# Scene Lead Privacy Notice

**Pilot Version 1.3.0**

This notice explains how Cyriac Labs, LLC handles personal information in Scene Lead. It is a public notice, not a
contract term; the Scene Lead Master Services Agreement (Pilot Terms of Service) and its Data Processing Addendum govern
our obligations to studios.

## 1. Which part of this notice applies to you

**Studio owners and staff** who sign in to Scene Lead: Cyriac Labs is
responsible (the "controller") for your account information. See section 2.

**Students, parents and guardians, purchasers and attendees** whose
information a studio puts into Scene Lead, or who register, pay or check in
through a studio's Scene Lead pages: **the studio is responsible** for your
information. It decides what to collect and how to use it. Cyriac Labs
processes that information on the studio's behalf, as its service provider,
to run the Service. See section 3.

Sections 4 to 13 apply to everyone.

## 2. Studio owners and staff

**What we collect.**

- **Account information.** Staff sign in with Google. We receive your name, email address, profile picture link and Google account identifier. We never receive your Google password.
- **Membership and activity.** The studios you belong to, your role and access period, invitations, and audit records of significant actions you take (who did what, and when).
- **Acceptance records.** When you accept Scene Lead terms, we record the exact document version and its content fingerprint, the time, the studio (where relevant) and, where available, your browser's user-agent string.
- **Support requests** you send through "Report a problem" in the app.
- **Connected calendar.** If you connect a Google Calendar, we request your Google account email address and read-only access to your calendar list and busy/free times — not event titles or details — and store the access credentials encrypted.
- **Technical data.** Our hosting provider's request logs record technical data such as IP address and browser type. We use IP addresses briefly in memory to rate-limit requests.

**How we use it.** To provide, secure and support the Service, act on your
instructions, keep records of what was agreed and done, contact you about
the Service, and meet legal obligations.

## 3. Students, guardians, purchasers and attendees

**What a studio may put into Scene Lead.** Names and contact details
(email, phone); class, event and program registrations; who is covered by a
purchase; attendance and check-ins; payment records (amounts, fees, refunds
and dispute status — never card or bank numbers); answers to questions the
studio adds to its forms; acceptances of the studio's own policies and
waivers; messages and replies; text-message consent; notes; and, where the
studio sets it up, guardian links and student-portal access. If a student
chooses to link a Google sign-in to their portal, we also store that
sign-in's identifier.

**Your requests go to the studio.** To see, correct, delete or ask about
your information, contact the studio you registered with. The studio can
view and correct records, export its data, and permanently remove a
student's personal details (section 8). We help studios answer requests.

**If you contact us directly** about information a studio holds, we will
pass your request to that studio where we can identify it, tell you so, and
help the studio respond. We do not change a studio's records without its
instruction unless the law requires it.

**Entering information about other people.** A parent, guardian or
purchaser can register and pay for other attendees and enter their names
and, optionally, their email or phone. If you do this, you must have the
authority or permission to share that person's information with the
studio.

**Text messages.** If a studio texts through Scene Lead, the registration
form asks "Yes, text me" or "No, email only". Neither answer is
preselected, and choosing No never blocks registration or payment. We
record each answer with the exact wording you were shown. You are sent
scheduled or operational texts only if you answered Yes, or if — after any recorded opt-out, including a
"No, email only" answer — you texted START or UNSTOP to the studio's number
(YES also works after you replied STOP). Studio staff can record
that you do not want texts but cannot record that you agreed to them. Reply
STOP at any time to stop texts from that studio; it is honored on every
later send. Texts are operational (such as confirmations, reminders, class changes
and waitlist openings), plus replies to people who texted the studio
first: staff replies, confirmations of STOP, START and HELP, and — if the studio turns it on — one
automatic reply per number per 24 hours saying the number is not monitored. No mobile
information is shared with third parties or affiliates for marketing or
promotional purposes, and text-message opt-in data and consent are not
shared with any third party.

**Email.** Scene Lead sends only operational email for a studio, such as
confirmations, reminders, notices and links. It does not deliver marketing
campaigns by email or by text.

## 4. Children

Scene Lead is a business tool directed to studios, not to children. Studios
may register minors, usually through a parent or guardian who enters the
child's details. Scene Lead's standard registration form does not ask for a
person's age or date of birth (a studio may add its own questions). Scene
Lead is not directed to children under 13, and we do not knowingly collect
personal information directly from children under 13. Studios must collect
a minor's information from a parent or guardian.

If we learn that a child under 13 has given personal information directly
through Scene Lead without a parent's or guardian's involvement, we will
tell the studio and work with it to delete that information or obtain the
required consent. Parents and guardians can also contact the studio or us.

## 5. Who we share information with

We do not sell personal information, and we do not use it for targeted
advertising. We share it only as follows.

- **Google Cloud / Firebase** — What it does: Hosting, database, sign-in, file storage, secret storage, scheduled jobs; What it receives: All Service data; When: Always
- **Stripe** — What it does: Processes payments on the **studio's own** connected Stripe account; the studio is the merchant; What it receives: The studio's name and contact email when the account is set up; for each checkout, the payer's email and the items and amounts being bought. Card and bank details are entered on Stripe's own page and never reach Scene Lead; When: When the studio connects payments
- **Twilio** — What it does: Sends and receives texts through a separate Twilio subaccount we hold and manage for each studio; What it receives: Recipient phone numbers, message text, replies texted to the studio's number, delivery status, and the studio's business details for carrier registration; When: When the studio turns on texting
- **Resend** — What it does: Delivers Scene Lead's transactional email for studios; What it receives: Recipient email address, sender name, reply-to address, subject and message; When: When the studio turns on email
- **Google Calendar** — What it does: Reads busy/free times from a staff member's calendar; What it receives: Only what the request needs; we receive busy/free times and the calendar list; When: Only when a staff member connects a calendar

We also share information **within a studio** (members see what their role
allows), **with the public** only as a studio chooses to publish it on its
pages, and **where required by law** or to protect the Service, its users
or others.

