Privacy Policy
What we collect, why, how long we keep it, who we share it with, and how to ask about your data.
Effective date: October 20, 2026
This policy is published at https://entertainhq.com/privacy, at /privacy-policy on app.entertainhq.com, and at /privacy-policy on every company's own EntertainHQ address. It is linked from the footer of every page of the marketing site, from its contact and demo forms, from every sign-in page, from every set-password page ("I accept the Terms of Service and Privacy Policy"), from the performer portal's Contact page, and from every page a client opens from a link.
1. Who we are, and what this policy covers
1.1. EntertainHQ is run by EntertainHQ LLC, a Texas limited liability company ("EntertainHQ", "we", "us"), 3244 Spaulding Dr, Paris, Texas 75460. This policy says what personal data we collect, why, how long we keep it, who we share it with, and what you can do about it.
1.2. It covers:
entertainhq.com, the marketing site, including its contact and demo forms;app.entertainhq.com, where a company signs up, pays, finds its workspace and signs in;- every company's workspace on its own EntertainHQ address (for example
acme.entertainhq.com, or a domain the company connects), including the staff pages, the performer portal, the costume portal, and the pages a client opens from a link; - the emails and text messages the product sends.
1.3. Two roles, and it matters which. For the marketing site, sign-up and billing, EntertainHQ decides what is collected and why: we are the controller (in California's words, the business). Inside a company's workspace, the company decides: the company is the controller and EntertainHQ is its processor (service provider). We hold a company's data on its instructions, as the Terms of Service, section 5, and its Customer Agreement set out. When this policy says "the Company", it means the business that runs the workspace you were invited into or sent a link from. Section 9 says who to ask for what.
1.4. A company's own page. When you read this policy on a company's own EntertainHQ address, the block at the top names that company (its legal name, trade name, address, phone and email) and its text-message program. That company is the sender of its texts and the controller of its workspace; EntertainHQ is the software and the processor.
2. What we collect, by who you are
We collect only what the product needs to do what you or the Company asked. We never ask for a Social Security number, a government ID number or a card number, and the product has no field for them; a company may ask a performer to upload a tax form (section 2.4).
2.1. A visitor to entertainhq.com
- Nothing identifying, by default. The site sets no analytics or advertising cookies and runs no third-party trackers. It remembers your light-or-dark choice in your own browser (section 7) and that is all.
- If you use the contact or demo form: your name, company, email, phone, the reason you wrote, the size of your roster and your event volume, the tools you use today and your timeline, as you typed them. Cloudflare Turnstile may run to tell a person from a bot; it does not identify you to us.
- Server logs at Cloudflare's edge: your IP address, the page asked for, the time and your browser, kept by Cloudflare for its own short period.
2.2. A company owner who signs up
- The company name, the workspace address chosen, the owner's first name, last name and email, the plan and add-ons chosen.
- Billing goes to Stripe: the card is typed on Stripe's page and never reaches us. We receive from Stripe the customer and subscription identifiers, the status of each payment and the billing email.
- A signed cookie for seven days so that the browser that started a sign-up can see its own welcome page, and nothing else.
2.3. A staff user (an owner, manager, agent, costumer, any other staff)
Entered by the Company or by you: your name, email, phone, role, which pages and actions you may use, your region, your photo, your profile, your working hours and time off, your clock-in and clock-out times, your schedule and your pay rate where the Company uses the workforce features; what you write in the product (messages, notes, tasks, reviews); and your sign-in record (section 2.7).
2.4. A performer
Entered by the Company or by you in the performer portal: your legal name and stage name, email, phone, mailing address, emergency contact, your photos and videos, the talents and skills you claim, your sizes and measurements (height, weight, hair, clothing sizes), your availability and the regions you work in, your business name and how you want to be paid, your rate, the events you were offered, accepted or declined, your check-ins (time and, where the Company turns it on, your location at check-in), the contracts you signed and when and from which address, your pay records, your wardrobe and props, your messages and notes, your consent to text messages (the time and the IP address, section 5), and documents you upload because the Company asked (a certificate, an insurance card, a tax form such as a W-9). A tax form carries a taxpayer identification number: it is the Company's to ask for and the Company's to see, and the product shows it only to the Company's staff who hold the paperwork right. The Company may also keep an internal ranking and internal notes about you that you do not see; those are the Company's.
