Legal
Privacy Policy
This policy explains how ShowDocLive (“we”, “us”) handles personal data when you use showdoclive.com and related share or contributor links. We process personal data in line with the UK GDPR and the Data Protection Act 2018.
1. Who we are
The data controller is the operator of the ShowDocLive service at showdoclive.com. Contact: info@showdoclive.com.
2. Data we collect
Account
Name, email address, password hash (we never store your password in plain text), optional passkeys, plan and credit balance, and timestamps such as last active and email verification.
ShowDocs and collaboration
ShowDoc titles, section content, pasted URLs, contributor invites, access requests, and share-link settings. If you put names, phone numbers, call times, or other personal data into a ShowDoc, we store it as content you asked us to host.
Payments
If you subscribe or buy credits, Stripe processes your payment details. We keep Stripe customer and subscription identifiers, plan status, and enough records to fulfil the purchase and deal with tax or disputes. We do not see full card numbers.
AI features
Dictation sends audio you record to xAI for speech-to-text. Format & Tidy sends the relevant ShowDoc text to xAI. We keep usage amounts (credits spent, feature, time) so we can bill fairly. We do not keep the audio after the request finishes.
Technical data
Sign-in cookies, a cookie that stores these privacy choices, optional preference storage (theme), and server logs (which may include IP address, user agent, and error details).
Grok Bot connector (optional)
On Pro and Team plans you can connect Grok Bot, xAI’s AI assistant, or another assistant that supports the Model Context Protocol (MCP), to your account. The connection runs through our connector at mcp.showdoclive.com. Nothing is shared until you sign in to ShowDocLive and approve the assistant on our consent screen.
- What the assistant can access — only the actions listed on the consent screen and on your Grok Bot page (mcp.showdoclive.com/grokbot): reading your ShowDocs, templates, rundowns, schedules, diagrams, attachments and share status; and, if you approve write access, creating and editing ShowDocs, sections, rundowns, schedules and diagrams, attaching files (to Fast Storage or your connected Google Drive, whichever you choose), managing share links, and running Format & Tidy (which spends your AI credits). It acts as you, within your plan. It can never change your email, password, billing, team membership or white-label settings, or delete your account.
- What the connector stores — your ShowDocLive account id, name and email; each assistant you approved (its name, the permissions you granted, when you approved it and when it was last used); OAuth access and refresh tokens, stored only as one-way hashes; your on/off setting for each action; and any feedback you or your assistant send. Feedback from an assistant is sent only after you agree to it, and records the category, the type of issue, the related action, a title, what you tried, what was missing or awkward, a suggested change, the page or area it was about, severity, a summary, an optional short quote, its review status (pending, approved or rejected), the assistant’s name and client id, the time, and the names and success or failure of the last few actions in that session (never their arguments or results). It also records which version of the connector’s action list each assistant last confirmed, so it can tell the assistant to refresh after an update. When an assistant uploads a file it gets a one-time upload link (valid up to 15 minutes); the connector keeps a record of that upload (file name, expected size and checksum, target, status) for up to 24 hours, while the file itself streams straight through to ShowDocLive and is not kept by the connector. It also briefly keeps sign-in state (up to 15 minutes) and a page session for your Grok Bot page (up to 8 hours). The connector does not keep copies of your ShowDoc content: each action is passed straight to ShowDocLive and the result goes back to the assistant.
- Tokens — the assistant receives an access token that lasts 1 hour and a refresh token that lasts up to 30 days and changes every time it is used. If an old refresh token is reused, we revoke the whole chain.
- Your controls — on your Grok Bot page you can switch individual actions on or off (risky actions such as deleting a rundown start switched off), see your feedback, and disconnect any assistant. Disconnecting revokes its tokens straight away. You can also remove the connector inside Grok Bot.
- Feedback — we read it to improve ShowDocLive and may reply by email. We do not use it for marketing.
When you use Grok Bot, the questions you ask it and the ShowDoc content its actions return are processed by xAI (and the service providers xAI uses to run Grok Bot) under xAI’s own terms and privacy policy. For this, xAI is a separate service that you choose to use, not a processor acting on our instructions.
