Scene Lead Privacy Notice

Pilot Version 1.3.0

This notice explains how Cyriac Labs, LLC handles personal information in Scene Lead. It is a public notice, not a contract term; the Scene Lead Master Services Agreement (Pilot Terms of Service) and its Data Processing Addendum govern our obligations to studios.

1. Which part of this notice applies to you

Studio owners and staff who sign in to Scene Lead: Cyriac Labs is responsible (the "controller") for your account information. See section 2.

Students, parents and guardians, purchasers and attendees whose information a studio puts into Scene Lead, or who register, pay or check in through a studio's Scene Lead pages: the studio is responsible for your information. It decides what to collect and how to use it. Cyriac Labs processes that information on the studio's behalf, as its service provider, to run the Service. See section 3.

Sections 4 to 13 apply to everyone.

2. Studio owners and staff

What we collect.

• Account information. Staff sign in with Google. We receive your name, email address, profile picture link and Google account identifier. We never receive your Google password.
• Membership and activity. The studios you belong to, your role and access period, invitations, and audit records of significant actions you take (who did what, and when).
• Acceptance records. When you accept Scene Lead terms, we record the exact document version and its content fingerprint, the time, the studio (where relevant) and, where available, your browser's user-agent string.
• Support requests you send through "Report a problem" in the app.
• Connected calendar. If you connect a Google Calendar, we request your Google account email address and read-only access to your calendar list and busy/free times — not event titles or details — and store the access credentials encrypted.
• Technical data. Our hosting provider's request logs record technical data such as IP address and browser type. We use IP addresses briefly in memory to rate-limit requests.

How we use it. To provide, secure and support the Service, act on your instructions, keep records of what was agreed and done, contact you about the Service, and meet legal obligations.

3. Students, guardians, purchasers and attendees

What a studio may put into Scene Lead. Names and contact details (email, phone); class, event and program registrations; who is covered by a purchase; attendance and check-ins; payment records (amounts, fees, refunds and dispute status — never card or bank numbers); answers to questions the studio adds to its forms; acceptances of the studio's own policies and waivers; messages and replies; text-message consent; notes; and, where the studio sets it up, guardian links and student-portal access. If a student chooses to link a Google sign-in to their portal, we also store that sign-in's identifier.

Your requests go to the studio. To see, correct, delete or ask about your information, contact the studio you registered with. The studio can view and correct records, export its data, and permanently remove a student's personal details (section 8). We help studios answer requests.

If you contact us directly about information a studio holds, we will pass your request to that studio where we can identify it, tell you so, and help the studio respond. We do not change a studio's records without its instruction unless the law requires it.

Entering information about other people. A parent, guardian or purchaser can register and pay for other attendees and enter their names and, optionally, their email or phone. If you do this, you must have the authority or permission to share that person's information with the studio.

Text messages. If a studio texts through Scene Lead, the registration form asks "Yes, text me" or "No, email only". Neither answer is preselected, and choosing No never blocks registration or payment. We record each answer with the exact wording you were shown. You are sent scheduled or operational texts only if you answered Yes, or if — after any recorded opt-out, including a "No, email only" answer — you texted START or UNSTOP to the studio's number (YES also works after you replied STOP). Studio staff can record that you do not want texts but cannot record that you agreed to them. Reply STOP at any time to stop texts from that studio; it is honored on every later send. Texts are operational (such as confirmations, reminders, class changes and waitlist openings), plus replies to people who texted the studio first: staff replies, confirmations of STOP, START and HELP, and — if the studio turns it on — one automatic reply per number per 24 hours saying the number is not monitored. No mobile information is shared with third parties or affiliates for marketing or promotional purposes, and text-message opt-in data and consent are not shared with any third party.

Email. Scene Lead sends only operational email for a studio, such as confirmations, reminders, notices and links. It does not deliver marketing campaigns by email or by text.

4. Children

Scene Lead is a business tool directed to studios, not to children. Studios may register minors, usually through a parent or guardian who enters the child's details. Scene Lead's standard registration form does not ask for a person's age or date of birth (a studio may add its own questions). Scene Lead is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. Studios must collect a minor's information from a parent or guardian.

If we learn that a child under 13 has given personal information directly through Scene Lead without a parent's or guardian's involvement, we will tell the studio and work with it to delete that information or obtain the required consent. Parents and guardians can also contact the studio or us.

5. Who we share information with

We do not sell personal information, and we do not use it for targeted advertising. We share it only as follows.

• Google Cloud / Firebase — What it does: Hosting, database, sign-in, file storage, secret storage, scheduled jobs; What it receives: All Service data; When: Always
• Stripe — What it does: Processes payments on the studio's own connected Stripe account; the studio is the merchant; What it receives: The studio's name and contact email when the account is set up; for each checkout, the payer's email and the items and amounts being bought. Card and bank details are entered on Stripe's own page and never reach Scene Lead; When: When the studio connects payments
• Twilio — What it does: Sends and receives texts through a separate Twilio subaccount we hold and manage for each studio; What it receives: Recipient phone numbers, message text, replies texted to the studio's number, delivery status, and the studio's business details for carrier registration; When: When the studio turns on texting
• Resend — What it does: Delivers Scene Lead's transactional email for studios; What it receives: Recipient email address, sender name, reply-to address, subject and message; When: When the studio turns on email
• Google Calendar — What it does: Reads busy/free times from a staff member's calendar; What it receives: Only what the request needs; we receive busy/free times and the calendar list; When: Only when a staff member connects a calendar

We also share information within a studio (members see what their role allows), with the public only as a studio chooses to publish it on its pages, and where required by law or to protect the Service, its users or others.

