Shownote Privacy Policy
Last updated: 21 September 2026
1. Who we are
Shownote (shownote.io) is operated by Incredo Information Flow AB, a Swedish limited company, organisation number 55952014-7501, Hällsbovägen 9, 193 31 Sigtuna, Sweden ("Shownote", "we", "us").
Questions about this policy: eskil@shownote.io
2. Our two roles
When you create an account, subscribe to Shownote, visit our website or contact us, we decide how your personal data is used. For that data we are the controller and this policy applies in full.
When an event host uses Shownote to create passes for their attendees, the host decides what data is collected and why. For that attendee data we act as a processor on the host's behalf, under a Data Processing Agreement with the host. If you are an attendee, the host's own privacy policy governs how your data is used, and requests about your data should go to the host first. Section 5 explains what happens to attendee data inside Shownote.
3. Data we collect as controller
- Host accounts and customers: name, email address, company name, role, login credentials (stored in hashed form), billing details and invoice history (card details are handled by Stripe, not stored by us), and records of how you use the dashboard, such as events created and passes issued.
- Website visitors: IP address, browser and device type, pages visited and referral source.
- People who contact us: name, email address and the content of your message, whether through email, forms, calls or scheduled demos.
4. Why we use your data and our legal basis
- To create and run your account and provide the service: performance of our contract with you.
- To bill you and keep accounting records: performance of contract and our legal obligations under Swedish bookkeeping law.
- To calculate event performance metrics, such as show-up rates, that apply to your subscription and billing: performance of contract, using aggregated attendance figures for your events.
- To provide support and answer enquiries: performance of contract or our legitimate interest in responding to people who contact us.
- To keep the service secure, prevent abuse and fix errors: our legitimate interest in running a secure and reliable service.
- To send product updates and marketing to customers and prospects: our legitimate interest for existing customers (you can opt out at any time), and consent where the law requires it.
- To analyse and improve our website and product: our legitimate interest.
5. Attendee data we process for hosts
When a host adds attendees to an event, we process the data the host sends us, typically name, email address, event registration details, and attendance or engagement status if the host provides it.
When an attendee adds a pass to Apple Wallet or Google Wallet, we also process technical data needed to deliver updates to that pass: a pass serial number, a device identifier generated by the wallet, and a push token. We use these only to update the pass and deliver event notifications. We do not receive the attendee's phone number, contacts, location or other app data from the wallet.
We process attendee data only on the host's documented instructions, never sell it, and never use it for our own marketing or advertising.
Apple and Google operate their wallet and push notification services under their own privacy terms. When an attendee adds a pass, Apple or Google receives the pass content and the data needed to deliver notifications to the device.
Shownote does not process payments from attendees. Any payment an attendee makes for an event is handled by the host and their own providers.
6. Who we share data with
We do not sell personal data. We share it only with service providers who help us run Shownote, under contracts that limit their use of the data:
- Hosting and database: Convex and Vercel, deployed in the EU
- Wallet and notification delivery: Apple (Apple Push Notification service), Google (Google Wallet API)
- Payments: Stripe, which processes subscription payments from hosts. Stripe handles card details directly and acts as an independent controller for its own fraud prevention and legal obligations, under its own privacy policy.
- Email and workspace: Google Workspace
- Contracted developers: who build and maintain the service, under confidentiality and data processing terms
We may also disclose data where required by law, to protect our rights, or as part of a merger, acquisition or sale of assets, in which case the recipient will be bound by this policy.
7. International transfers
We host our core systems in the European Union. Some providers, including Apple, Google and Stripe, may process data in the United States or elsewhere. Where data leaves the EU/EEA, we rely on the EU-US Data Privacy Framework where the recipient is certified, an EU adequacy decision for the destination country, or the European Commission's Standard Contractual Clauses together with appropriate safeguards.
8. How long we keep data
- Account data: for as long as your account is active, then deleted or anonymised within 90 days of closure.
- Billing and accounting records: seven years, as required by Swedish bookkeeping law.
- Attendee data: as instructed by the host, and by default deleted 90 days after the event ends or when the host deletes the event, whichever comes first.
- Website visitor data: up to 12 months.
- Support correspondence: up to 24 months after the conversation ends.
9. Security
We protect personal data with encryption, both when it's stored and when it's sent, and we limit access to the people who need it to run the service. We also keep regular backups.
If a data breach affects your personal data, we will notify you and the Swedish Authority for Privacy Protection (IMY) when the law requires it.
10. Your rights
If you are in the EU/EEA or UK, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time where we rely on consent. You can object to direct marketing at any time.
To use these rights, email eskil@shownote.io. We respond within 10 working days.
Attendees: since the host controls your data, please contact the host first. If you contact us, we will forward your request to the host and help them respond.
You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or your local data protection authority.
11. United States residents
Depending on your state, you may have the right to know what personal information we collect and to request its deletion or correction. We do not sell personal information or share it for targeted advertising. You can use your rights by emailing eskil@shownote.io, and we will not discriminate against you for doing so.
12. Cookies
We only use strictly necessary cookies, which are needed to run the website and dashboard. We do not use advertising or tracking cookies.
13. Changes to this policy
We may update this policy. If the changes are significant, we will notify customers by email or in the dashboard before they take effect. The date at the top shows the latest version.