2.5. A client who opens a link
The name, email, phone and company that the Company holds for you; the proposal, contract, invoice or page you opened and when; your signature on a document, the time and the IP address it was signed from; the payment status Stripe reports (never the card itself); anything you type into a page the Company sent you (a question, an approval, a note).
2.6. Text messages
Your mobile number, your consent (the box you ticked, the time and the IP address), each message sent to you and its delivery status, your replies (STOP, HELP, YES, NO, or anything else), and the fact that you opted out, which we keep so that we never text you again by mistake.
2.7. Sign-in and security records
For every login: sign-ins, failed sign-ins, lockouts, passwords set and reset, invitations accepted, changes to what a person may do, deactivations and sessions ended, each with the time, the IP address and the browser. Request logs with the address asked for, the IP and the browser. These exist to keep accounts safe and to answer "who did what".
2.8. Support
If you report a bug or write to support: what you wrote, the page you were on, your login's name and the Company, and any screenshot you attach.
3. Where it comes from
- From you, when you type it in.
- From the Company, when it creates your login, imports a roster, enters a client or syncs from Tripleseat (only companies that connect Tripleseat).
- From the product itself, as you use it (sign-ins, signatures, check-ins, messages).
- From Stripe (payment status), Twilio (delivery status and replies), the email provider (whether an email was delivered or bounced).
We do not buy data about you and we do not look you up on other services.
4. Why we use it
| Purpose | What it rests on |
|---|---|
| Running the workspace the Company asked for: casting, bookings, contracts, invoices, pay, wardrobe, check-in, messages | the Company's instructions as controller; our contract with the Company |
| Sending the emails and texts the workspace sends (an invitation, a casting call, a contract to sign, a reminder, an invoice) | the Company's instructions; your consent for texts |
| Signing documents and keeping the signed record | the Company's instructions; your request when you sign |
| Taking payment for the Company's subscription | our contract with the Company |
| Keeping accounts and data safe: throttling sign-ins, lockouts, audit trail, checking uploads | our legitimate interest in a secure service, and the law |
| Support, and fixing bugs you report | your request; our contract with the Company |
| Answering a demo or contact request from the marketing site | your request |
| Telling a Company's owner about changes, outages, bills and new features | our contract with the Company |
| Complying with law, a court order, or a carrier's rules | legal obligation |
We do not use your data for advertising, we do not profile you to make decisions with legal effect about you, and we do not use personal data from any workspace to train a machine-learning model.
5. Text messages: the carriers' rules and ours
5.1. Texts are sent on behalf of the Company that booked you, from a number registered in that Company's own legal name, for operational purposes only (casting calls, confirmations, reminders, schedule changes, contract and pay notices, replies from the Company's staff). Never marketing.
5.2. You receive texts only after you entered your own mobile number and ticked the separate, unticked consent box on your own account page, or replied to confirm. Message frequency varies with event activity; most performers receive one to ten messages a month. Message and data rates may apply.
5.3. Reply STOP to any message to stop texts from that Company; you get one confirmation and no more. Reply HELP for the program name and the Company's contact. You can also turn texts off on your Contact page in the performer portal or tell the Company in any reasonable way. Opt-outs are honoured at once where the carrier reports them and in every case within ten business days.
5.4. Mobile information and text-message opt-in data are never sold, rented or shared with third parties, affiliates or lead generators for marketing or promotional purposes. All sharing described in section 6 excludes text-messaging originator opt-in data and consent; that information is not shared with any third party, except the messaging provider that delivers the message (Twilio) and the carriers, strictly to deliver it.
5.5. Consent is given to one Company and is not transferred to any other company, affiliate or program.
6. Who we share it with
We share personal data only as follows. We do not sell personal data and we do not share it for cross-context behavioural advertising, and have not done so in the past 12 months.
6.1. The Company and its people
Everything in a workspace is visible to the Company's staff according to what the Company lets each person see. A performer's profile and media kit may be shown by the Company to a client to make a booking (a media kit link). A client's details are visible to the Company's staff. That is the product working as the Company instructs.
