Privacy notice

ImprovTeam helps improv groups run their schedule, sign-ups, payments and public pages. We make no money from your data and never sell or share it. This notice explains what personal data we handle and your rights. We've tried to keep it plain. If something is unclear, ask us.

1. Who we are

ImprovTeam is run by ImprovTeam Ltd, trading as ImprovTeam. ImprovTeam Ltd is registered in Scotland, company number SC908233. Registered office: Clyde Offices, 48 West George Street, Glasgow G2 1BP (“we”, “us”, “our”).

We are the controller of the data described in this notice, except where it says a group organiser is the controller (next section). You can reach us at hello@improvteam.com or through the contact form.

ImprovTeam is for people aged 18 and over. You must be 18 or over to hold an account or use the service, and nobody under 18 may use it. Organisers must not add anyone under 18 (students, members, acts, guests or guest lists). We don't ask for your date of birth or keep any record of your age. If we learn that someone under 18 is using ImprovTeam, we delete their data.

2. Group organisers are controllers of their members' data

When you join a group on ImprovTeam (a team, an open group, a show, a festival), the people who run that group decide what to do with the information about their members, such as who is on the list, who turned up and who owes what. Within their group, the organiser is the controller of that member data and we act as their processor, providing the tools. Ask the organiser first about anything specific to a group (for example removing you from its list). We are the controller of your account, sign-in and our own service records. If you aren't sure who to ask, contact us and we'll point you the right way.

We do not collect health information. A group must not ask for health, medical, dietary or access details through ImprovTeam; a camp, for example, links to its organiser's own form, and we keep only a tick that you sent your details and a tick that the organiser received them. A buyer can tick that they would like to talk about access, with no reason given, and that tick is deleted 30 days after the event. Anything health-related you type here by mistake is deleted on request.

