Privacy Policy.

1 Who we are ¶

show.fm Ltd is the data controller responsible for the personal data described in this policy, except where this policy says otherwise.

Company name: show.fm Ltd

Trading as: show.fm

Company number: 17438149 (registered in England and Wales)

Registered office: 128 City Road, London, United Kingdom, EC1V 2NX

Privacy contact: privacy@show.fm

References to "we", "us", and "our" in this policy mean show.fm Ltd.

2 Quick summary ¶

This summary is for convenience only. The full policy below is what binds us.

• We collect only the personal data we need to provide the Service.
• We use your data to run your account, deliver your podcasts to listeners, operate booking and automation features, generate AI content and guest research when requested or enabled, send service emails, and keep the Service secure.
• We do not sell your personal data. We do not use your podcast content to train AI models without your consent.
• Our infrastructure and service providers operate in several countries. Public podcasts are delivered worldwide; private account and production data may also be processed internationally, as explained below.
• You have rights over your data, including the right to access, correct, delete, and export it.
• Retention depends on the purpose and type of record. Ending a subscription does not automatically erase your identity, other podcast memberships or records we must keep. You can ask us to help with deletion.
• You can contact us at any time at privacy@show.fm and you can complain to the Information Commissioner's Office if you are unhappy with how we have handled your data.

3 Who this policy applies to ¶

This policy applies to the following people, whom we collectively call "you":

• Account holders ("Hosts"). Podcasters, producers, agencies, networks, and other customers who create a show.fm account.
• Team Members. People that an account holder has invited to their account in a role such as Producer or Co-host.
• Guests. People invited to or booking a podcast, including additional attendees and people using a guest portal without a full account. This also includes people with a Guest Network profile and people whose information appears in guest research.
• Listeners. People who download or stream podcast episodes hosted on show.fm, whether through a podcast app, browser, or directory such as Apple Podcasts or Spotify.
• Website visitors. People who visit our marketing site at show.fm without creating an account.
• Support contacts. People who contact us through our support channels.
• Prospective customers. People who sign up to our newsletter, request a demo, or otherwise enter into early conversation with us.

Different parts of this policy apply to different groups. Where a section is specific to one group, we say so.

4 Our role: controller and processor ¶

show.fm Ltd is a controller where we determine why personal data is used: running accounts and billing, operating the Guest Network and its reputation features, answering support requests, managing our customer relationships, measuring use of our own service and preventing abuse.

For podcast production activities directed by a Host, such as guest intake, episode collaboration, recordings, transcripts, guest research and automated communications, we generally act as a processor. The Host is normally the controller and must explain their own purposes and lawful basis. An agency may instead act on instructions from its client, in which case our position is that of a further processor.

Our roles depend on the activity, not just who supplies a record. For example, we can process an invitation for a Host while separately using abuse reports to protect the network. Our own delivery, security and service-measurement purposes are distinct from a Host’s use of their listener reports.

Processing on a customer’s behalf requires the appropriate binding processing agreement. Contact privacy@show.fm to arrange it. Draft documents are not an executed agreement. If your question concerns a particular podcast’s use of your information, contact its Host; we can help identify them and route a request. You can always contact us about processing for which we are responsible.

5 Personal data we collect, why, and on what legal basis ¶

We collect personal data in the following ways:

1. data you give us directly when you create an account, contact us, or use the Service;
2. data we generate when you interact with the Service (such as logs and analytics);
3. data we receive from services you connect, such as calendar providers, and public web pages used in guest research as described in section 6;
4. data uploaded to your account by you or your Team Members (which may contain personal data of others); and
5. data we collect automatically when you visit our website (cookies and similar technologies, covered in section 12).

What we collect, why we collect it, and the relevant legal bases are set out below. A basis described for our controller activities is not a substitute for the Host’s own lawful basis where we act on their instructions. An optional feature switch is not automatically GDPR consent from everyone mentioned in its inputs.

5.1 Account holders and Team Members

What we collect

• Identity and contact: name, email address, password (hashed, never stored in plain text), optional profile picture, optional company name, optional phone number.
• Billing: billing address, VAT number where applicable, and payment card details (the card details themselves are handled directly by our payment processor, Stripe, not by us; we receive only the last four digits, brand, and expiry).
• Account activity: login timestamps, IP addresses, browser and device information, security and audit events, publishing and usage information, and email delivery and interaction records described in section 12.
• Communications: emails and messages you exchange with our support team.
• Marketing preferences: whether you have opted in to receive product updates, the newsletter, or other communications.