6.2. Our sub-processors
The services that run the product. Each receives only what its job needs, under a written contract that limits it to that job, and each publishes its own security and privacy terms.
| Provider | Job | What it receives | Where |
|---|---|---|---|
| Railway Corporation | hosts the application, each company's database and uploaded files, and backups | everything in the product | United States |
| Cloudflare, Inc. | DNS and the network in front of every address (TLS, firewall, rate limiting); the marketing site, the control plane's front and our admin desk, with the storage behind the contact form and our own admin tools | your IP address and requests; what you type into the site's forms; our support desk's records | global edge network; stored data replicated across it |
| Stripe, Inc. | the Company's subscription to EntertainHQ | billing name and email, the card (typed on Stripe's page, never seen by us), payment status | United States |
| Twilio Inc. | sends and receives text messages | mobile number, message text, delivery status, replies | United States |
| Resend, Inc. | sends email | email address, name, the email's contents, delivery status | United States |
| Have I Been Pwned (Troy Hunt) | checks whether a new password is on the public list of leaked passwords | the first five characters of a hash of the password, never the password, never who you are | global |
| Mobile carriers and email providers | deliver the message to you | the message and your number or address | yours |
We give every Company at least 30 days' notice before adding a sub-processor that will process its data, by email to its owner and by updating this table. A Company that objects may end its subscription under its Customer Agreement, which says the same. GitHub holds our code and never any Company's data, so it is not on the list.
Services a Company connects are not our sub-processors. A Company may connect its own accounts to its workspace: its own Stripe account, through which its clients pay it, and Tripleseat, from which it syncs events, contacts and documents. Those services receive data because the Company connected them and on the Company's instruction, under the Company's own agreement with each; they are the Company's providers, not ours, and the Company's Customer Agreement calls them Third-Party Services. We send them only what the connection needs.
6.3. When the law requires
To comply with a law, a court order, a subpoena or a lawful request from a public authority; to enforce the Terms of Service; to protect the rights, property or safety of EntertainHQ, a Company, a person or the public. We tell the Company before we hand over its data unless the law forbids it, and we hand over no more than is required.
6.4. If EntertainHQ changes hands
If EntertainHQ LLC merges, is bought, or sells the product, personal data goes with it to the successor under this policy, and we tell every Company's owner before it happens.
6.5. The Company's own sharing
What a Company does with the data in its workspace beyond the product (exports it, emails it, shares a media kit) is the Company's decision and the Company's responsibility.
7. Cookies and your browser's storage
We use no analytics, advertising or tracking cookies, and no third-party cookies. What we do set:
| Name | Where | What for | How long |
|---|---|---|---|
| session | each company's address and app.entertainhq.com |
keeps you signed in while you work; carries your CSRF token | until you sign out or close the browser (staff), or the session's idle limit |
| remember | the same | keeps you signed in on that device when you ticked "remember me" or opened a signed link | 30 days |
ehq_signup |
app.entertainhq.com/signup |
lets the browser that started a sign-up see its own welcome page | 7 days |
ehq_access |
entertainhq.com |
only while the site is behind its launch gate: proves the gate password was entered | 30 days |
ehq-theme (browser storage, not a cookie) |
entertainhq.com |
your light-or-dark choice | until you clear it |
All our cookies are set only over HTTPS, cannot be read by scripts, and are scoped to the address that set them: a cookie from one company's address is never sent to another's. Because we do not sell or share personal data for advertising, a Global Privacy Control signal from your browser changes nothing; we treat it as honoured. If we ever add analytics, we will update this section first and use a tool that does not identify you.