3. What we collect

Account and profile: your name and, only if you want email reminders or to sign in with an emailed code, your email address (email is optional: you can make an account with just a name and a passkey), and optionally a city. We do not collect your phone number. You can use many features from an email link without creating an account; we still keep the name and email the link was sent to. If you make a profile, it can also hold what you add to it: a photo, a short bio, a website, your city, and optionally the improv styles you enjoy, the roles you take, forms you know or have performed, when you started improvising, where you trained and the languages you perform in. Your profile is private unless you choose to show it to signed-in people or the public.
Passkeys and recovery codes: if you create a passkey we store its public key, the name you give it and when you added and last used it. The private key, and any fingerprint, face or screen-lock data, stay on your device: we never see biometrics. Recovery codes are stored only as one-way hashes, so we cannot show them again.
Group chat links: an organiser can add an invite link to a group chat (WhatsApp, Signal, Telegram or Discord). Only people in that group see it. We store the link, never anyone's chat handle or phone number, and it is not shown on public pages or in exports of other people's data.
Groups and activity: which groups you belong to and your role, your RSVPs (yes, maybe, no and any note), sign-ups and waitlist positions, attendance, no-shows, polls you answered, and tickets, passes, workshop places, course places or merch orders you hold. If an organiser puts you on a course themselves, they give us your name and email address so we can send you your course link, and they may record whether you have paid them. If an organiser invites an act to perform at a show and gives us an email address for it, we send that address one invitation on the organiser's behalf (with Accept, Decline and unsubscribe links) and keep it as a guest record, which we delete under the same rules as other guests. If an organiser adds you to a guest list, they give us your name and sometimes your email address so we can issue you a free ticket. We use them only to make and send that ticket.
Invites to groups: If your profile is visible, members of a group can find you by name or profile handle and invite you; you choose who can do this (anyone, only people you share a team or theatre with, or nobody) in your notification settings. We keep a record of each invite and how it ended, any group you block, and any invite you report as spam, for 12 months (a block until you remove it), to stop unwanted invites; a group never sees who reported it.
Payments metadata: amounts, what a payment was for (including merch you bought from a group and a tip you gave it), its status and the Stripe references. A tip by card keeps no name or email at all; a merch order keeps your name and email so the group knows who to hand it to. We never see or store your card details: card payments are handled entirely by Stripe, and we never store bank or card details. If a group records a payment made another way, we store who marked what as paid. If a coach takes card payments, the payment is made to the coach's own Stripe account and Stripe is responsible for the card data.
Subscriber emails: the email addresses of people who subscribe to a city listing or a group's newsletter, and whether they confirmed.
Group news: groups on ImprovTeam can post news. If you follow a group or belong to it you see its news in the app and, if you have turned on notifications, as a push message. We email you a group's news only if you asked for it (by confirming a sign-up or ticking “Email me news from the group”); we keep the time and where you agreed, and every email has a one-click unsubscribe. At a ticket checkout you can tick a box, unticked by default and separate from your order, to get news from that group by email. If you are signed in and use your account address we record the time, the page and the wording; otherwise we email you once to confirm. A group's organisers can choose an address where replies to the group's news emails are sent. We email that address once to confirm it belongs to them, and we only use it after they confirm. It is not shown publicly.
Mail about your tickets: if you hold a ticket for a show, the group running it can email you once the day before, and when its date, time, doors or venue change or it is cancelled or put back on, through ImprovTeam. These are service messages about your ticket. If you reserve something and pay the group directly, we may email you once, a few hours before the reservation is released, to remind you. After a show, the group that ran it may send you one thank-you message by email or push, using the address you gave when you got your ticket. We do not give your address to the group. Every message has an unsubscribe link, and you can switch these messages off in your notification settings at any time.
Ticket transfers: if you give someone a ticket, we email them your first name and the show, and they choose whether to take it. We keep the recipient’s name and email address as you typed them, how many tickets, and how the offer ended (taken, declined, cancelled or expired). The tickets stay yours until the other person accepts. We delete a finished offer 30 days after it ends.
How you heard about a show: if a group turns on the question “How did you hear about this show?” at its ticket checkout, your optional answer (and, if you chose Other, the few words you typed) and the name of the website or link your visit came from (only the site's name or a short label such as “city”, never the full address) are kept with your order. The group's organisers see them only as totals, never which buyer answered what, and only once at least five buyers have answered. We keep them for as long as we keep the order, and the few words you typed are deleted if you delete your account.
Door devices: when a group’s door staff open a show’s door page, their phone keeps that show’s ticket list (each ticket holder’s name and ticket type, and a fingerprint of the ticket code, never the code itself) so the door works with no signal. It is deleted from the phone the morning after the show, and when they sign out. Scans made offline are uploaded later and kept as the group’s record of the show for six months.
Paid plans: if a group's owner buys a paid plan, Paddle sells it to them and handles the payment, tax and invoices (see section 5). We keep the group's plan, its status and dates, Paddle's reference numbers and which owner pays; never a card number, an address or an amount. If a group asks for a discount, we keep the organisation name, the short note and the link the person typed, who asked and who decided. We also keep a log of plan changes and the reference numbers of Paddle's messages to us, so that each is applied once. Paddle needs an email address to sell a plan, so a person with no email address cannot subscribe.
Ticket alerts: if you ask to be told when a show's tickets go on sale, we keep your email address for that show only, send you one email when sales open and then delete it, or delete it unsent if the show is over or cancelled first; the organiser sees how many people asked, never who.
Ticket waitlist: if a show is sold out and you join its waitlist, we keep your email address and how many tickets you want for that show only; if tickets come back we email you once and hold them for you for 12 hours, and we delete your address when you buy, when the hold ends, when the organiser closes the waitlist, or when the show is over or cancelled; the organiser sees how many people are waiting, never who.
Course and submission alerts: if you ask to be told when a group's next course opens or when a festival's submissions open, we keep your email address for that one alert, send you one email when it happens and then delete it, or delete it unsent if the window closes or the festival ends first, and after 12 months at the latest; the organiser sees how many people asked, never who.