If you sign up using a partner link, we store the partner code from that link with your new account to record which partner referred you. We do this for our legitimate interests in understanding referrals and managing our partner relationships. We carry the code in the page URL and do not use a referral cookie or browser storage.

If you connect a WordPress site, we store its site address, plugin version and the addresses of posts we publish there so we can publish your podcast content to that site and keep the connection working.

Why we collect it

• to create and run your account;
• to provide you with access to the features of your subscription plan;
• to take and refund payments;
• to communicate with you about your account, including service notices and security alerts;
• to detect and prevent fraud, abuse, and security incidents;
• to respond to your support enquiries and identify accounts that may need help, using activity, publishing, billing and support signals in our internal customer-management system;
• to send you product updates and marketing communications where you have opted in or where we have a soft opt-in under PECR for existing customers;
• to comply with our legal obligations (for example, accounting and tax obligations);
• to enforce our Terms of Service and protect our rights.

Legal basis

• Performance of a contract (UK GDPR Art. 6(1)(b)): where necessary to provide a service you contract for personally. For staff using an organisation’s account, we rely on legitimate interests in providing and securing that organisation’s service instead.
• Legitimate interests (UK GDPR Art. 6(1)(f)): for security, fraud prevention, service improvement, audit logging, and managing business relationships, where our interests are not overridden by your rights. Electronic marketing must also meet the separate PECR rules; legitimate interests alone does not authorise an email that needs consent.
• Consent (UK GDPR Art. 6(1)(a)): for marketing emails where consent is required, and for other processing where we specifically ask for consent.
• Legal obligation (UK GDPR Art. 6(1)(c)): for tax records, statutory disclosures, and responses to lawful requests from authorities.

Retention

We keep account and membership data while it is needed for your accounts and podcast participation. After closure, retention depends on outstanding billing, security, legal and rights-request needs. A person’s identity can remain where they belong to another account. Section 9 explains these criteria and how to request erasure.

5.2 Guests and Guest Network participants

Information and sources. A Host may provide your name and email address when inviting you. You may provide booking times, timezone, biography, selected links, intake and research answers, topics to avoid, additional attendee details, uploaded files, messages and episode contributions. We also record verification, invitation status, responses and relevant activity. Hosts must tell additional attendees about the use of their information.

Booking and collaboration. We use these details to arrange sessions, send invitations and reminders, verify portal access and support preparation and collaboration. The Host and authorised participants can see information shared for their episode, according to their access. Connected calendar or meeting providers receive the details needed for the booking. The Host determines the basis for their podcast processing; we use information for our own security and abuse-prevention purposes on the basis of legitimate interests.

Public network profiles. If you enable discoverability, your profile may be accessed publicly, including without signing in. It may show your name, avatar, biography, selected links, podcast appearances and reputation information according to your settings. We use your discoverability choice to make you available for relevant podcast approaches. Other users can ask us to deliver an invitation to your account email; that does not publish the address in the directory. Invitation emails identify the sender and may include their email address. Accepting or declining, and any response message you send, are shared with the inviter.

Feedback and reputation. Hosts can record private feedback about participation. Public rating summaries follow your visibility settings and the minimum participation threshold; endorsements are published following your approval. Turning off public ratings does not erase private feedback. We use this information to support useful, trustworthy introductions, with legitimate interests as our basis for private feedback and network integrity, and consent for the optional public visibility choices.

Your choices. You can turn off discoverability, change public-profile settings, decline an invitation, or contact support@show.fm about unwanted contact or disputed feedback. Removing a listing does not recall copies already obtained by others. Network listing is not blanket marketing consent. You can ask us to correct or delete your data; where the Host controls it, we will assist with their response.

Retention. Episode and research records can remain while the Host keeps the corresponding material. Invitation expiry does not erase the invitation history. Network profiles, feedback and abuse records have separate purposes, so deleting a booking does not delete all of these. Section 9 explains how retention and deletion requests are assessed.

5.3 Listeners (people downloading or streaming podcasts hosted on show.fm)

When you download or stream a podcast episode hosted on show.fm, your podcast app, browser, or platform makes a request to our delivery infrastructure.

