Privacy Policy

1. Overview

ShowBuzz ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, process, use, and disclose personal data when you access showbuzzott.com (the "Platform").

This policy is designed to comply with the Indian Digital Personal Data Protection Act, 2023 (DPDP Act); the European Union General Data Protection Regulation (GDPR) and UK GDPR; the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA); the Video Privacy Protection Act (VPPA); and the Children's Online Privacy Protection Act (COPPA).

2. Who We Are

ShowBuzz operates as the Data Controller (EU/UK), Data Fiduciary (India), and Business (California) responsible for personal data collected through showbuzzott.com.

For all privacy matters: showbuzzott@gmail.com

3. Information We Collect

We collect the following categories of personal data:

• Account data — Name and email address when you sign in via Google OAuth
• Contact data — Name, email, and message content when you write to us
• Technical data — IP address, approximate geolocation, browser type, device type, operating system, referral URLs, session duration, page interactions, and performance metrics
• Activity data (signed-in users only) — Watch history, watch progress (resume position), watchlist, and ratings (likes/dislikes)

Technical data is collected automatically via server logs for performance and security purposes. Activity data is collected only for signed-in users and is used solely to provide our service.

4. Legal Basis for Processing (GDPR — EU/UK)

We process personal data only where a lawful basis applies under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)) — To provide authentication, watch history, watchlist, and progress-saving features you have requested
• Legitimate interests (Art. 6(1)(f)) — To maintain platform security, prevent abuse, and improve performance
• Consent (Art. 6(1)(a)) — When you choose to contact us via email

5. How We Use Your Data

We use collected data to:

• Authenticate your identity and maintain your signed-in session
• Save and sync watch progress, watchlist, and ratings across your sessions
• Improve content delivery speed and platform performance
• Monitor and prevent security threats and abuse
• Respond to your inquiries and support requests

We do not sell, trade, or rent your personal data to any third party.

6. Video Viewing Records (VPPA — United States)

In compliance with the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710, ShowBuzz does not knowingly disclose personally identifiable information about your video viewing history to any third party without your prior, informed, written consent.

Your watch history is stored privately in your Firestore account and is not accessible to or shared with any third party. We retain video viewing records only as long as necessary to provide our service or as required by law.

7. Cookies & Tracking Technologies

We use the following technologies on the platform:

• __session cookie (HttpOnly, Secure, SameSite:Lax) — A strictly necessary session authentication cookie, valid for 5 days from sign-in. It does not contain personally identifiable content.
• Browser Local Storage — Used to store watch progress and preferences within your browser.

We do not use advertising, analytics, or third-party tracking cookies. Our session cookie is strictly necessary for authentication and does not require separate consent under the ePrivacy Directive. You may disable cookies in your browser settings; however, sign-in and related features will stop working.

8. Third-Party Data Processors

We share minimal personal data with the following processors, each contractually bound to protect your data:

• Google Firebase / Google LLC (United States) — Authentication, session management, and Firestore database. Governed by Google's Privacy Policy and Data Processing Terms.
• Sanity.io (United States) — Content management system for movie metadata. No personal user data is stored in Sanity.
• Vercel Inc. (United States) — Website hosting and serverless computing. Server access logs may include IP addresses.
• Bunny.net (Slovenia) — Content delivery network for video streaming.

9. International Data Transfers

ShowBuzz is operated from India. Your data may be transferred to and processed in the United States (Google Firebase, Vercel) and Slovenia (Bunny.net).

For EU/UK users: Transfers to the United States are made pursuant to Standard Contractual Clauses (SCCs) adopted by the European Commission and maintained by Google, Vercel, and other processors.

For Indian users: Cross-border data transfers are conducted in accordance with the DPDP Act, 2023, to countries providing an adequate level of data protection or under applicable safeguards.

10. Data Retention

We retain personal data only as long as necessary for the purpose it was collected:

• Session cookies — 5 days from sign-in, or until you sign out
• Watch history, watchlist, progress, and ratings — Until you request deletion or we delete your account
• Server access logs — Deleted within 90 days
• Contact correspondence — Up to 12 months, unless a longer period is required by law

11. Your Rights — India (DPDP Act, 2023)

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access — Request a summary of the personal data we process and the purposes for which it is used
• Right to correction — Request that inaccurate or incomplete personal data be corrected or updated
• Right to erasure — Request deletion of your personal data where the purpose of collection has been fulfilled or consent has been withdrawn
• Right to grievance redressal — File a complaint with our designated Grievance Officer (see Section 16)
• Right of nomination — Nominate another person to exercise your rights on your behalf in the event of death or incapacity

To exercise these rights, contact our Grievance Officer at showbuzzott@gmail.com. We will respond within 30 days.

12. Your Rights — European Union & UK (GDPR)

If you are located in the EU or UK, you have the following rights under the GDPR:

• Right of access (Art. 15) — Obtain a copy of the personal data we hold about you
• Right to rectification (Art. 16) — Correct inaccurate or incomplete data
• Right to erasure (Art. 17) — Request deletion of your data ('right to be forgotten') where it is no longer necessary
• Right to restrict processing (Art. 18) — Pause processing while a dispute is under review
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format
• Right to object (Art. 21) — Object to processing based on our legitimate interests
• Rights related to automated decision-making (Art. 22) — We do not make automated decisions that produce legal or significant effects on you

You also have the right to lodge a complaint with your national data protection supervisory authority. To exercise any of these rights, contact showbuzzott@gmail.com. We will respond within 30 days.

13. Your Rights — United States (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA and CPRA:

• Right to know — Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete — Request deletion of your personal information, subject to certain legal exceptions
• Right to correct — Request correction of inaccurate personal information we hold about you
• Right to opt-out of sale or sharing — We do not sell or share your personal information with third parties for advertising or commercial purposes
• Right to limit use of sensitive personal information — We do not use sensitive personal information beyond what is necessary to provide the service
• Right to non-discrimination — We will not discriminate against you for exercising any CCPA/CPRA right

To submit a rights request, contact showbuzzott@gmail.com. We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf.

14. Children's Privacy

United States (COPPA): ShowBuzz does not knowingly collect personal data from children under 13. If we discover that a child under 13 has created an account, we will delete their data promptly.

India (DPDP Act, 2023): We do not knowingly process personal data of individuals under 18 without verifiable parental or guardian consent. Users under 18 must obtain parental consent before creating an account.

EU/UK (GDPR): Processing personal data of children under 16 (or the applicable age in your member state, minimum 13) requires parental or guardian consent.

If you believe a child has registered without appropriate consent, contact showbuzzott@gmail.com immediately.

15. Data Security

We implement technical and organizational measures to protect your data, including HTTPS encryption, HttpOnly and Secure cookie flags, Firestore security rules, access controls, and regular security reviews.

Despite these measures, no method of internet transmission is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and, where required, the relevant supervisory authority within the timeframes required by applicable law (72 hours under GDPR).

16. Grievance Redressal Officer (India — DPDP Act, 2023)

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, ShowBuzz has designated a Grievance Officer for data-related complaints from users in India:

• Designation: ShowBuzz Grievance Officer
• Email: showbuzzott@gmail.com
• Response time: Within 30 days of receipt of complaint

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page. Your continued use of ShowBuzz after changes are posted constitutes acceptance of the updated policy.

18. Contact Us

For privacy inquiries, rights requests, or data-related concerns, contact us at:

showbuzzott@gmail.com