Privacy Policy

• Controller: L&B Creative Ventures Limited, trading as Stage Library
• Company number: 15662245
• Registered office: 10 Dovecote Drive, Borrowash, Derby, DE72 3LS
• Contact for privacy matters: hello@stagelibrary.co.uk

We have not appointed a Data Protection Officer; we are not required to do so.

Account and sign-in data. When you create an account or sign in, we process your email address and the authentication records needed to keep you signed in. Sign-in is passwordless: we email you a secure link or code rather than storing a password.

Organisation details. When you buy a licence we collect the organisation name and type, and the organisation address (address lines, city, county, postcode and country) supplied at checkout.

Order, purchase and licence data. We record your first and last name, email address, telephone number, the show purchased, the price paid in GBP, the order status, the licence created (start and end dates) and the resulting access grant to My Library.

Payment data. Card payments are taken by Stripe on Stripe-hosted checkout pages. We never see or store your full card details. We receive from Stripe the payment status and the identifiers for the checkout session and payment.

My Library usage data. When you download a script or resource we log which resource was accessed, the related licence and show, your account identifier and the time of access. This protects licensed material and helps us investigate misuse.

Contact enquiries. When you use the contact form we collect the name, email address, organisation (if given), subject and message content you submit.

Newsletter signups. If you submit the footer signup form we store your email address with MailerLite, recorded with the source “Stage Library website footer”.

Transactional email records. When your licence is confirmed we create a record containing the recipient email address, subject and the order and licence details used to build that email.

Technical and security data. Our hosting and database providers process standard technical information such as IP address, request details, browser user-agent, and error and security logs, as part of serving and protecting the site.

• To create and operate your account and sign you in securely — performance of a contract with you, and our legitimate interests in securing accounts.
• To take payment, process orders and issue your 12-month performance licence — performance of a contract.
• To give and control access to scripts and resources in My Library — performance of a contract, and our legitimate interests in protecting licensed content from misuse.
• To send transactional emails such as sign-in links and licence/order confirmations — performance of a contract.
• To respond to enquiries you send us — our legitimate interests in answering people who contact us (or steps prior to a contract).
• To send marketing emails and newsletters — your consent, given when you sign up.
• To keep accounting and tax records of sales — compliance with a legal obligation.
• To keep the site secure, prevent fraud and diagnose faults — our legitimate interests in running a safe, working service.

Where we rely on legitimate interests, we have considered the impact on you and only process data in ways you would reasonably expect.

We do not use advertising cookies, analytics cookies or third-party tracking on stagelibrary.co.uk.

We use strictly necessary storage only: a secure session token kept in your browser so you stay signed in to your account and My Library. Stripe may set its own strictly necessary cookies on its hosted checkout pages to process your payment and prevent fraud — those are described in Stripe’s own privacy policy.

We do not sell your personal data. We share it only with the service providers we need to run Stage Library, each acting under contract:

• Stripe — payment processing and hosted checkout. Receives your name, email address and order details in order to take payment.
• Supabase — the database, authentication and file storage behind Stage Library, hosting your account, order, licence, enquiry and access-log records.
• Lovable — the platform that builds, hosts and serves the Stage Library website and its server-side functions.
• MailerLite — our newsletter and marketing email platform, which stores the email addresses of newsletter subscribers. MailerLite is used for marketing email only.
• MailerSend — our transactional email provider, used to deliver service emails such as sign-in links, order confirmations and licence details.

We may also disclose personal data to our professional advisers, or to a public authority or regulator, where we are legally required to do so.

We keep marketing and service email separate: newsletter subscribers are held with MailerLite, while emails about your orders, licences and account are sent through MailerSend.

Some of our providers, including Stripe and Lovable, are based outside the UK or may process data outside the UK. Where personal data is transferred outside the UK, that transfer is protected by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or by a UK adequacy decision covering the destination country.

You can ask us for more detail about the safeguards applying to a particular transfer by emailing hello@stagelibrary.co.uk.

• Orders, payments, licences and accounting records: six years from the end of the relevant company financial year, or longer where the law requires it.
• Account and organisation details: kept while your account is open, then deleted or anonymised on request, except where we must retain purchase records under the period above.
• Resource and download access logs: kept for the duration of the related licence plus two years.
• Contact enquiries: two years after our last interaction with you about the enquiry.
• Technical and security logs: twelve months, unless retained longer for a security investigation or where the law requires it.
• Newsletter data: until you unsubscribe, or until we remove inactive subscriber data in line with our retention practices.

When data is no longer needed we delete it or remove the details that identify you.

The site is served over HTTPS. Account data is protected by row-level database security so that you can only see your own orders, licences and library access. Scripts and resources are held in private storage and released through short-lived signed links that only an entitled, signed-in customer can request.

Payment credentials never reach our systems: card details are entered directly on Stripe’s hosted checkout. Payment confirmations are accepted only from Stripe webhook messages whose cryptographic signature we verify.

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to erase data where we no longer need it;
• ask us to restrict or object to certain processing;
• ask for your data in a portable format; and
• withdraw consent at any time where we rely on consent, without affecting processing already carried out.

To exercise any of these rights, email hello@stagelibrary.co.uk. We will respond within one month. Note that we may need to keep order and licence records even after an erasure request, in order to meet legal obligations and to evidence the rights granted under a licence.

We only send marketing emails to people who have asked to receive them. You can unsubscribe at any time using the link in any marketing email, or by emailing hello@stagelibrary.co.uk.

Opting out of marketing does not stop essential service emails about your orders, licences and account, which we must send to fulfil our contract with you.

If you are unhappy with how we have handled your personal data, please contact us first at hello@stagelibrary.co.uk so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority: ico.org.uk, or by telephone on 0303 123 1113.

We may update this notice from time to time, for example if we add a new service provider. The date at the top of this page shows when it was last updated.