Midwest ShowMakerz LLC
Privacy Policy
Effective September 22, 2026. Last updated September 30, 2026.
This policy describes how Midwest ShowMakerz handles information on this website, including event bookings, account services, and optional promotional email.
1. Information we collect
We collect information for the website services described here.
Account. If you create an account: your name, email, and a password managed through Supabase Auth. If you use Google sign-in, Google can send an identifier, your name, and your email. We do not receive the password for those services.
Tickets. The booking name, email, and phone when the event asks for a phone number. The event, ticket types, order total, promo code if you enter one, ticket status, and a name on the ticket when one is collected. You can check out as a guest without an account. If you later create an account with the same email and that email is verified, earlier guest bookings for that email are attached to the account.
Check-in and refunds. Whether a ticket was scanned, when, and the refund request you submit, including the reason you type.
Lost and found. Your name, email, phone, the event if you know it, a description of the item, where and about when you lost it, a private note used to check that it is yours, and a photo if you upload one. Staff can also record an item that was turned in. That intake is not published.
Sponsors. Business name, contact name, email, phone, website, social links, a description, the application, the offer, payment status, and files such as a logo if you upload them.
Show control. An organizer can type a run of show for an event they hold: segment titles, planned times, cues, and an optional performer name, group, and contact. Assigned crew for that event can see the parts their role needs. A performer phone number is shown only to the stage manager. Customers, door staff, and the public pages do not see the run of show.
Volunteers. If you apply: your name, email, and phone, the event, the roles you chose, and your availability. Experience, languages, a shirt size, an accommodation note, and an emergency contact are stored only when that form asks for them. After an assignment we keep the role, shift, confirmation, check-in and check-out times, and the hours worked from those times. The public page does not list other applicants.
Privacy requests. The name, email, and message you send when you ask for a copy, a correction, or deletion.
Event contacts and promotional preferences. We keep the name and email from bookings, your promotional preference, and the source and date of that preference. Authorized organizers may import event contact records, including an associated event name. An imported record is not eligible for promotions unless consent is recorded. We also keep campaign delivery results and opt-out records.
Technical. A sign-in session can include an IP address and browser type. We do not run a waitlist, advertising, or an analytics product. We do not store a full card number.
2. How we use information
We use it to:
- Sell, issue, look up, and scan tickets
- Handle refunds and keep the order record
- Run the organizer tools for the events a person is allowed to manage
- Coordinate a show for crew assigned to that event
- Review a volunteer application, assign a shift, and record check-in, check-out, and hours
- Match a lost item, check ownership, and record a return
- Review a sponsorship, take payment when it is approved, and show a public listing only after that
- Answer a privacy request and keep a record of what we did
- Send event announcements and offers to contacts with a recorded promotional preference
- Keep the website working and limit obvious abuse, such as too many unverified privacy requests
Buying a ticket is not treated as permission for promotional email. A recorded promotional preference is required, and imported records without it remain excluded.
3. Tickets and event operations
A ticket record includes the event, ticket type, holder name, status, and check-in time when it is scanned. Door staff with a check-in role can scan a ticket. They do not see revenue. Cashiers can sell at the door. Refund access is its own role. A manager who only holds one event does not see other events. Signing up does not open the organizer dashboard. Show control is separate from the door: scanning a ticket does not open the run of show, and the run of show does not show ticket revenue.
Guest checkout still keeps the name, email, phone, and order so we can deliver the ticket, look it up, and handle a refund. Those records stay even if you never create an account.
4. Payments
When online checkout is enabled, Stripe processes card payments. This website does not store a full card number, expiration date, or security code.
Ticket checkout stores the amount, status, refunded amount, and provider payment references. A pending checkout is not a confirmed payment.
Sponsorship checkout is currently closed. A sponsorship payment is recorded only after a verified Stripe notice matches a previously bound checkout. We store the amount, status, and payment reference. Complimentary sponsor tickets are stored as zero-dollar tickets and are not counted as paid ticket sales.
5. Accounts and sign-in
You can create an account with an email and a password after confirming your email. Google sign-in is also offered. Apple sign-in is not currently available.
Supabase manages account sign-in. Use Privacy choices to request account deletion. Submitting a request does not immediately remove your sign-in or end your sessions.
6. Lost and found
Lost-and-found details can be sensitive. We use them to look for a match, ask a private question, return the item, and reduce false claims. There is no public gallery of found items, and reports are not a public list.
A reference number is not enough to open a report. The private link is. Crew can log a found item. They do not see the private ownership note, your contact details, or your answer. The owner and managers can handle the match. Photos stay in the database and are not published as a public file link. Do not send a PIN or password in a report. The form rejects that.
Lost-and-found retention is not a fixed number of days. The owner or a site manager can set a number later. Until then, this policy does not promise a delete date.