**Where data is stored.** The Service is hosted on Google Cloud in the
United States; the application, the database and uploaded images are in Google's
us-east4 (Northern Virginia) region. Google's sign-in service operates
globally.

**No trackers.** Scene Lead uses no third-party analytics, advertising or
session-replay tools. If a studio switches on visitor counts for its
Scene Lead website, we keep only an aggregate count of page views per day
— no IP address, browser details or other identifier.

## 6. Studio websites, embedded forms, cookies and browser storage

**Embedded registration forms.** A studio can show its Scene Lead
registration form inside its own website. Only website addresses the
studio lists can display the form; browsers refuse it everywhere else. The
form stores no information about you in your browser. Payment always opens on
Stripe's page in the full browser window, never inside the studio's site.
The studio's own website is run by the studio, under its own privacy
practices.

**Cookies.** Scene Lead sets only strictly necessary cookies: a secure,
HttpOnly session cookie when you open a student-portal or placement link,
so the link's secret does not stay in your address bar. We set no
advertising or analytics cookies.

**Browser storage.** For signed-in staff, the Google sign-in library keeps
your sign-in state in your browser, and the app stores display preferences
and unsaved setup drafts locally. Some public registration and payment pages keep
a temporary link code in that browser tab's session storage while you finish a
step.

## 7. Security and who can access data

We use these safeguards:

- Google's infrastructure encrypts data in transit and at rest. Provider and calendar credentials are additionally encrypted by Scene Lead with AES-256-GCM, using a key kept in a managed secret store.
- Database access rules apply to every read and write made from the app, and signed-in server operations check sign-in, membership and role (public and provider requests are checked by access-link secrets or provider signatures): data is separated by studio and by role, and anything not expressly allowed is refused.
- Personal links (registration, portal, waitlist-offer, booking and invitation links) carry random secrets that we store only as one-way hashes.
- Audit records cannot be edited or deleted by studio users.

**Support access.** Through Scene Lead's support tool, our support staff can
open a studio's records only after the studio's owner grants access. A grant is read-only, lasts as long
as the owner chooses (up to 90 days), can be revoked at any time, and each
support session is limited to four hours. Viewing an individual student's
details during a session is recorded.

**Other access you should know about.**

- Our operators can look up basic details of a studio account (its name, creation date, plan, support-grant status, open support requests and a masked owner email) without a grant, by exact studio ID or owner email. Each lookup that finds a studio is logged.
- If all of a studio's owners are unavailable (for example locked out), our operators can grant ownership to a named person through an emergency recovery path that requires a written reason and is recorded in the studio's audit log.
- Authorized Cyriac Labs personnel with access to our cloud infrastructure could technically access stored data. We limit such access to operating, securing and supporting the Service.

No system is perfectly secure, and we cannot promise that a security
incident will never occur.

## 8. Retention, deletion and export

**Retention.** We have no automatic deletion schedule. A studio's data is
kept while the studio is active and until it is deleted. Acceptance
records, audit logs, payment records and text-message consent and opt-out
records are
kept as evidence of what was agreed and done, and to meet legal
obligations. Database backups (point-in-time recovery) can hold deleted
data for up to 7 days. Uploaded website images are not backed up.

**Deleting a student's details.** A studio's owner or administrator can
permanently remove an individual student's personal details from the
student record. This cannot be undone in the product. Some related
records — such as payment, registration, message, attendance and consent
records — are kept so that money and history remain accurate and as
evidence.

**Closing a studio.** Deleting a studio's data is a manual process that we
carry out on the owner's request. We will tell the owner what was deleted
and what is retained, and why.

**Information held by providers.** Stripe, Twilio and Resend keep the
information they received under their own retention policies; deleting it
from Scene Lead does not delete it from them.

**Export.** A studio's owner can export the studio's core records (such as
classes, students, registrations, attendance and payment records) at any
time. The export does not include every record type: for example, message
bodies (only message metadata is included), uploaded images, and security
credentials are excluded.

## 9. Your privacy rights

Depending on where you live, state law — for example the Maryland Online
Data Privacy Act or California's privacy laws — may give you rights to
access, correct, delete or obtain a copy of your personal information, and
to appeal a decision about your request. Whether a law applies depends on
the law's thresholds.

- **Student, guardian, purchaser or attendee information:** contact the studio (section 3).
- **Studio staff account information:** contact Cyriac Labs at legal@cyriaclabs.com or through Help → "Report a problem" in the app. We may need to verify your identity before acting.

We do not sell personal information, do not share it for targeted
advertising, and will not discriminate against you for exercising your
rights.

## 10. If there is a security incident

If we discover a security incident affecting personal information a
studio holds in Scene Lead, we will notify the affected studios without
undue delay, tell them what we know, and support them in giving any
notifications the law requires of them.

## 11. Test environments

Production data is not copied into our test environments. If that ever
changes, we will update this notice first.

## 12. Changes to this notice

We publish each version in Scene Lead with its version number. For a
material change, we publish the new version before it takes effect and ask
studio owners to review it in the app.

## 13. Contact

Cyriac Labs, LLC — legal@cyriaclabs.com — 127 Lazy Hollow Drive, Gaithersburg, MD 20878. Studio staff can also use Help → "Report a problem" in the
app. Students, guardians, purchasers and attendees should contact their
studio first.