What we collect

• IP address (processed to deliver requests, estimate country, region or city, and detect abuse);
• user agent (the name of your podcast app or browser);
• timestamp of the request;
• which show and episode were requested, bytes and ranges delivered, response status, network provider, and whether playback came from an embed or show page, including the referring hostname where available.

Our download analytics store a daily-changing hash derived from the IP address rather than the raw IP. Together with the user agent, this helps group repeat requests for measurement. This is pseudonymous data, not a claim that every request record is anonymous. We do not use it to build advertising profiles. Ordinary infrastructure and security logs may separately process request information.

Why we collect it

• to deliver the audio file to you;
• to estimate valid downloads using filtering and deduplication informed by IAB Tech Lab Podcast Measurement Guidelines; this is not a claim of IAB certification;
• to provide Hosts with aggregate statistics about their listenership (such as "downloads by country");
• to detect and block abuse such as bot-driven download inflation;
• to keep the Service secure.

Legal basis

• Legitimate interests (UK GDPR Art. 6(1)(f)): we have a legitimate interest in delivering podcast content to listeners and in providing Hosts with the basic analytics that the podcasting industry expects. This is balanced against listener privacy by keeping the data minimal, not building profiles, and aggregating analytics shown to Hosts.

Retention

The event data used for our feed and download analytics is held in Cloudflare Workers Analytics Engine for three months. Aggregate reports can be retained longer. Other operational logs have separate security and troubleshooting purposes; section 9 sets out the retention criteria.

5.4 Website visitors

When you visit show.fm without logging in or creating an account, we collect limited information through our self-hosted Rybbit analytics tool and infrastructure logs.

What we collect

• the pages you visit and how long you spend on them;
• approximate location derived from your IP address;
• referrer (the link you arrived from);
• general device and browser information.

Rybbit runs on data.show.fm. It processes website activity to help us understand usage; self-hosting does not itself make all activity anonymous. We do not sell this information or share it with advertising networks. Cookies, local storage, analytics scripts and your choices are explained in section 12.

Why we collect it

• to understand how visitors find and use the website;
• to improve the website over time;
• to plan content and marketing.

Legal basis

• Legitimate interests (UK GDPR Art. 6(1)(f)): we have a legitimate interest in understanding and improving our website, where permitted and balanced against your privacy. Consent is required where the storage or access involved is not covered by a lawful exception. You may object to processing based on legitimate interests.

Retention

Website analytics are retained according to their service-improvement purpose and the criteria in section 9; they are separate from the three-month podcast-delivery event store.

5.5 Support contacts

What we collect

• the email address you contact us from (or the address on your account);
• your name where you provide it;
• the content of your messages with us, including any screenshots or files you share;
• metadata about the support conversation (such as ticket reference, status, and timestamps).

Why we collect it

• to answer your questions and help you with the Service;
• to track and improve our support quality;
• to keep a record in case the same issue comes up again.

Legal basis

• Legitimate interests (UK GDPR Art. 6(1)(f)): for support to people who are not yet account holders.
• Performance of a contract (UK GDPR Art. 6(1)(b)): for support to people who contract with us personally. For people using an organisation’s account, we rely on legitimate interests in supporting that organisation’s use of the Service.

Retention

We retain support records for handling the enquiry and related recurring issues, complaints or legal claims, then delete or anonymise them when no longer needed. We consider the issue’s sensitivity, age and whether it remains unresolved.

5.6 Prospective customers, newsletter subscribers, and marketing contacts

What we collect

• name, email address, consent and unsubscribe records, optional enquiry details, and newsletter delivery, open and click information where collected by our email tools. Section 12 explains email measurement.

Why we collect it

• to send you the newsletter;
• to evaluate beta and demo requests;
• to follow up on conversations you have started with us.

Legal basis

• Consent (UK GDPR Art. 6(1)(a)) for newsletter subscriptions.
• Legitimate interests (UK GDPR Art. 6(1)(f)) for following up on enquiries you initiated.

Retention

We keep subscriber data while the subscription continues. After an opt-out, we retain the minimum suppression information needed to respect it, rather than leaving you on an active marketing list. Enquiries are retained while the conversation or a related legal need remains relevant; we consider time since the last meaningful contact.

