Privacy Policy

1. Who we are (data controller)

For legal and tax purposes, StageLab is currently operated by its co-founder Sergi Miral as a Spanish autónomo (self-employed professional). A Spanish company (sociedad limitada) co-founded with Roger Capell is being incorporated and will take over operation of the Service. This change will not affect your account or your data — we will email you in advance when it happens, and the data controller will be updated on this page.

For the purposes of GDPR, the data controller is therefore Sergi Miral until the SL is incorporated. You can contact us at any time at admin@stagelab.studio for privacy questions, including to exercise your rights under this policy.

2. What data we collect

Account data: name, email address, password hash, and profile details you choose to provide (role, company, location, handle, avatar, bio, contact details).

Content data: the riders, stage plots, input lists, comments, and other documents you create, upload, or share through the Service.

Usage data: pages visited, actions taken, device type, browser type, approximate location derived from IP, and error logs. This is used to operate, secure, and improve the Service.

Waitlist data: if you sign up for the waitlist before launch, we store your email address to notify you when StageLab becomes available.

3. Why we use your data (purposes)

To provide and operate the Service (create an account, render riders, generate PDFs, share links).

To communicate with you about your account, changes to the Service, and (with your consent) product updates.

To secure the Service, prevent fraud or abuse, and comply with legal obligations.

To send waitlist notifications if you joined the waitlist before launch.

4. Lawful basis for processing

Performance of a contract (GDPR Art. 6(1)(b)) — to deliver the Service you signed up for.

Legitimate interest (GDPR Art. 6(1)(f)) — to secure, maintain, and improve the Service, and to communicate essential service updates.

Consent (GDPR Art. 6(1)(a)) — for optional marketing emails; you can withdraw consent at any time.

Legal obligation (GDPR Art. 6(1)(c)) — to comply with tax, accounting, and other legal requirements.

5. Third-party processors

We use a small, carefully selected set of third parties to operate the Service. They process personal data on our behalf under data processing agreements.

Supabase (database, authentication, and file storage). Hosted in the EU where available.

Vercel (application hosting and serverless execution).

Resend (transactional and waitlist emails).

Anthropic (Claude AI — used only when you opt in to the AI rider import feature; the rider file you import is sent for one-off parsing and not used to train AI models).

Future processors: when paid plans launch, a payment provider (such as Lemon Squeezy) will be added to handle payments and subscriptions. This policy will be updated before any such processor begins handling your data.

We do not sell your personal data. International transfers outside the EEA are covered by Standard Contractual Clauses or equivalent safeguards where required.

6. Cookies and tracking

StageLab does not currently use analytics, advertising, or third-party tracking cookies. We use only strictly necessary cookies — for authentication (keeping you signed in), remembering your theme and language preferences, and securing the Service. These do not require consent under GDPR / ePrivacy and we therefore do not show a cookie banner.

If we add analytics or any non-essential tracking in the future, we will update this policy and present a consent mechanism (such as a cookie banner) before any such tracking begins.

You can clear or block cookies at any time via your browser settings; some features of the Service may not work correctly without essential cookies.

7. Data retention

We keep account and content data for as long as your account is active. When you delete your account, we delete or anonymise your personal data within 30 days, except where we are legally required to keep it (for example, invoices for tax purposes are kept for the period required by law).

Waitlist emails are kept until launch notifications have been sent, or until you unsubscribe or request deletion — whichever comes first.

8. Your rights

Under GDPR you have the right to: access your personal data; request correction or deletion; restrict or object to processing; data portability; and — where processing is based on consent — withdraw consent at any time.

You also have the right to lodge a complaint with your local data protection authority (for example, in Spain, the Agencia Española de Protección de Datos — aepd.es).

To exercise any of these rights, email us at admin@stagelab.studio. We will respond within one month.

9. Security

We take reasonable technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), encryption at rest for stored data, row-level security policies at the database level, and principle-of-least-privilege access controls. No service can guarantee absolute security; if you suspect an incident, contact us at admin@stagelab.studio.

10. Changes to this policy

We may update this policy as the Service evolves — including when paid plans launch, when analytics are introduced, or when StageLab transfers from Sergi Miral (autónomo) to the future Spanish SL. Material changes will be announced by email or in-app notice and reflected in the "Last updated" date at the top of this page.

11. Contact

Privacy questions or requests: admin@stagelab.studio.