Where your information goes and how it's protected
This page sets out how the Theatre Ratings waitlist stores and protects what you share. It sits alongside our privacy policy, which covers what we collect and why.
In short
- Your form answers and files are stored in Sydney.
- Files and photos are private until you approve your profile.
- Only the founder can see sign-ups, through a login protected by two-factor authentication.
- CVs, documents, photos and accessibility preferences never go to our email tool.
- We keep a record of exactly what you agreed to, and when.
Where it's stored
| What | Where | Location |
|---|---|---|
| Form answers, permissions, links, credits and preferences | Our database (Supabase) | Sydney, Australia |
| CVs, documents and headshots | Private file storage (Supabase) | Sydney, Australia |
| Name, email, city and state, roles, professions, show and genre preferences, venue or company name, website and job title, how you heard about us, whether you'd like a chat, the critic trial or to be a founding reviewer, where your sign-up is up to, and email consent | HubSpot, our email and contact management tool | Sydney, Australia |
| Your first name, email, roles and share link, to send your confirmation email | Resend, our email delivery service | Tokyo, Japan |
| Your browser and network details while you submit the form | Cloudflare Turnstile spam protection | Global network |
| Answers you've started but not yet submitted | Your own browser only | Your device, cleared on submit or when you close the tab |
If the connection to HubSpot fails, your sign-up is still saved in our database and sent again later. Nothing is lost.
What stays out of our email tool
HubSpot only receives what we need to contact you. These stay in our Australian database and file storage only:
- CVs, company profiles and other documents
- Headshots
- Accessibility preferences
- Social accounts, production histories and other links
- Anything you write in open text fields
How it's protected
- Encrypted in transit: all pages and form submissions use HTTPS.
- Encrypted at rest: our database and file storage encrypt stored data.
- No public access: the database can only be read or written by our own server, never directly from a browser.
- Private files: uploads can't be reached by a web address. When we need to view one, we use a link that expires within minutes.
- Restricted access: the admin area is limited to the founder's account and protected by two-factor authentication.
- Secure keys: passwords and access keys are kept in protected settings, never in code.
- Spam protection: hidden bot traps, rate limits and Cloudflare Turnstile stop automated sign-ups.
- Backups: the database is backed up automatically.
How we build your profile
- We read the CV, documents and links you've shared, and publicly available information about your work.
- We leave out phone numbers, home addresses and dates of birth, even if they appear in a document.
- We draft your profile or venue page and email it to you to check.
- It goes live at launch only once you've approved it.
- We delete uploaded documents within 30 days of your approval, unless you ask us to keep them.
Records of your permission
When you tick a permission box, we save the exact wording you saw, the version of the form and the date and time. If you withdraw permission later, we record that too and act on it.
Critics in the early trial
Extracts from your reviews are only used once the trial is confirmed with you. Each extract is credited to you and linked to the full review on your site. If you pull out, we remove your extracts from the site within 7 days.
Keeping and deleting
- Uploaded documents: deleted within 30 days of your profile being approved.
- Waitlist information: deleted if Theatre Ratings hasn't launched within 18 months of your sign-up.
- On request: email hello@theatreratings.com.au and we'll delete your information from our database, file storage and HubSpot within 30 days.
If something goes wrong
If we become aware of a data breach, we'll act straight away to contain it and assess the risk. Where a breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
Questions
Email hello@theatreratings.com.au with any questions about how we handle your information.