6 AI Content and Guest Research ¶

AI features process the information relevant to a requested or enabled task. Transcription uses recordings; content generation uses transcripts and prompts. Guest research uses the Guest’s name, additional attendees’ names, show information and designated research answers, including biography, topic, talking points, topics to avoid and supplied web links. Ordinary custom booking fields are not automatically included in that research input.

Public sources. Research may read the public pages at the supplied links and a limited number of related pages on the same site, such as an about or biography page. It can combine that information with the booking answers to produce a preparation brief and suggested questions. Public availability does not remove a person’s data-protection rights. The Host must provide appropriate information to people whose details they supply or use.

Timing and access. A Host can request research manually or enable it after a booking; transcription can also run automatically after upload when enabled. Research results are stored for the Host and authorised team members and are not automatically published by the research feature. Existing answers may be used for later research requests. Switching off an automatic trigger does not erase earlier records.

Provider and storage. These features use Cloudflare Workers AI. Public-page retrieval can use Cloudflare’s browser service. Inputs, generated results, source references and processing records can be held in our application database, storage and workflow infrastructure. Deleting the booking or a visible brief does not necessarily remove separately retained job inputs or processing records; contact the Host or our privacy team about the full scope of a deletion request.

No model training. We do not use your Content to train AI models or authorise our providers to do so without your separate, explicit consent. Cloudflare’s Workers AI data-use terms state that customer content is not used to train models or improve its or third-party services without explicit consent. This does not mean inputs and outputs are never stored to provide the feature.

Lawful use and accuracy. For Host-directed research, the Host is responsible for identifying a lawful basis, necessary notices and any additional condition for sensitive information. A topic marked “avoid” is still processed to guide preparation. AI output may be inaccurate, including where it combines information about different people; it requires human checking. Contact privacy@show.fm or the Host to request access, correction, objection or deletion. We do not treat an AI brief as a verified assessment of a person.

7 Who we share your personal data with ¶

We do not sell your personal data. We share it only where necessary to operate the Service or where required by law.

7.1 Service providers (processors)

We use service providers for the functions below. They are processors or subprocessors where acting on our or a Host’s instructions; some, such as payment providers, also have independent responsibilities. These include:

• Cloudflare: hosts the website and application, delivers audio files, runs the RSS feed service, provides bot protection, and provides AI processing.
• Supabase: stores account and application data and handles login.
• Backblaze B2 and Bunny.net: backup storage and continuity of media and feed delivery if the primary delivery service is unavailable.
• Payment processor (Stripe): handles all card payments. We do not see or store full card numbers. Stripe's privacy policy is available at stripe.com/privacy.
• Resend: sends transactional emails (account, billing, security) and emails you configure in the automation engine.
• FreeScout (self-hosted): runs our support inbox. Our internal CRM links relevant account, support, billing and communication records.
• Rybbit (self-hosted): collects website usage statistics. MooSend supports newsletter and marketing-list management, including subscription and campaign interaction records where used.

For details of provider entities, processing locations and the safeguards relevant to your data, contact privacy@show.fm. The separate subprocessor register is still being prepared.

Where a provider processes personal data on our behalf, data-protection law requires appropriate contractual protections, instructions and security measures. Services you choose independently, such as your external podcast host or an authorised AI assistant, may process information under their own terms.

7.2 Other Hosts, Team Members, and Guests on the Service

If you are a Team Member or Guest, your name, email, contributions, and activity inside a podcast or episode are visible to the Host who invited you and to other authorised participants in that podcast or episode. This is how collaboration works.

7.3 Third-party platforms you connect to your account

If you connect a calendar, external podcast host, webhook destination, API client or AI-assistant integration, we share the personal data needed to make that integration work, including access tokens and permissions, calendar availability and event details, or selected podcast and episode information. An authorised assistant can receive data and perform actions within its permissions. Disconnecting stops future access but does not recall data already received by the third party. Use of those services is governed by their own terms and privacy policies. Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

7.4 Podcast directories

When you submit your podcast to Apple Podcasts, Spotify, Amazon Music, YouTube, or any other directory, the metadata you have entered in your RSS feed (including show and episode titles, descriptions, and any personal details such as a host name) becomes visible to the directory and to the public. Hosts control what goes in their feed, including contributor credits and any contact information they elect to expose. Public show pages, players, downloadable media and published transcripts can also disclose personal information. Private intake answers and research are separate unless a Host chooses to publish material from them. Public copies may remain with listeners, search engines or directories after removal from our Service.

