Privacy Notice

This notice explains how we collect and use personal information in HostFlow, the tool we use to arrange who hosts each of our live shows and to keep track of their availability.

Who we are

Who this notice is for

HostFlow holds information about:

• Our team — staff who log in to plan who hosts each show.
• Hosts and presenters — the people we ask to host a show and whose availability we track.
• Managers — individuals who look after a group of hosts and see those hosts' availability on their behalf.

What information we collect

• Identity and contact details — name, email address and phone number (a host's phone number is used by our team only and is never shown to other hosts).
• Availability and booking information — whether you're available, maybe or unavailable for a show, any notes you add, which shows you're assigned to, and any change requests you raise.
• Account and security data (team members only) — one-time sign-in codes (never stored in plain text), session records, and a log of actions taken in the system for security and accountability.
• Records of our contact with you — a log of the emails we send you through the tool, including confirmations and calendar invites.

We do not ask for special-category information (such as health data) through HostFlow. Please don't submit that kind of information in free-text fields.

Why we use it, and our lawful basis

What we do	Why	Lawful basis (UK GDPR)
Run team member accounts and keep the tool secure	So authorised staff can do their jobs safely	Legitimate interests / performance of a contract
Hold contact details for hosts and managers	To arrange who hosts each show and get in touch about it	Legitimate interests / performance of a contract
Collect availability for shows	To work out who can host and assign the right person	Legitimate interests / performance of a contract
Confirm a host and share the details with the people running the show	So everyone has what they need to deliver the show	Performance of a contract / legitimate interests
Send operational emails via our email provider	To send availability requests, confirmations, calendar invites and updates	Legitimate interests

Who we share it with

We only share information with people who need it to deliver the event, and we limit what each party sees:

• Our own team, according to their role.
• The people running a show, who receive the details needed to run it (for example, who is confirmed to host).
• Hosts, who only ever see their own shows and availability via a unique, unguessable link — never other hosts' details or notes. Managers see only the hosts they look after.

We use a small number of trusted service providers ("processors") who handle data on our instructions only, under contract:

• Railway — secure hosting of the application and database.
• Brevo — sending our operational emails.
• Google — read-only access to our master event calendar.

We do not sell personal information or use it for advertising.

Where your information is held

Our application and database are hosted on Railway. Where a provider processes some data outside the UK/EU (for example a globally operated email or calendar service), we rely on the appropriate safeguards required by law, such as UK-approved contractual clauses or an adequacy / "data bridge" arrangement.

How long we keep it

We keep personal information only as long as we need it to arrange our shows and keep our records straight, then remove or anonymise it. Short-lived security items (like sign-in codes) expire automatically, and a host's personal link can be revoked at any time. You can ask us to remove your details at any time and we will do so unless we're required to keep them.

How we protect it

Access to the admin tool requires a login, and permissions are limited by role. Sign-in codes are hashed, sessions use secure browser cookies, all traffic is encrypted (HTTPS), the database is queried safely against tampering, the links we send to hosts and managers are unguessable and revocable, and significant actions are recorded in an audit log.

Your rights

You have the right to: access a copy of your information; ask us to correct it if it's wrong; ask us to delete it; withdraw consent or object to / ask us to restrict certain uses; and, where relevant, receive it in a portable format. To make a request, contact us at beth@groovebox.co.uk. We will respond within one month.

If you're unhappy with how we've handled your information, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to put things right first.

This notice may be updated from time to time; the date at the top shows the current version.