Files and content you upload: photos, resources and documents, plus the text you write on group pages, in submissions and in messages through a team's contact form. Photos (profile pictures, team website and show archive photos) are shrunk in your browser when you choose them, and before we store any photo we remove the hidden details inside the file, such as the GPS location where it was taken and the camera or phone model, so a photo you upload does not give away where you were. Only the picture is kept. Files and links in a group's Resources are for its members only: they are public only if the team chooses to show them on its website, and only the ones it ticks are.
Messages from organisers: an organiser can write a short message to the cast of an event or to the volunteers on a shift. We deliver it to each person by email or notification, as they have chosen, so the organiser never sees anyone's email address. We keep only a log that it was sent, not a copy of the text.
Cast calls for a show or festival show: when a team is invited to play at a show or a festival, its players are asked Yes, Maybe or No on a show on the team's own calendar; those answers are ordinary answers like any other. Once the team's act is accepted, the show's organiser sees the names of the players who said Yes (up to the number wanted), never the Maybe or No answers, the reserves or the rest of the team. We keep, per call, the answer-by date, its status and the account numbers of the cast and reserves in the order they answered (so that a reserve who moves up can be told), and whether the act confirmed that it can come.
Festival review: a festival's organisers can set review criteria (labels only), assign applications to reviewers, and reviewers can record a score for each criterion, a note, and a conflict of interest (recusal) on an application. We keep these with the application. A reviewer sees only their own scores, assignments and recusals; the festival's organisers see them all. The applicant does not see them.
Announced lineups, hosts and teachers: a show or festival lineup, and any host or teacher shown on a public page, stays private until an organiser announces it. For each act the organiser can enter a public name, a short public blurb and a photo (which may show people), mark a headliner, hide an act and set the order; they can show on the group's public page, the lineup poster and the share image. We keep those entries, when each was announced, the time the organiser chose for it to go public, and which organiser set it. The organiser is responsible for having the agreement of the people named or shown. The public sees only acts announced and not hidden, by their public names, never a contact, address or phone number.
Festival headliners: a festival's organisers can list people as headliners on the festival's public site, poster and share image, with a name, a photo and a short bio. If the person has a public profile on ImprovTeam, we show only what is on that profile (name, photo, short bio and the teams they chose to show), never contact details, and nothing at all if the profile is not public. If they have no account, the organiser types in a name, a short blurb of up to 280 characters, one web link and, if they like, a photo; we shrink the photo and remove its metadata. We keep each entry, when it was announced and which organiser added it. An entry stays private until the organiser announces it. If you have an account we tell you when you are listed and again when it goes public, and a link takes you off at once. The festival decides who to list and is the controller of a guest's details; the organiser agrees to list only people who said yes. The basis is the festival's legitimate interest in announcing its line-up.
Supporter memberships: a group can offer a paid supporter membership. If you join one, we keep the scheme, your status, the dates (started, paid until, ended), the price you agreed, how you pay (by card or directly to the group), when you said you had paid, and a record of each payment (amount, date and period). For a card membership we also keep Stripe's reference numbers for the subscription and the customer. We never see or store your card details: Stripe holds them, on the group's own Stripe account. The group's owners and admins see your name, the scheme, the status, the dates and the price. We do not give them your email address. You need an account to join, so you can see and end the membership yourself in Groups I support. We use this data because you asked for the membership and pay for it (contract).
What a group agrees to pay an act or host: an organiser can record, for an act at a show or festival show or for the teacher of a workshop or course, the fee agreed (none, fixed, a door split or per student), expenses such as travel, and each payment they marked as paid (date, amount, an optional note, and who marked it). The person or team being paid can see their own agreement and tap Received. It is a record only: we never hold, route or take responsibility for the money. A notice goes to the person being paid when a fee is agreed and when a payment is marked.
Wrap-up feedback forms: a few days after a show or festival, the organiser can ask the acts, a festival's workshop leaders and, only if the organiser switches it on, the people who held a ticket or festival pass how it went. The form asks for a score from 1 to 5, up to two optional lines of free text and any questions the organiser added. We keep the person it was sent to, when it was sent and answered, and the answers. The organisers read an act's or workshop leader's answers under that act's or workshop's name; they read the answers of ticket and pass holders without a name (we keep the account number so you can download or delete your own answers, but it is not shown to them). Please leave out health details and other people's names. You can leave the form blank or never open it.
Freelance profiles and booking requests: a person can offer to be booked as a musical director, photographer, videographer, lighting, sound, technician or designer. A role holds what they do, their instruments or kit, what they need at a venue, styles and languages, how far they travel, a rate, a short bio, portfolio links and up to six portfolio images, and up to three questions of their own. A role is listed in the directory and on the public profile only while it is switched on and the profile is public; the portfolio images are shown only to whoever can see the profile. A group's organiser can ask for a freelancer for a practice, a class or a show: the request holds the group, the organiser's name, the date, place and length, a message and the answers to the freelancer's questions, and only the freelancer and the people who run the group can read it. A booked freelancer's name, role, call time and venue needs show on that event's run sheet for the organisers and hosts; a musical director is named on the public show page only once the host is announced, and nobody else is named there. The fee goes through the fee pages above.
Coach booking questions: a coach can ask up to three questions of the team that asks them for a practice. The team's organiser answers them in the booking form. The answers (free text, up to 1,000 characters each) sit on the request, and only the coach and the person who made the request can read them.
Class messages and “Ask your teacher”: if you have a confirmed place on a course or workshop you can write to its teacher (or, if the class has none, to the group's owners and admins). We keep the conversation: your messages and the replies, with the times. The teacher, and the group's owners and admins, can read every conversation, and we tell you so under the box. Nobody sees anyone's email address. A conversation is deleted 6 months after the class ended and after its last message.
The Library and class plans: if you share an exercise in the Library, we keep what you wrote and a link to your account so you can edit or delete it. Other people see the exercise but not your name (it shows the group’s name if the group is public, otherwise “an ImprovTeam member”). Anyone signed in can report a public exercise; we keep who reported it, the reason and an optional note. If you plan classes in ImprovTeam, we keep your plans, your notes on them and your marks on exercises. Your group’s teachers and organisers can read the plans; students see a plan only if it is shared with them.
