DOCUMENT

Privacy
Policy.

Effective from: 8 October 2026

1. Controller

The controller of your personal data is Bartosz Kołodziej, a sole proprietor trading as Crowdshow, Łubowo 127, 62-260 Łubowo, Poland, Polish tax ID (NIP): 784-243-86-40 ("we", "us"). For any data protection matter, write to contact@crowdshow.io. We have not appointed a data protection officer.

2. What data we process, why, and on what legal basis

Host account — e-mail address, hashed password or Google sign-in identifier (name, e-mail address and profile picture provided by Google if you choose that option), account settings. Purpose: creating and running your account and providing the service. Legal basis: Art. 6(1)(b) GDPR (contract).
Dashboard content — games, questions, answers, venue profile, game defaults, game history and statistics. Purpose and legal basis as above (Art. 6(1)(b) GDPR).
Payments and billing — plan, subscription status and dates, Stripe customer ID, country, invoice details (e.g. company name, VAT ID), payment history. We never receive your card details — Stripe processes them. Purpose: performing the contract (Art. 6(1)(b) GDPR) and complying with tax and accounting obligations (Art. 6(1)(c) GDPR).
Players — only the nickname and team name entered when joining a game, answers and scores, and a random identifier stored in the browser (localStorage) so a player can rejoin after a page refresh. Players do not create accounts and do not provide an e-mail address or phone number. Players are invited by the Host. Purpose: running the game and showing the leaderboard. Legal basis: Art. 6(1)(b) GDPR (providing the service the player requests) and Art. 6(1)(f) GDPR (legitimate interest in a smoothly running game). We recommend players do not use their full name as a nickname.
AI question generation — the text the Host types into the generator (topic, instructions). Purpose: generating question suggestions. Legal basis: Art. 6(1)(b) GDPR. Please do not enter personal data into prompts.
Transactional e-mails — e-mail address and message content (sign-in links, confirmations, notices of changes). Legal basis: Art. 6(1)(b) and (c) GDPR.
Correspondence, complaints, withdrawals — the data you provide in your message. Legal basis: Art. 6(1)(b), (c) and (f) GDPR.
Security and technical logs — IP address, browser type, request time in server logs. Purpose: security, detecting abuse and errors. Legal basis: Art. 6(1)(f) GDPR.
Visit statistics — Vercel Web Analytics, which works without cookies and without building user profiles; data is aggregated. Legal basis: Art. 6(1)(f) GDPR (improving the service).
Establishing or defending legal claims — data necessary for that purpose. Legal basis: Art. 6(1)(f) GDPR.

Providing data is voluntary but necessary to create an account, buy a plan or take part in a game. We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you (Art. 22 GDPR).

3. Recipients and processors

We use the following providers, who process data on our behalf under data processing agreements (Art. 28 GDPR):

Supabase Inc. (USA) — database and authentication;
Vercel Inc. (USA) — application hosting and Vercel Web Analytics;
Anthropic PBC (USA) — AI question generation (only the text the Host enters in the generator is sent);
Resend (USA) — sending transactional e-mails.

Data is also received by:

Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) — payments, tax and invoicing; for fraud prevention and regulatory obligations Stripe acts as an independent controller;
Google (Google Ireland Limited / Google LLC) — only if you sign in with Google; Google then acts as an independent controller;
public authorities — only where required by law.

4. Transfers outside the EEA

Some providers are based in the USA or process data outside the European Economic Area. Such transfers rely on the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) and, for certified companies, on the Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). You can request a copy of the safeguards at contact@crowdshow.io.

5. Retention

Account data and content — until the account is deleted (or the Host deletes the content earlier); data in backups is removed as part of their regular rotation.
Player data (nickname, team name, scores) — until the Host deletes the game or the account.
Billing data and invoices — for 5 years from the end of the calendar year in which the tax payment deadline expired (tax and accounting law).
Correspondence and complaints — until any claims become time-barred.
Technical logs — for a short period set by our hosting providers and needed for security.

6. Your rights

You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can export and delete your account data yourself in the dashboard under My data. Send any other request to contact@crowdshow.io — we reply within one month.

You have the right to lodge a complaint with a supervisory authority — in particular in the EU member state of your habitual residence or place of work. Our lead authority is the Polish President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

7. Cookies and local storage

We only use cookies and local storage that are strictly necessary for the service:

sign-in session cookies (Supabase authentication) — keep you signed in;
language cookie (crowdshow_locale) — remembers your chosen language;
player localStorage — lets a player rejoin a running game.

We do not use analytics, advertising or tracking cookies. Vercel Web Analytics works without cookies. Because we only use technologies strictly necessary to provide the service you request, no consent is required and we do not show a cookie banner (Art. 5(3) Directive 2002/58/EC and its national implementations). The Stripe checkout runs on Stripe's domain, where Stripe may set its own cookies necessary for payment security, as described in Stripe's privacy policy.