7. Sponsors and partners
An application is private. It can include the business, the contact person, email, phone, links, the offer, files, and payment status. Organizers who hold the event can review it.
A public partner listing is separate. It appears only after approval and payment, and only if the organizer turns public display on. The public page can show the business name, logo, and public links. It does not show the private application, phone, email, or payment details. One sponsor cannot open another sponsor’s portal.
8. Communications
Account verification, password resets, account welcomes, ticket confirmations, refund updates and support replies are service communications. We use your email address to provide those services. Marketing preferences are managed separately in your account. Development previews do not send customer email.
Promotional emails include an unsubscribe link that does not require signing in. You can also turn promotions off in your account. A purchase or contact-list import does not reverse an opt-out. We stop future queued promotional sends after an opt-out; a message already accepted by our email provider may still arrive.
An address removed for privacy, unsubscribed, or blocked following a bounce or complaint remains excluded from promotions. Contact support if you want a blocked preference reviewed.
Support requests and attachments
When you ask for help, we store your name, email, message, ticket reference and any files you choose to attach. The owner can access this information to investigate and resolve your request. The owner receives the request and attachments by email; you receive a reference and follow-up messages. Support files are not public. Please do not include passwords, full payment-card details or admission QR codes.
Request data is kept for follow-up and operational records. Verified privacy closures remove support message content and stored attachments from the application. Copies already delivered by email may need separate review through our privacy-request process.
10. Service providers and sharing
We do not sell personal information. We also do not claim that nobody else ever handles it.
- Supabase stores application records and manages account sign-in.
- Google, if you choose Google sign-in.
- Stripe processes enabled online payments and reports payment and refund results.
- Resend delivers website service emails and promotional campaigns and reports delivery problems.
- Authorized staff, limited to the role they were given.
- A public partner listing, only for the business details the organizer has turned on after approval and payment.
We do not use an advertising or analytics vendor. Copies of messages already delivered by email may need separate review when handling a privacy request.
11. Data retention
Different records are kept for different reasons. We have not set a single number of days, and this policy does not invent one.
Orders, tickets, refunds, and payment references are kept so tickets can be scanned, refunds can be handled, and the amount of a sale is not lost. Reviewed contact removal preserves the order amount, ticket status, refund record, and payment reference. Account deletion requires a separate review of sign-in access.
Reviewed contact removal clears the CRM contact, imported event associations, and stored campaign recipient details, and cancels unsent promotional messages. We retain limited delivery and consent records and a hashed address suppression record so a later import or purchase cannot silently sign that address up again.
Lost-and-found reports stay until a return is finished or the owner sets a retention rule. Privacy requests and their confirmation records stay so we can show the request and the result to the person who submitted it.
12. Your privacy choices
The privacy center at Privacy choices lets you submit and follow your private request.
- Signed-in customers can download a copy of their own bookings, tickets, lost-and-found reports, sponsorship applications, contact record, promotional preferences and campaign history. The file leaves out secret links and other people’s records.
- Anyone can ask for a copy, a correction, or deletion. The request stays closed until the email is confirmed with a private link. Typing an email address is not enough.
- If you are signed in with that same email, the request is confirmed from the session.
- Account deletion requests require review. The request form does not immediately close an account or sign anyone out.
- Turn off promotional email in your account or use the unsubscribe link in a promotional message. Service messages for your bookings and account remain separate.
Guest bookings are not erased from a form alone. The owner or a site manager can remove guest contact details after the email is confirmed while retaining the charge record. This does not delete a sign-in account. Requests tied to a known account require account-specific review; the result is recorded on the private request page.
13. Security
We use ordinary access checks. They reduce the chance that one person opens another person’s records. They are not a promise that information can never be exposed.
- Account, ticket, and export actions run on the server for the signed-in person.
- Lost-and-found and sponsor portals need a private link, not a public id.
- Photos and sponsor files are stored in the database and served only after a permission check.
- Privacy cases are visible to the site owner and a site-wide manager, not to door staff or a one-event manager.
- A sponsorship payment notice is checked with a signature when that secret is set.
- Privacy actions are written to a private audit trail.
This website does not claim a compliance certification, a specific encryption setup, or that data is stored only in one country.
14. Children
Accounts and ticket checkout are for the person placing the booking. Some events are family events, and a child may attend as a guest. This website does not knowingly ask a child to create an account, and it does not have a separate age gate. The owner still needs a lawyer to confirm the right age rule before this is treated as a finished policy.
15. Changes to this policy
If our privacy practices change in a material way, we will update the effective date and the last-updated date above.
16. Contact us
Midwest ShowMakerz LLC
Indianapolis, Indiana
For a copy, a correction, or deletion, use privacy choices. For a booking, include the order number.