Your inbox: We keep a copy of each notification we send you (a short title and line and a link in the app, never your email address or a sign-in link) so you can find it again. We keep the newest 100 for 60 days.
Telegram notifications: if you link Telegram from your notification settings, we keep the chat number Telegram gives our bot and nothing else (no phone number, username or name). We delete it when you unlink, when the bot is blocked or when you delete your account.
Private reports about a code of conduct: a group on ImprovTeam can take private reports about its code of conduct. A report goes only to the people that group has named as contacts; neither we nor the group's other organisers can read it. We store what you write, the time, and your account only if you choose to tell the group who you are. A report may mention other people; it is read only by the named contacts and kept only as long as section 7 says. If you delete your account, reports you chose to sign are deleted. We do not investigate reports: the group is responsible for how it handles them. For private reports the group is the controller and we provide the form and the storage as its processor.
Out-of-date reports and listing checks: if you tell us a listing is out of date, we pass your note to the group's organisers and to our administrator queue. We keep your account id only if you were signed in. Organisers can confirm a public listing is current: we show the date, and remind organisers by email or notification every three months.
What you and your group type: in notes, class messages, coach answers and other free text, the group is the controller of what its members and students type in its spaces, not us. Please don’t include health or other sensitive details about yourself or anyone else.
Stats and casting: for teams and open groups, a nightly count of the shows you played, practices you came to, how often and how quickly you answer, your no-shows and when you were last cast, plus which shows an organiser cast you in. Only you and the group’s organisers can see your numbers; other members never can.
The team-finder board: if you post on a city's board (a team that needs a sub, a player looking for a team, a coach, a room), the text you write, an optional link to an event, the date it expires and your display name (or your group's name) are public. If someone replies, the message is passed to you through the app by email or notification, as you have chosen; neither of you sees the other's email address. We keep the messages, who wrote them and when, and any report someone files about a listing.
Theatre discussions: if a theatre you belong to (or that is open to anyone signed in) has a Discussion tab and you use it: the threads you start and the posts you write (with when you wrote and edited them), the threads you follow or mute, the people you block, and the reports you make (the post, your reason and an optional note). If you moderate a discussion, we record the moderation actions you take (posts you hid, people you muted or removed, and when). If someone reports one of your posts, we keep the report and the decision. We refuse phone numbers, bank details and email addresses in posts.
Rehearsal spaces: public listings of rooms to hire, built from the space’s own published business details: its name and address, a booking link, a business email address, a business phone and WhatsApp number, with a link to where we found them and the date we checked. These are details about a business, not about a person. If you suggest a space we keep your account on the suggestion (and how many you suggested today) so an admin can ask about it; erasing your account removes that link.
Calendar links: if you subscribe to a calendar feed, a private link made for you. The feed lists your groups' events (title, venue, time, and your own answer), never anyone else's name or email. We store a version number so you can reset the link; resetting makes the old links stop working.
Chat posts (Slack, Discord, Telegram): an organiser can connect the group to a chat, and we post the title, time and venue name of the group's events, with a link, to that chat. We store the webhook address or bot token the organiser pasted (shown only in part afterwards) and which events were posted. Posts never contain member names, email addresses or answers. The group decides to share this with the chat service and is responsible for that choice; nothing is read back from the chat.
Channels connected to a city: if you connect a Discord channel or a Telegram channel or group to a city page, we keep the Discord webhook address (encrypted) or the Telegram chat number, the city, which account connected it, the channel's name as Telegram gave it or the last four characters of the webhook, and when we last posted. We use it to post that week's public shows there on Monday mornings: names, days, times, venues, prices and a link, never a person. Only we can read the stored address. You see the channel name or the end of the webhook on the connect page, and nobody else on ImprovTeam sees the connection, not even the groups whose shows are listed. Discord or Telegram receives what we post, under their own terms. Our lawful basis is that you asked us to, by connecting the channel.
Notes in a group: a member can write a short note about a practice or show and choose who may read it: the whole team, only themselves, or one other member. Notes can use simple formatting (markdown) and are shown formatted to the people allowed to read them; links in a note are marked so search engines ignore them. The author can edit their own note: only the current text is kept, and the note says when it was edited. We keep the text, who wrote it, who it is addressed to, when it was written or last edited, and the event it is about. Anyone who can read a note can download it as a file, for themselves. An organiser cannot read a note that is private or addressed to someone else. If a group switches on the optional after-event digest and you opt in, you get an email saying how many notes you can read, never their text. Please don't write health or other sensitive details about anyone; phone numbers and bank details are refused.
The show archive: an organiser can record, for a show that has been played, who played, the setlist or format, the audience count, a recording link and up to 12 photos, each with an optional short caption. These are visible to the group’s members, and on the group’s public archive page only if the organiser switches that on for the group and ticks the show. Names in a lineup and people in photos are then public: organisers should check with them and remove anything they are asked to.
Devices you turn notifications on for: the browser's push address and keys (so we can reach that device) and a short label such as “Chrome on Android”. We don't keep the browser's full user-agent.
Technical records: a record of the emails we send (so we don't send duplicates) and error reports if error monitoring is switched on. We don't store IP addresses in our database; our host, Cloudflare, sees them to deliver the site and apply rate limits. We don't track whether you open or click our emails.
Visit counts on public pages: We use Cloudflare Web Analytics, which does not use cookies or track you across sites, to count visits to public pages (the home and information pages, city and directory pages, a group's public site and public show and event pages). It records the page address, where you came from, your country, browser and device type, with no cookie and no personal profile. It is not used on pages you sign in to or on the admin pages. We see only totals.
Public API and widget: the same public information that is on a group's public page (names, dates, places, public ticket prices) can be read by other websites and apps, and shown in a box on a group's own website. It contains no people, emails, member counts or anything from a private or members-only group, and reads no cookie.
Forms you’re filling in: saved in your browser, on your device only, until you send or discard them (or seven days pass, or you sign out). We never receive them.
Messages to us: what you send through the contact form or by email, including your name and email address.