8. Security

We use encrypted connections (HTTPS), database-level access control (row-level security policies) and data minimisation — we do not collect e-mail addresses, phone numbers or postal addresses from players.

9. Children

Only adults may create an account. Players may be minors (e.g. in a classroom) — in that case the Host is responsible for running the game in line with the law and for obtaining any required consents. We only collect a nickname and team name from players.

10. Changes

We may update this policy. We will inform you of material changes by e-mail and on the website. This policy is effective from 8 October 2026.

Back to the homepage →

2. What data we process, why, and on what legal basis

Host account — e-mail address, hashed password or Google sign-in identifier (name, e-mail address and profile picture provided by Google if you choose that option), account settings. Purpose: creating and running your account and providing the service. Legal basis: Art. 6(1)(b) GDPR (contract).

Dashboard content — games, questions, answers, venue profile, game defaults, game history and statistics. Purpose and legal basis as above (Art. 6(1)(b) GDPR).

Payments and billing — plan, subscription status and dates, Stripe customer ID, country, invoice details (e.g. company name, VAT ID), payment history. We never receive your card details — Stripe processes them. Purpose: performing the contract (Art. 6(1)(b) GDPR) and complying with tax and accounting obligations (Art. 6(1)(c) GDPR).

Players — only the nickname and team name entered when joining a game, answers and scores, and a random identifier stored in the browser (localStorage) so a player can rejoin after a page refresh. Players do not create accounts and do not provide an e-mail address or phone number. Players are invited by the Host. Purpose: running the game and showing the leaderboard. Legal basis: Art. 6(1)(b) GDPR (providing the service the player requests) and Art. 6(1)(f) GDPR (legitimate interest in a smoothly running game). We recommend players do not use their full name as a nickname.

AI question generation — the text the Host types into the generator (topic, instructions). Purpose: generating question suggestions. Legal basis: Art. 6(1)(b) GDPR. Please do not enter personal data into prompts.

Transactional e-mails — e-mail address and message content (sign-in links, confirmations, notices of changes). Legal basis: Art. 6(1)(b) and (c) GDPR.

Correspondence, complaints, withdrawals — the data you provide in your message. Legal basis: Art. 6(1)(b), (c) and (f) GDPR.

Security and technical logs — IP address, browser type, request time in server logs. Purpose: security, detecting abuse and errors. Legal basis: Art. 6(1)(f) GDPR.

Visit statistics — Vercel Web Analytics, which works without cookies and without building user profiles; data is aggregated. Legal basis: Art. 6(1)(f) GDPR (improving the service).

Establishing or defending legal claims — data necessary for that purpose. Legal basis: Art. 6(1)(f) GDPR.

3. Recipients and processors

We use the following providers, who process data on our behalf under data processing agreements (Art. 28 GDPR):

Supabase Inc. (USA) — database and authentication;

Vercel Inc. (USA) — application hosting and Vercel Web Analytics;

Anthropic PBC (USA) — AI question generation (only the text the Host enters in the generator is sent);

Resend (USA) — sending transactional e-mails.

Data is also received by:

Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) — payments, tax and invoicing; for fraud prevention and regulatory obligations Stripe acts as an independent controller;

Google (Google Ireland Limited / Google LLC) — only if you sign in with Google; Google then acts as an independent controller;

public authorities — only where required by law.

4. Transfers outside the EEA

5. Retention

Account data and content — until the account is deleted (or the Host deletes the content earlier); data in backups is removed as part of their regular rotation.

Player data (nickname, team name, scores) — until the Host deletes the game or the account.

Billing data and invoices — for 5 years from the end of the calendar year in which the tax payment deadline expired (tax and accounting law).

Correspondence and complaints — until any claims become time-barred.

Technical logs — for a short period set by our hosting providers and needed for security.

6. Your rights

7. Cookies and local storage

We only use cookies and local storage that are strictly necessary for the service:

sign-in session cookies (Supabase authentication) — keep you signed in;

language cookie (crowdshow_locale) — remembers your chosen language;

player localStorage — lets a player rejoin a running game.

PrivacyPolicy.

1. Controller

2. What data we process, why, and on what legal basis

3. Recipients and processors

4. Transfers outside the EEA

5. Retention

6. Your rights

7. Cookies and local storage

8. Security

9. Children

10. Changes

PrivacyPolicy.

1. Controller

2. What data we process, why, and on what legal basis

3. Recipients and processors

4. Transfers outside the EEA

5. Retention

6. Your rights

7. Cookies and local storage

8. Security

9. Children

10. Changes

Privacy
Policy.

Privacy
Policy.