This Privacy Policy explains how Quelight LTD collects, uses, stores, shares and protects personal data in connection with the Quelight Platform at www.quelight.com. We are committed to handling personal data lawfully and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
- Data Controller: Quelight LTD
- Company Number: 16168474
- Address: 13 Alexandra Road, London, N8 0PJ, United Kingdom
- Contact: quelight.info@gmail.com
2. What Personal Data We Collect
Account and profile data
Name, email address, username, password (stored in encrypted form), profile photograph or image, biography, credits, professional history, and any other information you choose to include in your profile.
Show and content data
Show listings, video uploads, images, audio, descriptions, category labels, credits, and any other content you submit to the Platform.
Payment and transaction data
Details relating to purchases, Donations, payout requests and transaction history. Card details are processed directly by Stripe and are not stored by Quelight. We retain records of transaction amounts, dates, and associated accounts for legal and accounting purposes.
Bank account and payout details
Where a creator chooses to receive payouts, they may need to provide bank account details or other financial information. This data is used solely for the purpose of processing payouts.
Usage and technical data
Your IP address when you connect (used by our hosting provider for security and not kept by us), browser and device type, and, only if you accept analytics cookies, the pages you view, how you arrived and how you move around the site.
Location data
If you allow it, Explore uses your device's location to show where you are on its map and to start directions from there; it goes to Google Maps or Apple Maps only when you open directions there. When you plan an evening, the start you choose (where you are, a postcode or an address) is sent through Quelight's server to the transport operator (Transport for London in London) to find your journey, postcodes are looked up with postcodes.io, and an address you type is looked up with Google's Places service; Quelight keeps the start only if you save the plan, until you delete it. The evening's weather comes from MET Norway, which is sent the theatre's location, never yours.
Communications data
Emails or messages you send to us, content reports, complaints, and any correspondence relating to your account.
Moderation data
Where you have not opted out, data used to assist AI content moderation, which may include visual analysis of uploaded images or video content.
3. How We Collect Your Data
We collect personal data:
- directly from you when you register, create a profile, upload content, buy, donate, send a message, report content or contact us;
- automatically through strictly necessary cookies and, if you agree, analytics and advertising cookies (see our Cookie Policy);
- from Stripe (payment status) and Mux (video processing and play counts);
- from the show's team, when they confirm that a profile you claimed is yours; and from Stripe Identity, if you choose an ID check (the result only).
4. How We Use Your Personal Data and Our Legal Bases
- Operating your account and profile: Performance of a contract
- Processing purchases and Donations: Performance of a contract
- Processing creator payouts: Performance of a contract
- Storing bank and payout details: Performance of a contract, and Legal obligation
- Displaying your content on the Platform: Performance of a contract, and Legitimate interests
- Confirming a profile you claim is yours, by the show's team or by an ID check with Stripe Identity: Legitimate interests (keeping profiles and credits with the right people). The ID check itself: Explicit consent, which you give on Stripe's page.
- Moderating content (including AI tools, unless opted out): Legitimate interests
- Responding to complaints and takedown requests: Legal obligation, and Legitimate interests
- Serving and measuring advertising (Google AdSense): Consent (via cookie settings).
- Analytics and improving the Platform: Consent (via cookie settings).
- Counting plays for artists' statistics without cookies: Legitimate interests.
- Storing records for legal, tax and accounting compliance: Legal obligation
- Sending material service notifications within the Platform: Legitimate interests
- Marketing communications (if opted in): Consent
5. Third-Party Services and Data Sharing
- Lovable (Lovable Cloud, built on Supabase): hosts the website, the database, accounts and file storage, and sends our emails (account, purchase and notification emails).
- Mux: stores, processes and streams video, and counts plays.
- Stripe: takes payments, subscriptions and payouts. Card details go to Stripe and never to us. When a show connects a bank account to be paid, Stripe collects and checks the account and the person's identity under its own terms; Quelight keeps only the Stripe account's id and status.
- Stripe Identity: if you choose an ID check to claim a profile, Stripe checks an ID document and a matching selfie on its own page. Stripe holds the document and the images; we receive only the result (verified or not, and whether the name matched the profile), never the images. The show's team who confirm a claim see your name and email.
