account.
13. Changes to this policy
If we make a material change, we will tell you by email or in the app at least 15 days before it takes effect, and ask for fresh consent where the law requires it. The version and effective date are at the top of this page.
14. Contact and grievances
For any privacy question, request or complaint, contact the Grievance Officer, The Right Management at info@therightmanagement.in.