1. Who controls your information

Showden is the controller for the personal information described here. Email privacy@showden.co.uk or write to 21 East Central Apartments, Walthamstow, E17 9GY, United Kingdom.

2. Information we collect

• Account details, age-eligibility and terms evidence, profile image, sign-in provider, and verification state.
• Preferences and activity, including city, watchlists, ratings, bookings, reviews, votes, predictions, event responses, and communications choices.
• Community content, room membership, messages, threads, comments, reports, blocks, appeals, and moderation records.
• AI prompts, responses, recommendations shown, feedback, and conversation identifiers when you use AI features.
• Safety-report details, the reported page, category, report reference, and an email only when follow-up is requested.
• Security data, including pseudonymised request and device fingerprints, audit events, and rate-limit records.

We receive most information from you. Google can provide account data when an already-linked user signs in; TMDB and cinema, streaming, showtime, or event providers supply title and availability data. Do not put sensitive personal information into prompts or public posts unless it is necessary for a safety report.

3. Purposes and lawful bases

• Contract: create and secure accounts and provide requested discovery, planning, community, AI, event, and booking features.
• Consent: optional analytics, local personalisation, location access, and marketing communications.
• Legitimate interests: prevent abuse, moderate content, investigate reports, improve reliability, and understand service performance where those interests are not overridden.
• Legal obligation and substantial public interest where applicable: respond to rights requests, protect children, handle potentially illegal content, preserve required evidence, and cooperate with lawful authorities.

Consent can be withdrawn in Settings. Withdrawal does not affect earlier lawful processing. We assess necessity, impact, and safeguards before relying on legitimate interests.

4. AI, recommendations, and moderation

Showden uses preference, activity, community, and availability signals to rank titles and explain recommendations. AI prompts and relevant Showden context are sent through OpenRouter to the selected model provider to generate a requested response.

Automated checks may restrict spam or clearly unsafe submissions, or send content for human review. These tools do not make decisions intended to produce legal or similarly significant effects. Use the Safety page to report or challenge an outcome.

5. Providers, recipients, and transfers

Depending on enabled features, recipients include Vercel for hosting and consent-gated measurement; Supabase for database, storage, and realtime services; Google for linked sign-in and consent-gated Maps; Resend for email; OpenRouter and selected model providers for user-initiated AI; and title, cinema, streaming, showtime, event, and ticket providers.

We share only what is needed for the service and do not sell personal information. A third-party checkout is governed by the identified seller's notice. Where information leaves the UK, we require an adequacy basis or appropriate safeguards, such as the UK IDTA or UK Addendum, where applicable. Ask the privacy contact for details relevant to your data.

6. Cookies, browser storage, and optional services

Essential storage operates without optional consent because it secures the service or remembers a feature you request. Refusing optional purposes is as easy as accepting them. Change choices in Settings.

7. Retention

• Verification and password-reset tokens are deleted after expiry; expired pseudonymised rate-limit counters are routinely deleted.
• Identifiable AI interaction records are anonymised after 90 days and product feedback after 12 months.
• Consent evidence, audit events, privacy-request evidence, and identifiable moderation or safety-report details are kept for up to three years, then deleted or anonymised.
• Account, preference, booking, and community data is normally kept while the account remains active.

Deletion removes or anonymises direct identifiers and private records. Public discussion content is redacted to preserve conversation integrity. Limited evidence may be retained longer when necessary for a legal claim, safeguarding, fraud prevention, or a valid legal hold.

8. Your rights

You may have rights to access, correction, deletion, restriction, portability, objection, and withdrawal of consent. You may also opt out of communications. Signed-in users can use Settings and the privacy-request controls; otherwise email privacy@showden.co.uk. We normally respond within one month and may verify identity.

9. Children and age-appropriate privacy

Accounts are for people aged 13 or over. We ask only for a broad age group, not a date of birth. Optional analytics, personalisation, and location processing stay off when no eligible age group has been confirmed and for anyone selecting under 13. Users aged 13 to 17 receive the same high-privacy defaults and can change optional choices deliberately.

A parent, guardian, or affected person can contact privacy@showden.co.uk or use the public safety report about a child's information or safety.

10. Security and incidents

Controls include encrypted transport, password hashing, one-time account tokens, access controls, request validation, rate limits, audit logging, private database policies, and security monitoring. No online service is risk-free. We investigate incidents and notify affected people or the ICO when the applicable threshold is met.

11. Complaints and changes

Contact privacy@showden.co.uk first so we can investigate. You may also complain to the UK Information Commissioner's Office. We update this notice when processing changes materially and request fresh consent where required.