Privacy Policy

This Privacy Policy describes how Showpane (“we,” “us,” or “our”) collects, uses, and shares information when you use our websites, cloud services, CLI tools, APIs, billing, and support channels (collectively, the “Services”).

If you self-host Showpane on your own infrastructure, your client portal data stays entirely on your servers. The only interaction with our systems is the initial npx showpane install (which downloads from npm and clones from GitHub) and optional Cloud upgrade.

Account and organization details

Name, email address, organization name, and role when you sign up for Showpane Cloud via Clerk.

Authentication

We use Clerk for authentication. Sign-in via email or Google OAuth. Session tokens are stored as secure cookies. We do not store passwords for Cloud accounts.

Billing and subscription

Payment processing is handled by Stripe. We store your Stripe customer ID and subscription status. We do not store full card numbers.

Usage and analytics

Portal engagement data: page views, section visibility time, tab switches, file downloads, and visitor sessions. Visitor tracking uses a first-party UUID cookie (sp_visitor) with no personally identifiable information.

Portal content

Portal pages, uploaded files, and client credentials (hashed) that you create through the Services. For Cloud users, this data is stored in our Supabase database and Vercel-hosted deployments.

Infrastructure data

IP addresses, subdomain assignments, deployment status, and provisioning state for Cloud portal hosting.

• Provide, operate, and maintain the Services
• Process billing and manage subscriptions
• Send transactional emails (welcome emails, activity alerts)
• Generate engagement analytics for portal operators
• Prevent abuse and enforce rate limits
• Improve the Services based on usage patterns
• Comply with legal obligations

We do not sell your personal information. We share data with the following service providers who process it on our behalf:

• Clerk — authentication and user management
• Stripe — payment processing
• Supabase — database hosting
• Vercel — application and portal hosting
• Resend — transactional email delivery

We may also share information with professional advisors, in connection with a business transfer, or as required by law.

• Authentication cookies — secure session tokens set by Clerk
• Portal session cookies — client_auth cookie for portal access (HMAC-signed, 7-day expiry)
• Visitor tracking cookie — sp_visitor first-party UUID cookie (30-day expiry, no PII)

You can control cookies through your browser settings, though disabling them may affect functionality.

We retain your data for as long as your account is active or as needed to provide the Services. Engagement analytics are retained for 1 year on Cloud plans and 30 days on self-hosted.

After subscription cancellation, portal data is retained for 90 days before deletion. You are responsible for exporting your data before this period ends.

We implement reasonable safeguards including encrypted connections (TLS), hashed credentials (bcrypt), HMAC-signed tokens, row-level security policies, and constant-time comparisons for sensitive operations. No system is perfectly secure, and you are responsible for protecting your account credentials.

• Access, correct, or delete your account information at any time
• Export your portal data before cancellation
• Choose self-hosted deployment to keep all data on your own infrastructure
• Request data deletion by contacting us

Additional rights may apply depending on your jurisdiction.

Your information may be processed in countries other than your own. By using the Services, you consent to the transfer of your information to these countries.

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13.

We may update this policy from time to time. We will update the effective date and may notify you of material changes via email or in-product notice.

For questions about this Privacy Policy or to exercise your data rights, contact us at privacy@showpane.com.