8. How long we keep it
| What | How long | Why |
|---|---|---|
| A Company's workspace (everything in sections 2.3 to 2.6) | for the life of the subscription, then the export window of 30 days, then deleted from our live systems within a further 30 days | the Company's instructions; the Terms of Service, section 13.1; the Customer Agreement |
| Backups of a workspace | taken daily by our host and kept on a rolling schedule; a deleted workspace is gone from every backup within three months of its deletion | recovery from loss |
| A performer's, staff member's or client's data inside a live workspace | as long as the Company keeps it; a Company can delete a person's record, and the product deletes what belongs to that record with it | the Company is the controller |
| Text-message consent and opt-out records | consent: while the number is on the account; an opt-out: kept so the number is never texted again | the carriers' rules; your right not to be texted |
| Sign-in and security records (section 2.7) | 12 months | security and "who did what" |
| Request logs | 3 days | diagnosing problems |
| Sign-in throttle counters and spent-link records | pruned when idle; spent links after 31 days | security |
| Sign-up and billing records (section 2.2) | 7 years after the last payment | tax and accounting law; Stripe keeps its own records under its policy |
| Marketing-site contact and demo requests | until handled, then 24 months in our prospects list, then deleted on request or at the end of that period | follow-up on your request |
| Support tickets and bug reports | 24 months after the ticket closes | fixing the product; a record of what was promised |
| Emails and texts sent | the product keeps the fact of sending and the delivery status with the record it was about; the email provider and Twilio keep their own logs under their policies | delivery proof |
Where the law requires a longer period (a signed contract, a payment record, a legal hold), we keep that record for that period and no longer.
9. Your rights, and whom to ask
9.1. What you can ask for. Wherever you live, you can ask to: know whether we hold personal data about you and get a copy of it, in a form you can take elsewhere; correct what is wrong; delete it; and stop or limit some uses. Residents of Texas, California and a number of other states have these rights in law (the Texas Data Privacy and Security Act, the California Consumer Privacy Act as amended, and their counterparts); we extend them to everyone. We will not treat you differently for exercising them.
9.2. Ask the Company for workspace data. If you are a performer, a staff member or a client of a Company, the Company is the controller of your data in its workspace and the one that can act on it: it can show you your record, correct it, export it or delete it. Performers can read and change most of their own profile in the performer portal. EntertainHQ acts for the Company here: a request that reaches us about workspace data is passed to the Company, and we give the Company what it needs to answer within ten business days (its Customer Agreement says so). If the Company does not answer you within 30 days, or its subscription has ended and it cannot be reached, write to us and we will help: we remind the Company, and where its subscription has ended we act on your request ourselves.
9.3. Ask us directly for data we control: the marketing site's forms, sign-up and billing, support tickets, and our sign-in and security records. Write to [email protected] or by post to the address in section 15, from the email address we hold for you, and say what you want. We may ask you to confirm something only you would know, to be sure it is you. We answer within 45 days; if we need another 45 we say so and why. The request is free, unless it is plainly repeated or excessive, and we tell you first.
9.4. An appeal. If we refuse, we say why and how to appeal. Write "appeal" to the same address; a different person answers within 60 days. In Texas you may then complain to the Texas Attorney General (texasattorneygeneral.gov); in California to the California Privacy Protection Agency (cppa.ca.gov); elsewhere to your state's attorney general.
9.5. Sale, sharing, targeted advertising, profiling. We do none of these, so there is nothing to opt out of. If that ever changes, this policy will say so first and you will be given the opt-out before anything happens.
9.6. An authorised agent may make a request for you if they show us your written permission or a power of attorney, and we may still confirm it with you directly.
10. Children and minors
10.1. The product is for adults. We do not knowingly collect personal data directly from a child under 13, and nothing on the marketing site or in the product is directed at children. If you believe a child has given us data, write to the address in section 9.3 and we delete it.
10.2. Performers under 18. Some companies book performers who are minors. In that case the Company must arrange for the parent or legal guardian to hold the login, give any text-message consent, sign any contract and receive any notice, and the Company must tell us it casts minors. For a performer the Company has told us is under 18, we do not collect precise location at check-in, we show no third-party content, and we delete the record on the parent's request to the Company or to us.
11. Security, truthfully
11.1. No system is unhackable, and we will not tell you ours is. What we do:
- Every address is served only over HTTPS, behind Cloudflare, with strict transport security.
- Each Company has its own database, chosen by the address you are on; its uploaded files live under its own folder and are served only on its own address; a session, a signed link or a cookie from one Company's address does not work on another's, and this is tested as two companies in our test suite before every deploy.