7.5 Legal, regulatory, and law enforcement

We may share your personal data:

• where we are required to do so by law, including in response to a court order, statutory request, or other legally binding instruction;
• where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others;
• where we are responding to a credible copyright takedown or other rights-holder notice;
• to enforce our Terms of Service or investigate suspected breaches.

We will resist overbroad or improper requests and, where lawfully able, we will notify you before disclosing your data.

7.6 Business transfers

If we sell, restructure, or merge our business, your personal data may be transferred to the acquiring entity, subject to the same protections that apply under this policy. We will give you notice of any such transfer.

8 International data transfers ¶

Our infrastructure and providers operate internationally. Storage location and the countries from which data is accessed or processed are not necessarily the same. AI processing, delivery, email and support can involve countries outside the UK and European Economic Area; public podcasts are intentionally distributed worldwide.

Where we transfer personal data outside the UK and EEA, we rely on one of the following safeguards:

• an adequacy decision by the UK or the European Commission (for example, transfers to countries deemed to provide an adequate level of protection);
• the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, combined with a transfer risk assessment;
• another lawful transfer mechanism permitted under UK GDPR.

You may request information about the transfers relevant to your data and a copy of the safeguards in place by emailing privacy@show.fm.

9 How Long We Keep Your Data ¶

We retain personal data for the purposes described in this policy, then delete or anonymise it when it is no longer needed. Where an exact period depends on the record, we consider the active service relationship, the Host’s instructions, the sensitivity and age of the information, outstanding requests or disputes, and legal requirements.

• Accounts and production data: kept while needed for active accounts, memberships and podcast material. Cancelling billing does not automatically delete a login, a podcast or a Guest’s information. Booking deletion, episode deletion and research deletion are separate actions.
• Billing and accounting: normally six years from the end of the relevant financial year, and longer where required for a legal obligation or unresolved matter.
• Podcast analytics: feed and download event data is retained in Workers Analytics Engine for three months; aggregate reports are retained separately. Pseudonymous event records remain personal data where a person can be identified.
• Temporary external-host recordings: our processing copy is normally scheduled for deletion 30 days after publication, subject to hosting-migration and processing needs. The transcript and external host’s recording are separate.
• Research, messages, profiles and feedback: retained according to their production, network or communications purpose. Expired links and invitations do not themselves erase the related records. Research inputs can also remain in job and workflow records.
• Security, support and complaints: kept while needed to investigate incidents, resolve issues, protect the Service or establish, exercise or defend legal claims. Access is limited to those purposes.
• Marketing suppression: we retain enough information to avoid sending marketing to someone who has opted out for as long as needed to respect that choice.
• Backups: deletion from active systems may take additional time to flow through backup and recovery systems. Retained copies are for recovery, security or legal purposes, not a fresh marketing use. Public copies held independently by other services are outside our control.

You can ask privacy@show.fm about a particular record, request erasure, or ask why it is still needed. We assess deletion across connected systems, including account identity, CRM, research and email records, and explain any legal reason for keeping information. We do not describe account cancellation as instant, complete erasure.

10 Your rights ¶

Under UK GDPR and the Data Protection Act 2018, you have the following rights over your personal data:

10.1 Right of access. You can ask us for a copy of the personal data we hold about you.

10.2 Right to rectification. You can ask us to correct personal data that is inaccurate or incomplete.

10.3 Right to erasure. You can ask us to delete your personal data in certain circumstances, for example when it is no longer needed for the purpose we collected it. We will not always be able to delete (for example, where we need to keep records for legal reasons), and we will explain why if so.

10.4 Right to restrict processing. You can ask us to limit our processing of your data while we look into a concern you have raised.

10.5 Right to data portability. Where we process your data based on consent or contract, you can ask us to provide it in a structured, commonly used, machine-readable format, and to send it to another controller if technically feasible.

10.6 Right to object. Where we process your data based on legitimate interests, you can object on grounds relating to your particular situation. You have an absolute right to object to direct marketing.

10.7 Right to withdraw consent. Where we process your data based on consent, you can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing we did before you withdrew it.

10.8 Rights relating to automated decisions and profiling. We use automated signals such as account-activity and customer-health indicators to help staff provide support, and reputation summaries to inform network users. These can involve profiling. We do not use them or guest research to make solely automated decisions with legal or similarly significant effects about you. Contact us to query an inaccurate assessment or ask for human review.