4. Why we use it, and our lawful basis

To run your account and the groups you use (contract): signing you in with an emailed code, showing the schedule, recording your answers, taking payments and issuing tickets.
Reminders and service emails (legitimate interests): day-before reminders, nudges for an unanswered event, receipts, and messages about your account. These are why you use the service. You can switch categories off in your email and notification settings.
To keep the service safe and working (legitimate interests): preventing abuse and spam, rate limiting, security, fixing faults, and keeping a record of the emails we've sent. We balance this against your interests and keep it to what is needed.
To look after our own business (legitimate interests): answering your messages and understanding in aggregate how the site is used.
Newsletters, group news, the weekly city list and push notifications (consent): We only email you a newsletter, a group’s news or a weekly listing, or send a notification to your device, if you asked us to, and you can withdraw consent at any time (the unsubscribe link in every email, or your notification settings).
Paid plans (contract, legitimate interests, legal obligation): selling and running a paid plan for a group (contract); a trial, limits against abuse and the log of plan changes (legitimate interests); keeping billing records, together with Paddle (legal obligation). When a theatre chooses to cover a house team’s plan, the theatre sees that team’s cover status (covered, from when, or in its 30 days after it ended) and, for a team with a plan of its own, only that it has one and the date its own subscription ends; the team sees which theatre covers it and until when. Nothing else about either group’s plan, payer or payment is shared between them.
To meet legal duties (legal obligation): for example keeping accounting records for payments, and responding to lawful requests.
Theatre discussions: to show your posts to the people the theatre allows to read them and to tell you about replies in threads you follow (contract: the service you asked to use). To keep discussions safe: posting limits, the checks for contact and bank details, reports, moderation and our own review of reported posts (legitimate interests in a safe service, and our legal duties under the UK Online Safety Act 2023).

We never sell your personal data and we never share it for advertising across other sites (in California terms: no “sale” and no “sharing” for cross-context behavioural advertising). We do not make automated decisions that significantly affect you.

Within a group, organisers and (depending on the group's settings) other members can see names, answers and attendance. Public pages show only what an organiser has chosen to publish. Beyond that, we use these processors, who handle data only on our instructions:

