Privacy policy

The short version

We collect the data we need to run your account, sell and license our software, send you the emails you expect, and run the community. We do not sell your data, and we do not use it for advertising. Visit counting is optional and stays off until you allow it.

Who we are

Onstage Labs makes SetStage and Arco Live. We are the controller of the personal data described here. You can reach us at support@onstagelabs.com for anything about your data.

What we collect

• Your account. Your name and email address, and a password if you sign up with one. Passwords are stored as a one-way hash, so we cannot read them. If you sign in with Google or Apple, we receive your name, email address and profile picture from them, and nothing else.
• Purchases and licences. The products you buy, amounts, dates, your licence keys and how many devices a licence has been used on. Payment is handled by Stripe. We never see or store your card number.
• Downloads. When you download the software we record the date, your IP address and your browser or device type. We use this to run licences and to spot misuse.
• Community and feature requests. Posts, replies, likes, feature requests and votes you make, shown with your name. Please do not post anything you want to keep private.
• Emails. We send the emails that go with your account: confirming your address, receipts, licence details, and password resets. If you write to us, we keep your message and our reply.
• Technical data. Our hosting provider keeps standard server logs (such as IP address and the pages requested) for security and to keep the site running.
• Visit statistics, only if you allow them. If you accept analytics in the cookie settings, Vercel Web Analytics counts page views. It records the page, where you came from, and rough device and country details. It does not use cookies or follow you across other sites.

Why we use it, and our legal basis

• To create your account, take payment, deliver your licence and let you download: to perform our contract with you.
• To keep the site and licences secure, prevent misuse, answer support questions and run the community: our legitimate interests in running a safe, working service.
• To keep tax and accounting records: a legal obligation.
• To count visits with analytics: your consent, which you can withdraw at any time.

Who we share it with

We use a small number of companies to run the service. They only process data for us, under their own privacy terms:

• Stripe processes payments and holds your payment details.
• Resend sends our emails.
• Vercel hosts the website, and provides analytics if you allow it.
• A managed database provider stores your account and order records.
• Google and Apple, if you choose to sign in with them.

We may also disclose data if the law requires it. We do not sell personal data and we do not share it with advertisers.

Transfers outside your country

Some of these companies are based in, or process data in, the United States and other countries. Where required, they use approved safeguards such as the EU–US Data Privacy Framework or standard contractual clauses.

How long we keep it

We keep your account data while your account is open, and delete it if you ask us to. Order and payment records are kept for as long as tax and accounting rules require, even after an account is closed. Server logs and download records are kept only as long as we need them for security and licensing. Posts you made in the community can be removed on request.

Your rights

Depending on where you live, you can ask us to:

• give you a copy of the data we hold about you;
• correct data that is wrong;
• delete your data, or restrict how we use it;
• send your data to you in a portable format;
• stop using your data where we rely on legitimate interests;
• withdraw consent, for example for analytics, in the cookie settings.

Email support@onstagelabs.com and we will reply within a month. You also have the right to complain to your local data protection authority.

Security

We protect data with encrypted connections (HTTPS), hashed passwords and limited access to our systems. No service is perfectly secure, so please use a strong password that you do not use elsewhere.

Children

Our site and software are not aimed at children under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we will update the date above and, for important changes, tell you by email or on the site. More on what stays in your browser is in our cookie policy, and the limits of what we promise are in our disclaimer.