Crew and visitors
Crew who only open a share link do not need an account. We may set a strictly necessary cookie so a password-protected short link stays unlocked, and we store the cookie consent described in the Cookie Policy.
3. Why we use it (legal bases)
- Contract — create and run your account, host ShowDocs, share and contributor links, dictation, Format & Tidy, credits, and support.
- Legitimate interests — keep the service secure, prevent abuse, diagnose faults, and understand how the product is used at a coarse level. We do not use this basis to override your cookie choices.
- Consent — optional cookies (preferences, and any future analytics or marketing). You can withdraw it at any time via Cookie settings.
- Legal obligation — keep billing records where tax or accounting rules require it.
4. Who we share it with
We do not sell personal data. We use processors who only see what they need:
- Stripe — payments and subscriptions.
- xAI — dictation audio and Format & Tidy text, only when you use those features.
- Grok Bot (xAI) and other assistants you connect — only if you connect one and only for the actions you allow: the ShowDoc content and account details (name, email, plan, credit balance) its actions return, under the assistant provider’s own terms (see Grok Bot connector).
- MXRoute — transactional email (verify address, reset password, billing notices).
- Hosting — the servers and database that run ShowDocLive.
Crew and contributors you invite can see ShowDoc content you share with them. Anyone who has a live share URL can read that ShowDoc until you regenerate or disable the link. Treat that URL like a password.
We may disclose data if the law requires it, or to protect the service, our users, or other people.
5. International transfers
Some processors and services (including Stripe, xAI and Grok Bot) may handle data in the United States or other countries. Where the UK GDPR requires a safeguard, we rely on the provider’s appropriate mechanism (such as the UK Extension to the EU-US Data Privacy Framework where they participate, or standard contractual clauses).
6. How long we keep it
- Account and ShowDocs — until you delete them. Account deletion has a 24-hour grace period, then we erase the account and associated ShowDocs, credits, invites, and Grok Bot connections.
- Grok Bot connector — assistant approvals until you disconnect the assistant; hashed tokens until they expire (1 hour for access, up to 30 days for refresh, even if revoked sooner), then they are purged within a day; upload records up to 24 hours (sooner if you disconnect the assistant); action settings, feedback and the last confirmed action-list version until you delete your account, when the connector erases everything it holds about you. Diagrams, schedules and attached files are part of your ShowDocs and follow the Account and ShowDocs rule above.
- Stripe identifiers — removed when we delete the Stripe customer as part of account deletion, except records we must keep for tax.
- Session cookies — short-lived access token; refresh cookie up to 14 days idle / 30 days absolute.
- Cookie choices — up to 6 months, then we ask again.
- Security logs — a limited period, then discarded.
7. Special category data
We do not ask for health, accessibility, or other special category data. Show ShowDocs sometimes include it (for example an accessibility rider). If you put that in a ShowDoc, you are the controller of that content for your crew; you must have a lawful basis to share it. We host it as your user content under the contract.
8. Your rights
Under UK GDPR you can ask us to:
- access the personal data we hold about you
- correct it
- erase it (including by deleting your account in Settings)
- restrict or object to certain processing
- receive a copy (data portability) where the basis is contract or consent and the processing is automated
- withdraw consent for optional cookies, without affecting processing that already happened
- stop an assistant’s access at any time by disconnecting it on your Grok Bot page
Email info@showdoclive.com. You can also complain to the Information Commissioner’s Office at ico.org.uk.
9. Children
ShowDocLive is for adults running shows. You must be 18 or over to create an account.
10. Security
We use HTTPS, hashed passwords, httpOnly refresh cookies, and access control on ShowDocs. Grok Bot connector tokens are stored hashed. Each action uses a separate token that lasts 2 minutes and works only for that action’s request. No method of transmission or storage is perfectly secure. Do not put secrets in a share URL you cannot rotate.
11. Cookies
See the Cookie Policy for the list, purposes, and how to change your choices. You can open Cookie settings from the footer on any page.
12. Changes
We will update this page when our practices change and bump the version date above. If a change is material, we will also note it in the product or by email where we have a working address.