Privacy Policy

Last updated 2026-10-27

1. Who is responsible for what

• Account data (showpath is the controller). When someone visits this site, creates an account, or uses showpath as a User, the company that operates showpath decides how that account and usage data is handled. This policy applies to it directly.
• Customer Data (showpath is the processor). When a company uses showpath to record conversations, scan badges, take notes and follow up with prospects, that company is the controller of the data it captures. showpath processes it only on the company’s behalf and instructions. If you met a showpath customer at an event and want to know what they hold about you or how they use it, please contact that company; their privacy notice applies. We will help them respond.

2. Data we collect about Users

• Account details: name, work email, company, password hash or the identity returned by a sign-in provider (Google or Microsoft, when enabled).
• Recording attestation: the version of the attestation a User accepted, when, and the IP address and browser that accepted it.
• Settings: preferences such as audio and badge-photo retention, automatic assignment, automatic sending and writing rules.
• Usage and device data: logs of requests and actions (including an audit trail of changes), IP address, browser type and timestamps, used to run, secure and bill the service.
• Connected accounts: if a User connects a mailbox or calendar, the access tokens needed to send messages and create events on their behalf.
• Cookies: we use cookies that are strictly necessary for sign-in and security. We do not use advertising cookies.

3. Customer Data we process for customers

Depending on how a customer uses showpath, Customer Data can include:

• Audio of sales conversations (at a booth, on a visit or in a meeting) a User chose to record, and the transcripts made from it;
• Notes and summaries generated from transcripts, and the links between a conversation and an event, account, opportunity or contact;
• Badge details read from a QR code, typed in, or extracted from a badge photo (name, title, company, email, phone and similar);
• Contact and company details, including details added by optional enrichment providers or read from a company’s public website;
• Follow-up drafts (emails, tasks, calendar holds) and the messages a User sends through a connected account.

Which of these are collected, and why, is decided by the customer. Customers are responsible for having a lawful basis, giving notice, and obtaining recording consent where required (see our Terms).

4. How we use data

• To provide the service: authenticate Users, store and process Customer Data, run the AI features a customer uses, and send what a User approves.
• To secure the service: tenant isolation, abuse prevention, audit logs, and investigating incidents.
• To support, bill and communicate with customers about their account and changes to the service.
• To understand aggregate, de-identified usage and improve showpath.
• To meet legal obligations.

Where the law requires a legal basis for account data, we rely on performance of our contract with the customer, our legitimate interests in running a secure and useful service, and legal obligations. We do not sell personal data, share it for cross-context behavioral advertising, or use Customer Data to train AI models.

5. Who we share data with

• Sub-processors that host the service, store data and run AI models, listed with what each one processes on our AI processing and sub-processors page.
• Providers a customer turns on, such as optional enrichment providers or the mailbox and calendar a User connects. These act under the customer’s own relationship with them.
• Authorities or others where the law requires it, or to protect rights, safety and the service.
• A successor in a merger, acquisition or sale of assets, subject to this policy.

6. How long we keep data

• Audio is deleted after transcription by default. If processing fails it is held for at most 24 hours while it is retried. A customer may choose to keep audio for a set period, and a User may opt in within that policy.
• Badge photos are discarded after the details are extracted, by default. The same customer policy can keep them for a set period.
• Transcripts, notes, contacts and other Customer Data are kept while the customer’s workspace is active, until the customer deletes them, or until the customer asks us to delete them. After a workspace closes we delete Customer Data on the timeline the customer chooses; backups expire on their normal cycle.
• Account and audit data is kept for as long as the account exists and as needed afterwards for security, billing and legal purposes.

7. Where data is processed

showpath is hosted in the United States. Some AI models we route to are operated by providers located, or serving requests, outside the United States. We enable zero data retention (ZDR) for every customer and User by default: every AI request is routed only to providers that have agreed not to store or log the content of requests and responses, and a request is refused rather than sent anywhere that has not. See the AI processing page for the providers and what each one receives. Where the law requires safeguards for international transfers, we will put appropriate contractual measures in place with customers and sub-processors.

8. Security

We use measures appropriate to a business service of our size, including encryption in transit, row-level isolation between customer workspaces in our database, access controls, and an audit trail of changes. No system is perfectly secure. We will notify affected customers without undue delay if we become aware of a breach affecting their data. We do not currently hold third-party security certifications.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to complain to a data protection authority. Users can contact us at legal@showpath.dev. For Customer Data, contact the company that captured it; if you contact us instead, we will pass your request to that company. We will not discriminate against anyone for exercising their rights.

10. Children

showpath is a business tool and is not directed at children. showpath is for people aged 18 and over. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We will post changes here and update the date above. If a change is material, we will notify customers before it takes effect.

12. Contact

Email legal@showpath.dev.