We take the privacy of theatre educators and their programs seriously. Here's exactly what we collect and why.
Theatre4u™ (theatre4u.org) is a product of Artstracker LLC, a California limited liability company. We are committed to protecting the privacy and security of all users, with special attention to the requirements applicable to educational institutions and school districts. This Privacy Policy is designed to address the requirements that may apply to us and to our educational customers, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), CalOPPA, the Student Online Personal Information Protection Act (SOPIPA), the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and the comparable consumer and student privacy laws of other states.
Theatre4u™ is designed for use by theatre educators, school drama departments, community theatre organizations, and district administrators. Accounts are created by adults (18 or older) or by authorized school employees, not by students directly. Where a program gives students access (for example, team members added by a teacher, or a join code), that access is set up and controlled by the school or organization that holds the account. The account holder acts as the data controller for any student information and is responsible for consents required by law.
Account Information: organization name, email address, password (encrypted via Supabase Auth, so we never see plaintext passwords), and optional profile details including phone, city, and bio. Inventory Data: item names, descriptions, photos, locations, and condition notes you add to your account. Communication Data: messages sent between organizations on the platform. Usage Data: pages visited and features used, which we use to operate and improve the platform. Cookies and Tracking Technologies: on our public marketing pages, we and our providers use cookies and similar technologies, including Google Analytics and the Meta (Facebook) Pixel, to understand how visitors and users interact with the Service, to measure the performance of our advertising, and to record when a visit leads to a signup. These tools may collect device and usage identifiers and IP address through cookies; they do not receive your account credentials, inventory, messages, or student or organizational content. You can control cookies in your browser settings, opt out of Google Analytics at tools.google.com/dlpage/gaoptout, and manage interest-based ads at aboutads.info/choices. This Service is built for program administration, not for collecting information about students; any student information we process belongs to your organization, as described in the Student Data section.
To provide and operate the Theatre4u™ platform. To facilitate Backstage Exchange listings and rental/loan requests between programs. To send transactional emails (request notifications, account confirmation) via Resend from hello@theatre4u.org. To operate and improve the platform based on usage patterns. On our public marketing pages we use standard analytics and advertising measurement tools (Google Analytics and the Meta Pixel) to understand how people find and use the Service and whether a visit leads to a signup, so we can run and improve our advertising. These tools may collect device and usage identifiers and IP address, but we never send them your account information, inventory, messages, or any student or district content, and we do NOT sell your data. We do NOT share your data with third parties except as described in section 5. If we send marketing email, each message will identify the sender, include a postal address and a working unsubscribe link, and we will honor an opt-out within 10 business days. Transactional messages, such as account confirmations and request notifications, are separate from marketing email.
Supabase (supabase.com): Our database and authentication provider, hosted in AWS us-east-1. All data is encrypted at rest and in transit. Supabase is SOC 2 Type II certified. Resend (resend.com): Transactional email delivery only. Vercel (vercel.com): Web hosting and content delivery. Vercel processes web requests to serve the Service and keeps standard server and CDN logs (such as IP address and request metadata); it does not store your account or inventory content. Stripe (stripe.com): Payment processing for subscriptions only. Stripe does not receive inventory or student data. Anthropic (anthropic.com): powers the optional in-app Help assistant and receives only the text a user types into the help chat. Google: web fonts on our pages and, when a user chooses it, Google Drive photo import. Amazon Web Services (aws.amazon.com): the cloud infrastructure hosting our Supabase database and storage. Google Analytics & Meta (Facebook) Pixel: analytics and advertising measurement on our public marketing pages (page views, referral source, signup events, and device or usage identifiers collected through cookies), used to run and measure our advertising. These tools do not receive your inventory, messages, or organizational content. Other Programs: When you post items to Backstage Exchange, your organization name, location, and listed items are visible to other logged-in Theatre4u™ members. We may also disclose information to comply with law or valid legal process, to protect the rights and safety of users, or as part of a merger or sale of the business, in which case this policy continues to apply to the transferred information until it is updated. No other sharing occurs.
Theatre4u™ is built for program administration, not for collecting information about students. Depending on how your organization uses the Service, limited student information may be processed on your behalf, such as a name or school email for a student team member, or a photo or record that your staff uploads. Any such information belongs to the subscribing organization (the school or district), which acts as the data controller; Theatre4u™ acts as a service provider under the FERPA school official exception where applicable. We use student information only to provide the Service to your organization. We do not sell student information, do not use it for targeted advertising, and do not build student profiles for purposes unrelated to the school. We do not use student information to train artificial intelligence models. School administrators retain full control over their organization's data and may request export or complete deletion at any time. Theatre4u™ will not disclose organizational data to third parties without the written consent of the institution's authorized representative, except as required by law.
Theatre4u™ is not directed to children and does not offer public signup to students. Student access, where a program chooses to enable it, is provisioned and supervised by the school under the school's authority. For students under 13, a school's authorization under COPPA covers school authorized educational use only and does not replace parental consent for any commercial use; Theatre4u™ does not use student information for commercial purposes. For a student team member, the information collected is limited to the student's name and school email address, plus content that school staff choose to upload. If you believe a child created an account through ordinary public signup without school authorization, contact hello@theatre4u.org and we will remove it and any associated data promptly.
All data is encrypted in transit via TLS 1.2+. Database data is encrypted at rest via AES-256 (Supabase/AWS). Passwords are hashed using bcrypt, so we cannot access your password. Authentication tokens expire automatically. Row-Level Security (RLS) is enforced on all database tables, so each organization can only access its own data. Security headers (HSTS, CSP, X-Frame-Options) are enforced on all pages. The anon key exposed in the client is restricted by RLS policies and cannot access other organizations' private data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your data is retained as long as your account is active. You may request complete deletion of your account and all associated data at any time by emailing hello@theatre4u.org. We will complete deletion from active systems within 30 days. A closed account is first soft-deleted for up to 30 days to protect against accidental closure and then permanently removed. Once deletion and the backup cycle below are complete, deleted data is not recoverable, except for records we must retain to comply with law or a legal hold. Anonymized aggregate statistics (total item counts, etc.) may be retained. Backup snapshots are retained for 7 days before permanent deletion.
California residents have the right to: know the categories of personal data we collect, the purposes for which we use it, and the categories of third parties that receive it; access and correct your data; request deletion of your data; opt out of the sale or sharing of personal data; limit the use of sensitive personal information; and not be discriminated against for exercising these rights. We do not sell personal data. Advertising cookies on our public marketing pages may count as "sharing" under California law, and you can opt out through your browser cookie settings and the links in the Cookies section above. We will verify your request, respond within 45 days, and accept requests submitted by an authorized agent. Residents of other states with comprehensive privacy laws, such as Virginia and Colorado, have similar rights and may use the same contact. To exercise any right: email hello@theatre4u.org with 'Privacy Request' in the subject line.
For school district subscribers (District plan), Artstracker LLC will execute a Data Processing Agreement (DPA) upon request. Contact hello@theatre4u.org. We will cooperate with district IT security reviews and questionnaires. Our infrastructure providers (Supabase and Vercel) maintain SOC 2 Type II, and their documentation is available upon request for your district's vendor review process. Artstracker LLC is a small business and does not hold its own SOC 2 or ISO certification.
We will notify users of material changes to this policy with at least 14 days notice via email. Questions, data requests, or security concerns: hello@theatre4u.org | theatre4u.org | Artstracker LLC, California, USA. For security vulnerabilities, please email hello@theatre4u.org with 'Security' in the subject line.
School districts that require a Data Processing Agreement can download our DPA (PDF) or request a countersigned copy at hello@theatre4u.org.