Cloudflare: hosting (Workers), our database (D1), file storage (R2), resizing photos that are still too big after your browser has shrunk them (Cloudflare Images) and caching (KV). Cloudflare Web Analytics counts visits to public pages without cookies and without tracking you across sites.
Resend: sending the emails described above.
Amazon Web Services: delivering group newsletters and the weekly city list (Amazon SES, EU region), and telling us when an address bounces or someone marks a message as spam so we stop mailing it. A group that sets up its own sending domain has its emails sent through Amazon SES from that domain, on the group's behalf.
Stripe: card payments. A card payment goes to the group's own Stripe account (Stripe Connect), where Stripe acts for the group as the merchant; we don't receive or hold the money. Stripe is also an independent controller for its own legal and fraud-prevention duties; see Stripe's privacy policy.
Paddle: if a group's owner buys a paid plan, Paddle (Paddle.com Market Ltd) sells it to them and handles the payment, tax and invoices as an independent controller (see Paddle's privacy notice). It also hosts the checkout and the billing portal for us, acting as our processor. We keep only the group's plan, its status and dates, Paddle's reference numbers and which owner pays; never a card number, an address or an amount. Paddle's checkout page may set its own cookies (section 9). Paddle moves data between countries under its own terms and transfer mechanisms.
Push services (Google, Mozilla, Apple): if you turn on notifications, the push service your browser uses (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari) delivers them. It sees an encrypted message and the device address, not the content. In the iPhone app, Apple’s push notification service (APNs) delivers notifications and, unlike a browser, can read their text (the group name, the event and the short message), because that text is not encrypted for Apple.
Slack, Discord and Telegram: only if a group's organiser connects the group to one of them: the group's event titles, times and venue names, with a link, are sent to it. No member names, emails or answers are sent.
Telegram (notifications): only if you link it: the notification text and a link go to your private chat with our bot through Telegram, whose own terms apply to that chat. We keep only the chat number.
Google Wallet and Apple Wallet (tickets): only if you tap "Add to Google Wallet" on a ticket, the pass (the event, its time and place, the ticket type, your name as on the ticket, the ticket code and the QR code) is sent to Google, which keeps it in your Google account under its own terms; we can change or switch off that pass later. An Apple Wallet pass is a file made for you to keep on your own device and goes nowhere else. Nothing is sent to either unless you tap the button.
Address suggestions (Geoapify, postcodes.io): when you type an address into the location box of an event, course or show form, what you type is sent through our server to Geoapify (Geoapify Ltd, Cyprus, hosted in the EU) or, for a UK postcode, to postcodes.io, to suggest places. They see the text only, never your name, email or account. Geoapify keeps request logs for about a day. We keep each answer for up to 90 days so the same search is not sent twice; it is not linked to you. Suggestions are OpenStreetMap data, © OpenStreetMap contributors. Nothing else you type is sent to anyone.
Sentry: error monitoring (Sentry, EU region), if switched on. A report holds the error text, the page path without its query string or any link token, and the app version. It never holds cookies, request contents, headers, your name or your email address.
Theatre discussions: your posts are shown, with your first name and the initial of your last name, to the people the theatre allows to read its discussion. Reports, with their reasons and notes, go to the theatre's moderators and to us; the person who wrote the post is not told who reported it. Where the law requires it, we may share content and the details needed to identify an account with the police or other authorities. Notifications about replies go through browser push services, or by email if you choose email.

We may also disclose data where the law requires it, or to professional advisers under a duty of confidence.

Signing in to other ImprovTeam apps. You can use your ImprovTeam account to sign in to other apps made by the same company, ImprovTeam Ltd, starting with the Improv MD Toolkit. When you do, we show you a screen first and ask once for each app. The app gets a private ID that is different for every app (so apps cannot compare notes about you, and your ImprovTeam ID never leaves), your name, and your email address only if you tick the box for it; it never gets your groups, tickets or anything else. We keep a record of which apps you connected, what each can see, when you connected and when it was last used, for as long as you keep the account, and list it in "Download my data". You can disconnect an app at any time in Settings under Connected apps, and deleting your account disconnects them all and signs you out of them. A note of which apps you are signed in to, kept only so we can sign you out of them, is deleted a year after you signed in. What you saved inside another app stays in that app until you delete it there; that app has its own privacy notice.

6. Transfers between countries

ImprovTeam is used by groups in many countries, and these providers process data in several places, including the United States. Where personal data leaves the UK or the European Economic Area, we rely on adequacy decisions (such as the UK–US and EU–US data bridges) or on standard contractual clauses and the UK International Data Transfer Addendum in the provider's terms. Other countries' transfer rules are handled the same way, through the provider's contract terms.

