Privacy & cookies

1. Controller

2. Data we process

Access and operational security

Establishing an HTTPS connection processes technical data including IP address, time, destination, transferred volume and browser/device information. Security, error and system logs may contain technical connection data. We are verifying the scope and retention of production reverse-proxy logs against the operating configuration; we do not make a blanket claim that no access logs exist.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure, stable operation and abuse prevention.

Accounts, sign in and permissions

We process user ID, email address, display name, preferred language, roles, account status, project memberships, institution names and account/project assignments to institutions, device name and technical client ID. Session, refresh and access tokens are stored server-side only as cryptographic hashes. Passwords are hashed with Argon2; plaintext passwords are not stored. Failed attempts are stored only in HMAC-pseudonymized buckets for temporary sign-in throttling.

Processing is necessary to provide and secure the service under Art. 6(1)(b) GDPR where required for a contract or pre-contractual steps, and otherwise under Art. 6(1)(f) GDPR.

Projects and synchronization

We store shared project, work, rundown, cue, camera, score and planning data, revision history, conflict evidence, tombstones, roles and project expiration dates. Concert-level technical configuration, including camera IP addresses and ATEM input assignments, is synchronized among authorized project members. Live hardware state, playback positions, local credentials and control commands are not synchronized. Concert purpose, camera-section rules, timeline markers and station notes are synchronized planning data. A revocable operator link displays only concerts, works, cameras and vision cues for its assigned project; that station may edit its own notes. Only a hash and a derivation nonce of the link token are stored server-side. Project content may include personal data entered by users.

Where we process this content solely on a customer's behalf, we act as processor under Art. 28 GDPR and the relevant agreement. The respective controller is responsible for the lawfulness of project content.

Private video files

When video sharing is enabled, we process the uploaded MP4, file name, size, SHA-256 checksum, work assignment, version, time and uploader. Objects are private and available only through short-lived signed URLs after a permission check. When sharing ends or a video is replaced, the prior file is permanently deleted; necessary revision and verification records may remain without the video file.

AI recognition and credits

When cloud AI is enabled and only after explicit confirmation, CueBot sends the excerpts needed for the chosen recognition to OpenRouter and the selected model provider: one or two locally selected still frames per shot depending on mode, possibly a limited audio segment for LiveScreen analysis, plus the instruction and response schema. The complete video is not sent automatically. The project-specific provider key remains encrypted on the cloud server and is never issued to CueBot clients or browsers.

For cost control, replay protection and billing we store project, user and client IDs, quote, maximum amount, run and step IDs, input hashes, model and price version, status, token and cost metadata, and credit ledger entries. Provider responses are cached encrypted only for a limited retry window; the analysis result remains in the local CueBot installation. The legal basis is Art. 6(1)(b) GDPR where processing is part of the agreed service, otherwise Art. 6(1)(f) GDPR. The relevant controller remains responsible for content, the legal basis and the permissibility of requested recognition.

Beta access requests

When you submit the public beta form, we process your name, email address, short explanation, selected language and submission time to review your request. A new request sends your name, email address, explanation and selected language by email to active super admins; they can review the same details in the protected administration area. You receive a regular account invitation only after approval; the request does not create an account. Unreviewed requests are deleted after 90 days and reviewed requests after 30 days. Abuse limits use short-lived HMAC buckets rather than storing IP addresses in plain text. Processing is based on your request for pre-contractual steps under Art. 6(1)(b) GDPR and abuse prevention under Art. 6(1)(f) GDPR.

Invitations, registration and account recovery

For project invitations we process recipient address, preferred language, project, role, inviter, creation, sending, expiry, revocation and acceptance times, and a hash of the single-use token. The raw token is generated for delivery but is not stored in the database. A project administrator normally provides the recipient address. This notice is linked in the invitation email. Password reset requests additionally process the account address, a single-use token hash and nonce, expiry and delivery attempts; the raw reset token is never stored and is valid for one hour. The legal basis is Art. 6(1)(b) GDPR where the invitation serves a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR; our interest is the requested project collaboration.

Administration and security records

Administrative changes are logged with time, actor, action, target and necessary details in a tamper-evident audit log. For super admins we also process AES-GCM-encrypted authenticator secrets and, for passkeys, the public key, device type, backup status, signature counter and usage times. The private passkey stays on the device. Passwords, raw tokens and provider keys are not stored in the audit log. The legal basis is Art. 6(1)(f) GDPR; our interest is access security, investigation of abuse and traceable administration.

3. Cookies

The following cookies arise during cloud administration. The short-lived pre-auth cookie binds a passwordless passkey challenge, or the required two-factor check after a correct password, to the same browser. Other cookies are set only after successful authentication. They are strictly necessary for the requested sign in, secure session and CSRF protection. Therefore prior cookie consent is not required under § 165(3) TKG 2021 (Austrian law). The legal bases for related personal data processing are Art. 6(1)(b) and (f) GDPR.

