Privacy Notice

Pilot Version 1.1.0

Scene Lead is operated by Cyriac Labs, LLC ("we", "us"). This notice explains how we handle personal information during the invitation-only pilot. The current version, its identifier, and its content hash are always published at /legal.

1. Scope and roles

Two roles matter:

- For account holders (studio owners, staff, organizers) we are responsible for your account information. - For your attendees, students, and customers, your Organization decides what is collected and why; we process that information on your Organization's behalf to provide the Service.

2. Information we collect

- Account information: name, email address, profile picture link, and authentication identifiers from your sign-in provider (Google). We do not receive or store your Google password. - Organization content: rosters, attendee and student records, events, registrations, attendance, messages, and settings your Organization puts into the Service. - Operational records: audit logs of significant actions (who did what, when), invitation records, and acceptance records for these documents (including the exact document version, timestamp, and your browser's user-agent string at acceptance), plus technical logs needed to run and secure the Service. - Payment records: if your Organization connects Stripe, we keep the record of each payment made through the Service — amounts, the platform fee, refunds and dispute status. Card details are entered on Stripe's own checkout page: we never receive or store your customers' card numbers. - Provider credentials: if you connect an SMS provider, or a staff member connects a calendar, the credentials are stored encrypted, are never returned by any interface, and are used only to act on your instructions.

3. What we do NOT do

- We do not sell personal information. - We do not use your Organization's content to advertise to your attendees. - We do not read your Organization's content except to operate, secure, and support the Service, and then only as needed.

4. How we use information

To provide and secure the Service; to act on your instructions (for example, recording an attendee you checked in); to keep honest records (audit trails, acceptance records); to support you; and to meet legal obligations.

5. Sharing

- Service providers: Google Cloud / Firebase, which hosts the Service and provides Google sign-in; our email delivery provider, which sends the email your Organization turns on (it receives each recipient's address, the subject and the message); and, when your Organization connects it, Stripe, which processes your customers' payments on your Organization's own Stripe account (it receives your Organization's name and its contact email — or, if none is set, the email address of the owner who connects it — when the account is opened, and each payer's email address and the amount with each checkout, so that Stripe can process the payment and send the payer a receipt). - Providers you connect: an SMS provider or a calendar you connect receives what it needs to carry out your instructions. - Embedded content: if your Organization's public pages embed content from another service (for example a video or a map), visitors' browsers load that content from that service. - Within your Organization: members see what their role allows. - Legal: when required by law or to protect the Service and its users.

6. Retention, export, and deletion

Organization content is retained while the Organization is active. You can export your Organization's data with the built-in export tools at any time. If you close your Organization, we will delete its content on your request; deletion is performed manually and confirmed to you. Acceptance records and audit logs are retained as evidence of what was agreed and done, and we may retain data where the law requires it.

7. Security

We apply role- and organization-scoped access controls, check every write on the server, keep provider credentials encrypted with a key held in a managed secret store, and rely on the underlying cloud platform's encryption in transit and at rest. No system is perfectly secure, and we do not promise that security incidents can never occur; if an incident affects your data, we will tell you what we know without undue delay.

8. Your choices and rights

You can access and export your Organization's data with the built-in tools, and correct your account information in your account. Depending on where you live, you may have additional legal rights over your personal information; contact us and we will honor the rights that apply to you.

9. Children

The Service is a business tool for adults; we do not direct it to children and there is no public signup. Organizations may store records about minors (for example, youth class rosters) as the party responsible for those records; we process them on the Organization's behalf.

10. Changes

Material changes to this notice require fresh acceptance from Organization owners before the actions they govern; the exact accepted version is recorded.

11. Contact

Privacy questions and requests (including data export or deletion) go through the Help section inside the app. During the invitation-only pilot you can also reply to the invitation you received.