7. How long we keep it

Account and group data: while your account or the group is active. You can download a copy or delete your account yourself at any time in “Your account and data” (/settings/account). Deleting is scheduled for 7 days after you ask, and signing in during those 7 days cancels it. Groups you own are dealt with straight away, when you confirm: you hand each to another member, or delete it if nobody else is in it, and a theatre, festival or venue that other people rely on is handed to staff or closed (its ticket holders, students and applicants are told, and refunds are the organisation’s to make: we never held the money). When the 7 days are up we remove your name, email address (if you gave one), settings, sign-ins, passkeys and recovery codes, devices, memberships, poll votes, newsletter sign-ups, follows, board posts, coach profile and your answers to events that have not happened yet. Past answers and attendance stay in your groups’ history under the name “Deleted person” so their records and cost splits still add up, and tickets you bought stay valid at the door without your email address. If you connected a group’s Stripe account and the new owner did not keep it, we disconnect it; we never touch its balance.
Sign-in codes, sessions and one-tap links: codes expire in 10 minutes; a signed-in session lasts up to 60 days and is deleted when it expires; one-tap link records are deleted 30 days after they expire.
Record of emails we sent you: 13 months.
Payment records: kept for as long as tax and accounting rules require (six years after the end of the tax year in the UK; other countries differ). After you delete your account they stay, but no longer carry your name or email address.
Paid plans: a group’s plan is kept while the group exists and deleted with it (its subscription is set to end first), and with it any discount request. If a payer deletes their account, their id is removed from the plan, the log and the requests, and the subscription ends at the end of the paid period. A cover row (which theatre covered which team, and when) is kept while the team exists and deleted with it; if the theatre is deleted first, its rows stay for the team’s 30 days and go with the team. The log of plan changes and Paddle’s reference numbers are kept for 7 years as a billing record, then deleted. Paddle keeps invoices and tax records for as long as the law requires: deleting your account does not remove them.
Ticket transfer offers: 30 days after the offer ended.
Cast calls: while the show or the group exists, and deleted with either. If you delete your account you are removed from any list of cast and reserves, and your answers are dealt with as in the first item of this section.
Festival review: with the festival, and deleted with it. If a reviewer deletes their account, their assignments and recusals are deleted and their scores stay with their notes removed.
Announced lineups, hosts and teachers: while the show, festival or course exists, and deleted with it, along with the photos. “Make private again” hides an act at once and keeps what was entered; an organiser can remove a photo or clear a public name at any time, and you can ask them, or us, to do so. If an organiser deletes their account, their name is removed from the announcement they set.
Festival headliners: until the entry is taken off by the organiser or by you, until you delete your account (an entry that names you is deleted then), or until the festival is deleted, which also deletes a guest's photo. A guest has no account, so to be taken off they ask the festival's organisers, or write to us through the contact page and we will pass it on and, where we need to, remove the entry ourselves. Entries that name you are in your data download.
Supporter memberships: the membership and its payments are the group's accounting record and stay while the group exists; the payments are kept as other payment records are (see “Payment records”). If you delete your account, we first cancel any card subscription in the group's Stripe account so nothing more is taken, then end every membership of yours and clear the Stripe customer reference; the payments stay without your name. Everything is deleted with the group. Your memberships are in your data download.
What a group agrees to pay an act or host: while the group exists, and deleted with it, the show, the course or the act. If you delete your account, we clear who marked or confirmed a payment; the payment itself stays in the group’s records without your name. Your own agreements and the payments you marked are in your data download.
Wrap-up feedback forms: while the show or festival exists, and deleted with it or with the group. The answers to the organiser’s own questions are also cleared 12 months after they were last changed. If you delete your account, your answers are deleted; they are in your data download.
Freelance profiles and booking requests: a role stays until the person switches it off, deletes it or erases their account, which deletes their roles, portfolio images, questions and the requests sent to them. A request that never became a booking is deleted 6 months after it was made or answered; for an accepted one the message and answers are cleared 12 months after the event, and the rest is deleted with the group. If you erase your account, a request you sent keeps its place on the group's list without your message or answers.
Coach booking questions and answers: they live with the request. A request that never became a practice is deleted 6 months after it was made or answered; for an accepted one the answers are cleared 12 months after the practice.
Class messages and “Ask your teacher”: 6 months after the class ended and after the last message. If you delete your account, your conversations are deleted; a teacher’s replies stay on the thread as “a teacher”.
The Library and class plans: until you or the group delete them. If you delete your account, private exercises and the reports you made are deleted; public and group exercises and plans you wrote stay without your name, and your marks on exercises are deleted.
Your inbox: 60 days, at most the newest 100.
Private reports about a code of conduct: a closed report 12 months after it is closed, an open one 24 months after it was sent. Reports you signed are deleted if you delete your account.
Out-of-date reports: 90 days after they are handled, and 12 months at most.
Telegram chat number: until you unlink, the bot is blocked, or you delete your account.
Connected channels: until you disconnect, Discord or Telegram stops accepting our posts or the bot is removed from the channel (we tell you when that happens), or you delete your account. The one-time code for linking a Telegram channel lasts 15 minutes. What we keep is in the data you download, without the encrypted address.
Subscriber emails: until you unsubscribe; an unsubscribed address is deleted after 30 days, and a sign-up that was never confirmed is deleted after 30 days.
Bounced or complained addresses: if a newsletter or city-list email to you bounces for good, or you mark it as spam, your address is kept on a do-not-mail list so we never send that kind of email to it again. It is deleted after 24 months, or when you delete your account.
Guests: if you took part without ever signing in (for example a guest at an open session or a ticket buyer) and are in no group, your name and email address are anonymised 12 months after your last event.
Festival applications: contact details and free-text answers are cleared 12 months after the festival ends. The act’s name and basic details stay for the festival’s records.
Audition applications: your name, email address, answers and the reviewers’ notes about you are cleared 12 months after the audition round closes.
Stats and casts: kept only while you are an active member of the group. They are deleted when you are removed from the group, when you delete your account and when the group is deleted; they are recalculated every night from your answers and attendance.
Board listings and replies: a listing is hidden when it expires or you close it and deleted 14 days later, with its replies and reports. Every reply is deleted 90 days after it was written. Deleting your account removes your listings and every message you wrote or received.
Shows listed for a venue that has not joined yet: the title, time, place and a link back to the venue’s own page (nothing about any person) are deleted 30 days after the show ends.
Calendars suggested for a listing: a web address someone sends with “Add your calendar” waits for an admin and is deleted when it is approved or declined, or after 60 days. If the sender was signed in, their account is attached to it until then (never an email address or an IP address); it is removed when the account is deleted.
Rehearsal spaces: a listing stays until the space asks us to remove it (see “Rehearsal space listings” below), an admin removes it, or the details are replaced by newer ones. A removal request hides the listing straight away. Reports and removal requests carry no name or address and are deleted with the listing.
Notes in a group: kept until you or an author delete them or the group is deleted. Deleting your account removes the private and one-to-one notes you wrote and every note addressed to you; notes you wrote for the whole team stay, under “Deleted person”.
Show archive: kept until an organiser removes it or the group is deleted. Deleting a group deletes its archive photos and captions.
Theatre discussions: posts and threads stay while the theatre keeps its discussion and are deleted when the theatre is deleted. A post a moderator hid, or that was hidden after reports, is deleted 6 months after it was hidden. Reports, and the record of how they were dealt with, are deleted 6 months after they were made. A post you remove yourself keeps no text. When you delete your account, your posts are replaced by "Post removed" with no name, the reports you made are kept without your name until their 6 months are up, and your follows, blocks and moderator roles are deleted.
Backups: a copy of the whole database is saved every week in private storage in the EU and deleted after 60 days. Only the platform admin can open it. If you delete your account, you stay in these backups until they expire.
Messages to us: up to two years after the conversation ends.
Logs and error reports: up to 30 days.