- Passwords are stored as salted scrypt hashes, never in plain text; a new password must be at least 12 characters and not on the public leaked-password list; sign-in is throttled by address and by account and locks for a growing period after repeated failures.
- Every sign-in, failure, lockout, password change and permission change is written to an audit trail kept 12 months.
- What each person may see and do is checked on every request by capability, never by a page being hidden.
- Signed links (to sign in, to reset a password, to accept an invitation) expire, and a link that changes anything works once.
- Uploads are checked by their content, not their name; images are re-encoded so that location data is stripped; nothing uploaded is ever executed.
- Backups are taken daily by our host and kept as section 8 says; the host encrypts data at rest.
- Secrets live in the host's variable store, never in code.
- The code carries a suite of tests that fail when a protection is removed, and runs before every deploy.
11.2. What we are still building, and do not claim yet: two-factor authentication for staff logins, off-platform backups, an independent penetration test. When each is done, this section changes to say so.
11.3. Your part: keep your password to yourself, do not forward a sign-in link, sign out on a shared device, and tell the Company and us at once if you think your login has been used by someone else.
12. If there is a breach
12.1. If we learn that personal data has been taken, lost or exposed, we tell the Company whose workspace it is without undue delay and within 72 hours of confirming it, with what we know: what happened, whose data, which data, what we have done and what we suggest. Under Texas law a business that maintains data for another must tell the owner immediately on discovery, and we treat that as the standard.
12.2. The Company tells its people and its clients, because it is their controller and holds their relationship; we help it do so, and we write the notice with it if it wants. Texas law gives a business 60 days from determining the breach to notify affected individuals and 30 days to notify the Texas Attorney General when 250 or more Texans are affected; other states have their own clocks, and the Company's lawyer should check them.
12.3. For data we control (section 9.3), we notify you ourselves within the same periods, by email to the address we hold.
13. Where your data is stored
The product and every Company's data are hosted in the United States by Railway. The marketing site runs on Cloudflare's global network, and what its contact form and our admin tools store is replicated across that network. EntertainHQ is offered to companies in the United States; if you use the Service from elsewhere, your data is transferred to and processed in the United States, which may not have the same data-protection laws as your country, and by using it you agree to that.
14. Changes to this policy
We may change this policy. For a change that matters (a new purpose, a new category of data, a new sub-processor, a shorter or longer retention period), we give every Company's owner at least 30 days' notice by email, show a notice on the sign-in page and in the product's "What's new", and update the date at the top. The current policy is always at the addresses in the header; earlier versions are available on request.
15. Contact
Privacy questions and requests, security reports, and everything else: [email protected]
EntertainHQ LLC 3244 Spaulding Dr, Paris, Texas 75460
Appendix A. Notices for particular states
California. The categories of personal information we have collected in the past 12 months are those in section 2 (identifiers; customer records such as name, address, phone, email and, where a company asks for a tax form, a taxpayer identification number; professional information; physical characteristics such as height, weight and hair colour for a performer's casting profile; audio and visual information such as photos and videos; geolocation only at a check-in the Company turns on; internet activity such as sign-in and request logs; and inferences the Company itself writes, such as a ranking). The sources are in section 3, the purposes in section 4, the recipients in section 6. We do not sell or share personal information, we have no actual knowledge that we collect personal information from anyone under 16, and we do not use sensitive personal information to infer characteristics about you. Your rights (know, delete, correct, portability, non-discrimination) and how to use them are in section 9. Residents may also use the request address in section 15 by post.
Texas. We do not sell personal data, sensitive or otherwise, and we do not process personal data for targeted advertising or for profiling with legal effect. The categories, purposes and recipients are in sections 2, 4 and 6. Your rights, the 45-day response period and the appeal are in section 9.
Other states with a comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, Rhode Island and others as they take effect): the same rights, periods and appeal apply to you under section 9. Where EntertainHQ falls under a state's small-business or data-volume threshold and the law does not apply to us, we extend the rights anyway.
Appendix B. The sub-processor list
The table in section 6.2 is the list. Its date is the date at the top of this policy. A change is announced as section 6.2 says.