For the password-protected tour, we store each recipient group's label, a password hash, and the count and first/last time of successful password entries. A short-lived signed cookie controls access. Failed attempts are temporarily counted in HMAC-pseudonymized IP buckets to prevent guessing. We do not record individual visitors, viewing duration, tour mode, chapters or actions. The shared password cannot distinguish people within a group.

These cookies are deleted on sign out. If optional analytics, marketing or third-party cookies are introduced, they will be set only after voluntary consent and this notice will be updated.

4. Recipients and processors

Hetzner Online GmbH

The cloud application, PostgreSQL database and private media files run on infrastructure of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The running instance metadata identifies Hetzner location fsn1-dc14 in Falkenstein, Germany, and region eu-central. The data processing agreement applicable to this account and possible support access are being checked separately. The server's location does not establish the location of other recipients. Hetzner privacy notice.

Dropbox

Regular database backups, including technical runtime secrets, are encrypted on the cloud server with an age key held separately before an encrypted archive and technical verification metadata are transferred to Dropbox. Media files are excluded. Dropbox receives the encrypted archive, not the recovery key. The agreement, plan, storage location and deletion of versions and trash applicable to the actual account are being checked separately.

Resend / Plus Five Five, Inc.

Project invitations, beta request notifications to super admins, account recovery links, operational alerts and optionally app announcements are sent through Resend, operated by Plus Five Five, Inc. in the USA. Depending on the message, recipient, sender and reply addresses, invitation or reset link, project and role details, beta form content, service status or announcement text are transmitted. Resend receives no CueBot passwords. Resend's public DPA describes standard contractual clauses; the version applicable to this account, plan and tracking settings are being verified separately. Further information: Privacy, DPA and Subprocessors.

OpenRouter, Inc. and model providers

For explicitly started AI recognition, CueBot sends the inputs described above to OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA. OpenRouter forwards them to a provider compatible with the selected model; a Google Gemini model is currently used. Each request asks for Zero Data Retention routing and no provider data collection, and explicitly disables OpenRouter response caching. These request settings do not guarantee provider compliance or exclude operational logs, abuse monitoring or transient prompt caches. No EU-only inference endpoint is currently pinned; processing outside the EEA is possible. Model, token, latency and cost metadata may remain. The agreements and transfer safeguards applicable to the actual subprocessing chain are being reviewed separately. Further information: OpenRouter DPA, ZDR and Response caching.

Within CueBot, only authorized project members and administrators receive access according to their role. Further disclosure occurs only under a legal obligation or appropriate legal basis.

5. Retention and deletion

• Access tokens are valid for at most 15 minutes; sessions and refresh tokens for at most 30 days. Sign out, password or role changes, and account deactivation may revoke sessions earlier.
• Invitation links are generally valid for seven days. Revoked, expired and accepted invitation records may be retained as evidence of permissions, security and legal claims.
• Current project and account data is kept during use. Authorized administrators can delete accounts, removing profile, credentials and active memberships.
• Sync revisions, acknowledgements, tombstones, pseudonymous IDs and audit events may be retained longer where necessary for reliable offline synchronization, integrity, abuse prevention or legal claims.
• Shared video files are stored until replaced or sharing ends, then permanently deleted. Version metadata may remain as integrity evidence.
• Encrypted AI provider responses are normally kept at most 24 hours and, by technical configuration, never longer than seven days for safe retries. Quotes, cost, credit and audit records may be kept longer in accordance with contractual, billing, integrity and limitation requirements. The linked data policies also apply to provider processing.
• Regular encrypted external database and runtime backups without media are retained for up to 30 days under CueBot rotation. Historical manually created local migration dumps are also held with restricted access on the server; a separate deletion rule for this legacy set will follow a verified restore test. Restoring an older state can reintroduce prior deletions or revoked access and requires separate review and reapplication of those decisions.

Where statutory retention duties or concrete legal claims exist, deletion takes place after those duties or claims expire. Relevant criteria are contract duration, project and account status, technical sync integrity, and statutory limitation and retention periods.

6. Your rights

Under the GDPR you may have rights of access, rectification, erasure, restriction, portability and objection. You can withdraw consent with future effect at any time. CueBot makes no solely automated decisions with legal or similarly significant effects.

To exercise your rights, write to info@perspective.events. Proof of identity may be required to prevent unauthorized disclosure.

You may also complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.

7. Security and updates

Measures include TLS, private media files, short-lived signed URLs, role-based permissions, mandatory two-factor authentication for super admins, Argon2 password hashes, hashed tokens, encrypted authenticator and provider secrets, WebAuthn passkeys, CSRF protection, restrictive cookies and security headers. No internet service can guarantee absolute security.

This notice will be updated if functions, recipients or legal requirements change. The current version remains available at this address.