Rehearsal space listings

The rehearsal spaces on a city page are businesses, and we list the contact details each one publishes itself (a booking link, a business email address, a business phone number, a WhatsApp number), always with a link to where we found them and when we checked. We rely on legitimate interests for this: it helps improv groups find rooms, and the details are already public. If you run a space and want your listing changed or taken down, use “Request removal” on its page: the listing is hidden at once and an admin looks at the request. You can also write to us through the contact form and we will remove it. If an address or number on a listing belongs to a person rather than a business, tell us the same way and we will remove it.

8. Security and data breaches

We limit who can see personal data, keep sign-in codes and link tokens hashed, and send notifications encrypted. If a breach puts people at risk, we will tell the data protection authority where the law requires it, within 72 hours of becoming aware, and tell the people affected without undue delay.

What we do to keep data safe, and how to report a security problem, is on the security page.

9. Cookies

Apart from Paddle's checkout page (see the end of this section), we only use strictly necessary cookies, so we don't show a cookie banner. There are no analytics or advertising cookies:

__Host-it_session: keeps you signed in. It is set when you sign in, lasts up to 60 days, and is sent only to ImprovTeam itself, never to a group's public site.
it_grant: a short-lived (30 minute) signed cookie set when you use a one-tap link in an email, so you can change your answer on the next page without signing in.
it_city: remembers the last city page you opened (just the city, nothing about you), for a year, so the home page can offer "Back to" that city. "Find improv near you" uses your approximate location from your connection, or your exact location if you tap for it, for that one step only. We do not store it.

Paddle's checkout page, which only a group's owner sees when buying a paid plan (at /billing/checkout), may set its own cookies. ImprovTeam loads Paddle nowhere else.

We don't use analytics, advertising or cross-site tracking cookies. We use Cloudflare Web Analytics, which does not use cookies or track you across sites, to count visits to public pages. A group's public page may embed content from other sites (for example a video the organiser has added); those sites may set their own cookies, which is outside our control.

10. Your rights

Under data protection law, such as the UK and EU GDPR and similar laws elsewhere, you have the right to:

be told what we hold about you and get a copy (access);
have wrong data corrected (rectification);
have your data erased in many circumstances (erasure);
restrict how we use it, and receive it in a portable format;
object to processing based on legitimate interests; and
withdraw consent at any time, for example by unsubscribing.

Two of these you can do yourself: sign in and open “Your account and data” to download everything we hold about you and, for theatre discussions, the posts and threads you wrote, the reports you made, the threads you follow and how many people you blocked, or to delete your account. Download or delete your data.

For anything else, write to hello@improvteam.com or choose “Privacy request” on the contact form. We'll normally reply within one month. If your request is about a group's member data, we may pass it to the organiser, who is the controller.

11. Complaints

We'd like the chance to put things right first, so please contact us. You also have the right to complain to the data protection authority where you live or work. In the UK that is the Information Commissioner's Office (ico.org.uk/make-a-complaint); for the EU and EEA, the national authorities are listed at edpb.europa.eu.

12. Changes to this notice

If we change this notice in a way that matters, we'll update the date at the top and, for significant changes, tell account holders by email. If you don't agree, you can stop using the service and delete your account, and a payer can cancel a paid plan before the change takes effect, without charge.

13. Contact

ImprovTeam
Email: hello@improvteam.com