Privacy Policy

Theatrio is an AI-powered marketing platform built specifically for amateur theatre groups. We help committees, producers and publicity volunteers create social posts, newsletters, press releases and campaign material in minutes rather than evenings.

Because we work with volunteer-run organisations, we keep this policy short and plain. Protecting your theatre's data is a priority, and we only collect what we genuinely need to run the service and write content that sounds like you.

Theatrio is operated as a UK sole trader business, based at 4 Barton Court, Parkham, Bideford, EX39 5RJ, United Kingdom. You can reach us at any time at info@theatrio.co.uk.

Theatrio is the data controller for the account information we hold about you, and acts as a data processor for the theatre content you upload and generate. Our Data Processing Agreement explains that split in more detail.

When you sign up and use Theatrio, we collect:

• Your name
• Your email address
• Your password, stored only in encrypted form
• Your theatre name
• Theatre profile information — location, website, social pages, tone of voice, mission statement, preferred hashtags and emojis
• Production information — show names, dates, venues, ticket links, sponsors and supporting details you enter
• Theatre Memory™ data, including any documents or examples you upload
• Marketing content generated for your theatre
• Your subscription status
• Basic technical and usage information — such as sign-in times, browser type and which features are used — to keep the service secure and working properly

Payments: payment information is processed securely by Stripe and is never stored by Theatrio. We only receive confirmation of whether your subscription is active, along with limited billing metadata such as the renewal date.

We use your information to:

• Create and secure your account
• Manage your subscription and free 14-day trial
• Generate AI marketing content for your productions
• Personalise that content to your theatre's voice and branding
• Store your Theatre Memory™ so future campaigns stay consistent
• Improve the reliability and usefulness of the platform
• Provide customer support when you contact us
• Meet our legal, accounting and fraud-prevention obligations

We do not sell your data, and we do not share it for advertising purposes.

UK GDPR requires us to have a lawful reason for using personal data. In plain English, here are ours:

• Performance of a contract — to give you the service you signed up for: your account, your trial or subscription, and the marketing content you ask us to generate.
• Legitimate interests — to keep Theatrio secure, prevent misuse, fix bugs, understand which features are actually used, and improve the platform. We only rely on this where it does not override your rights.
• Legal obligations — to keep accounting and tax records, respond to lawful requests, and meet regulatory duties.
• Consent — where consent is required, for example non-essential analytics cookies or optional marketing emails. You can withdraw consent at any time, and withdrawing it will not affect your use of the core service.

Theatre Memory™ is your theatre's own private library of tone, history and wording.

• It belongs to your theatre. Anything you store there remains your organisation's information, and you keep ownership of everything you upload.
• It is used only to improve AI-generated content for your own organisation.
• It is never shared with other Theatrio customers.
• It is never used to train public AI models.
• You can view, edit or delete Theatre Memory™ items at any time from within the app.

To write your marketing pack, the production details and Theatre Profile information you provide may be securely shared with trusted AI providers, including OpenAI, Anthropic and Google, solely to generate personalised marketing content for your theatre. This happens only at the moment you ask for content to be created or regenerated.

To be completely clear:

• AI providers only receive the information needed to produce the content you have requested.
• Your data is never used to train public AI models.
• Theatre Memory™ is never shared with other customers.
• AI providers process your request, return the content, and are contractually restricted from using it for their own purposes.

Our AI Usage Policy explains what AI is and isn't suitable for, and where your responsibilities as a publisher begin.

Some of our providers — including AI providers and cloud infrastructure — may process information outside the United Kingdom, for example in the European Economic Area or the United States.

Where that happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Addendum, or Standard Contractual Clauses. The aim is simple: your theatre's information receives the same level of protection wherever it is processed.

• While your account is active, we keep your account details, Theatre Profile, productions, Theatre Memory™ and generated content so the service works and your campaigns stay consistent.
• If you delete your account, we delete or anonymise your information once it is no longer needed — normally within 30 days, with backup copies cycling out shortly afterwards.
• Some records are kept longer where the law requires it — for example invoices and billing records for accounting and tax purposes (typically six years), or limited records needed for fraud prevention, security and regulatory compliance.

You can ask us to delete your data sooner, and we will do so unless we are legally required to keep it.

Theatrio uses cookies and similar browser storage for:

• Keeping you signed in during a login session
• Remembering your preferences, such as saved drafts and favourites
• Analytics, so we understand which features are actually used
• Improving performance and page loading

A separate Cookie Policy applies and explains each cookie, what it does and how long it lasts. Non-essential cookies, such as analytics, are only used with your consent where the law requires it, and you can withdraw that consent at any time via our Cookie Policy page or your browser settings.

You can also clear or block cookies in your browser, though some features may stop working.

We use industry standard security practices to protect your account and content. This includes encrypted connections, encrypted password storage, access controls that keep each theatre's data separate, and hosting with reputable infrastructure providers.

Our Security page sets out these measures in more detail, including backups, monitoring and how to report a vulnerability.

No online service can promise perfect security, but we take reasonable and proportionate steps to keep your theatre's information safe. If a personal data breach occurs that is likely to affect your rights, we will notify you and the Information Commissioner's Office without undue delay.

Under UK data protection law you can:

• Access the personal data we hold about you
• Correct information that is inaccurate or out of date
• Delete your account and associated theatre data
• Request a copy of your data in a portable format
• Object to or restrict certain processing, including our legitimate interests
• Withdraw consent where we rely on it, such as analytics cookies
• Contact us with any question or complaint about privacy

We respond to requests within one month, as required by UK GDPR, and usually much sooner. If your request is unusually complex we may extend this by up to two further months and will tell you if that happens.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

For anything relating to privacy or your data, email info@theatrio.co.uk. This inbox is monitored during UK working hours.

You can also write to us at: Theatrio, 4 Barton Court, Parkham, Bideford, EX39 5RJ, United Kingdom.

• General privacy questions: we aim to reply within 5 working days.
• Formal UK GDPR requests: answered within one month of verifying your identity.
• Security or breach reports: reviewed as a priority, normally within 24 hours.