- Google (Analytics and AdSense): only if you accept those cookies. For advertising, Google also acts independently under its own policies.
- Notion: our internal workspace. It holds a copy of each account's name, handle, email address, join date and last sign in, whether it is on Quelight Pro, and the shows and venues it works on, so the Quelight team can run the company. When you delete your account, that copy is removed within a day.
- YouTube and Vimeo: only when you play a video embedded from them.
- Filming requests. When you ask us to film a show at quelight.com/book, we keep what you tell us (the show, your name, email and phone, the venue and its contact's name and email, and any poster or promo card you add) in our database and in Notion, our internal workspace, so that Flynn or Vicki can read and answer it, and we email you a copy. We do not email the venue. When you type an address, our server sends what you typed to Google's Places service and your postcode to postcodes.io to place it; neither receives your IP address. We keep a request for three years.
- Transport for London, postcodes.io and MET Norway: only when you plan an evening in Explore, as the location data line in section 2 says.
- Instagram. If a show's team connects the show's Instagram Business or Creator account to Quelight, Quelight reads that account's public profile (name, picture, followers, number of posts) and its insights (views, reach, interactions, and each post's figures). It reads nothing private, never reads messages, and never posts. Quelight keeps a daily copy of these figures so the show keeps its history, shows them only to that show's team and to Quelight, and keeps them until the account is disconnected. Disconnecting, from the show's Artist Resources or from Instagram's own settings (Apps and websites), deletes the access and every figure Quelight kept at once. A request to delete this data can also be made by writing to quelight.info@gmail.com.
- AI tools: we use AI assisted tools to help build the site and to help check content against our Terms. We never submit a user's identifiable image or copyright material to be used for training AI models.
We do not sell your personal data.
6. How Long We Keep Your Data
- Account and profile data: Duration of account, plus up to 12 months after deletion for legal and compliance purposes.
- The copy of account details in Notion: for as long as the account exists; removed within a day of the account being deleted.
- Transaction and payment records: 7 years from the transaction date, as required for tax and accounting purposes.
- Bank account and payout details: Held for as long as the creator account is active and for up to 7 years thereafter for legal compliance.
- Content uploaded to the Platform: For the duration it remains live, plus reasonable backup or cache periods after removal.
- Analytics data: two months in Google Analytics, only if you accepted analytics cookies.
- Reports, complaints and appeals: three years from when they are resolved.
- Profile claims: who confirmed the claim (the show and the person, or Stripe), the Stripe session reference, the result and the dates, for as long as the profile is claimed and 12 months after. Stripe keeps its own record of an ID check under its own policy.
- Communications and support records: Up to 3 years.
- Cookie and analytics data: As set out in the Cookie Policy.
7. International Data Transfers
Some of these providers, including Stripe, Mux, Notion and Google, store or process data outside the UK, mainly in the United States. We only use providers that protect it with the safeguards UK law recognises, such as the UK Extension to the EU US Data Privacy Framework, the UK International Data Transfer Addendum or an International Data Transfer Agreement.
8. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to legal retention requirements;
- Restrict processing of your data in certain circumstances;
- Object to processing based on legitimate interests, including the display of an Unclaimed Profile relating to you;
- Data portability: receive your data in a structured, machine-readable format where applicable;
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing;
- Opt out of AI moderation of your likeness or image (see Section 6.3 of the Terms and Conditions).
To exercise any of these rights, please contact quelight.info@gmail.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk if you believe we have not handled your data lawfully.
9. Security
We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or loss. Passwords are stored in encrypted form. Payment and card data is handled by Stripe and is not stored on Quelight's systems. No method of transmission or storage over the internet is completely secure.
10. Children and Minors
The Platform is available to users aged 14 and over. We do not knowingly collect personal data from children under 14. If we become aware that a child under 14 has created an account, we will take steps to remove that account and associated data. Users aged 14 to 17 should use the Platform with parental awareness and, where required by local law, with parental consent.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The revised version will be posted with an updated date. Where changes are material, we will use reasonable endeavours to notify registered users.