Where data is stored. The Service is hosted on Google Cloud in the United States; the application, the database and uploaded images are in Google's us-east4 (Northern Virginia) region. Google's sign-in service operates globally.

No trackers. Scene Lead uses no third-party analytics, advertising or session-replay tools. If a studio switches on visitor counts for its Scene Lead website, we keep only an aggregate count of page views per day — no IP address, browser details or other identifier.

6. Studio websites, embedded forms, cookies and browser storage

Embedded registration forms. A studio can show its Scene Lead registration form inside its own website. Only website addresses the studio lists can display the form; browsers refuse it everywhere else. The form stores no information about you in your browser. Payment always opens on Stripe's page in the full browser window, never inside the studio's site. The studio's own website is run by the studio, under its own privacy practices.

Cookies. Scene Lead sets only strictly necessary cookies: a secure, HttpOnly session cookie when you open a student-portal or placement link, so the link's secret does not stay in your address bar. We set no advertising or analytics cookies.

Browser storage. For signed-in staff, the Google sign-in library keeps your sign-in state in your browser, and the app stores display preferences and unsaved setup drafts locally. Some public registration and payment pages keep a temporary link code in that browser tab's session storage while you finish a step.

7. Security and who can access data

We use these safeguards:

• Google's infrastructure encrypts data in transit and at rest. Provider and calendar credentials are additionally encrypted by Scene Lead with AES-256-GCM, using a key kept in a managed secret store.
• Database access rules apply to every read and write made from the app, and signed-in server operations check sign-in, membership and role (public and provider requests are checked by access-link secrets or provider signatures): data is separated by studio and by role, and anything not expressly allowed is refused.
• Personal links (registration, portal, waitlist-offer, booking and invitation links) carry random secrets that we store only as one-way hashes.
• Audit records cannot be edited or deleted by studio users.

Support access. Through Scene Lead's support tool, our support staff can open a studio's records only after the studio's owner grants access. A grant is read-only, lasts as long as the owner chooses (up to 90 days), can be revoked at any time, and each support session is limited to four hours. Viewing an individual student's details during a session is recorded.

Other access you should know about.

• Our operators can look up basic details of a studio account (its name, creation date, plan, support-grant status, open support requests and a masked owner email) without a grant, by exact studio ID or owner email. Each lookup that finds a studio is logged.
• If all of a studio's owners are unavailable (for example locked out), our operators can grant ownership to a named person through an emergency recovery path that requires a written reason and is recorded in the studio's audit log.
• Authorized Cyriac Labs personnel with access to our cloud infrastructure could technically access stored data. We limit such access to operating, securing and supporting the Service.

No system is perfectly secure, and we cannot promise that a security incident will never occur.

8. Retention, deletion and export

Retention. We have no automatic deletion schedule. A studio's data is kept while the studio is active and until it is deleted. Acceptance records, audit logs, payment records and text-message consent and opt-out records are kept as evidence of what was agreed and done, and to meet legal obligations. Database backups (point-in-time recovery) can hold deleted data for up to 7 days. Uploaded website images are not backed up.

Deleting a student's details. A studio's owner or administrator can permanently remove an individual student's personal details from the student record. This cannot be undone in the product. Some related records — such as payment, registration, message, attendance and consent records — are kept so that money and history remain accurate and as evidence.

Closing a studio. Deleting a studio's data is a manual process that we carry out on the owner's request. We will tell the owner what was deleted and what is retained, and why.

Information held by providers. Stripe, Twilio and Resend keep the information they received under their own retention policies; deleting it from Scene Lead does not delete it from them.

Export. A studio's owner can export the studio's core records (such as classes, students, registrations, attendance and payment records) at any time. The export does not include every record type: for example, message bodies (only message metadata is included), uploaded images, and security credentials are excluded.

9. Your privacy rights

Depending on where you live, state law — for example the Maryland Online Data Privacy Act or California's privacy laws — may give you rights to access, correct, delete or obtain a copy of your personal information, and to appeal a decision about your request. Whether a law applies depends on the law's thresholds.

• Student, guardian, purchaser or attendee information: contact the studio (section 3).
• Studio staff account information: contact Cyriac Labs at legal@cyriaclabs.com or through Help → "Report a problem" in the app. We may need to verify your identity before acting.

We do not sell personal information, do not share it for targeted advertising, and will not discriminate against you for exercising your rights.

10. If there is a security incident

If we discover a security incident affecting personal information a studio holds in Scene Lead, we will notify the affected studios without undue delay, tell them what we know, and support them in giving any notifications the law requires of them.

11. Test environments

Production data is not copied into our test environments. If that ever changes, we will update this notice first.

12. Changes to this notice

We publish each version in Scene Lead with its version number. For a material change, we publish the new version before it takes effect and ask studio owners to review it in the app.

13. Contact

Cyriac Labs, LLC — legal@cyriaclabs.com — 127 Lazy Hollow Drive, Gaithersburg, MD 20878. Studio staff can also use Help → "Report a problem" in the app. Students, guardians, purchasers and attendees should contact their studio first.