How to exercise your rights

Contact us at privacy@show.fm. We will respond within one calendar month. Where a request is complex or we have received a number of requests from you, we may extend this by up to two further months, in which case we will let you know.

We may need to verify your identity before responding, to make sure we do not disclose personal data to the wrong person.

Most requests are free of charge. We may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, in line with UK GDPR.

Right to complain

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office, the UK's independent data protection authority:

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
Website: ico.org.uk

You can raise a data-protection complaint by emailing privacy@show.fm or writing to our registered address. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and tell you the outcome. This does not delay a separate data-rights request or prevent you from contacting the ICO or another competent data-protection authority.

11 How we protect your data ¶

We use a range of technical and organisational measures to protect your personal data, including:

• encryption of data in transit using TLS;
• encryption of data at rest, including encrypted backups;
• hashing of passwords (we do not store plain-text passwords);
• access controls and the principle of least privilege for our team;
• separate permissions for account administration, podcast membership and guest access;
• audit logging of significant account and admin actions;
• regular security reviews and dependency updates;
• isolated environments for development, staging, and production;
• bot protection and rate limiting on public endpoints.

No security measure can guarantee complete protection. If we become aware of a personal data breach affecting your data, we will notify you and the ICO as required by UK GDPR.

You can report security concerns to security@show.fm.

12 Cookies, Analytics and Email Measurement ¶

We use cookies and other storage or access technologies for sign-in, guest verification, security and preferences. The website stores your selected colour theme in your browser’s local storage. The app uses authentication and guest-access cookies on the relevant service host. Bot-protection services may process device and network information.

The website loads our self-hosted Rybbit analytics script from data.show.fm. Analytics scripts can access device and usage information even without setting a cookie. Self-hosting or the absence of cookies does not, by itself, remove privacy-law requirements.

Email measurement. Some service notifications contain an image request that records an open and links that record a click before redirecting to the destination. These events are associated with the notification and recipient; they can help the Host or our team understand delivery and engagement. Marketing tools can also provide sent, open, click and unsubscribe events. Email software may load images or scan links automatically, so these records are not proof that a person read a message.

Legal requirements and choices. Necessary storage and access can be used without consent where the law permits. Other uses require consent or a specific statutory exception with its required safeguards; describing a feature in this policy does not supply consent. You can manage stored data and block scripts or remote email images using your browser or email software, although disabling necessary storage may affect sign-in or booking. You can withdraw marketing consent using an unsubscribe link and contact privacy@show.fm about analytics or email-measurement objections. These technical controls do not replace our obligations to provide any consent or objection mechanism required by law.

A separate itemised Cookie Policy is being prepared. This section describes the current categories of cookies and similar technologies.

13 Children ¶

The Service is not directed to children. You must be at least 16 years old to create an account.

If you become aware that a child under 16 has provided personal data to us, please contact privacy@show.fm and we will investigate and take appropriate steps. A child may be mentioned in a podcast or listen to public content without having an account; we assess the context and relevant rights rather than assuming all such data can simply be erased.

Hosts select their podcast content and are responsible for appropriate contributor permissions and audience labelling. Public availability does not mean a show is suitable for children. We handle safety reports as described in our Terms. Podcast directories that distribute podcasts (such as Apple Podcasts and Spotify) have their own child safety policies.

14 Changes to this policy ¶

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any change.

If we make a material change (for example, a change to the categories of data we collect or to the lawful basis we rely on), we will give you at least 30 days' notice by email or in-product notification before the change takes effect, except where the change is required by law to take effect sooner.

For existing users, material changes in this version take effect only after that notice period. Until then, the previous policy’s commitments continue to apply. Publishing this page does not start the notice period: we must send the email or in-product notification. This policy explains our processing; it does not retrospectively authorise a use of your data or replace any consent required by law.

Older versions of this policy are available on request.

15 How to contact us ¶

For any privacy question, request, or complaint:

Email: privacy@show.fm

Post: show.fm Ltd, 128 City Road, London, United Kingdom, EC1V 2NX

For security issues, please use security@show.fm.

For general support, please use support@show.fm.

show.fm Ltd

Trading as show.fm
Company number 17438149
Registered in England and Wales