# Privacy Policy | ShowsUp > How ShowsUp collects, uses and protects personal data. Source: https://showsup.ai/privacy # Privacy Policy Effective date: 6 November 2026 Updated 6 November 2026: Upshow is now called ShowsUp, and our website moved from upshow.co.uk to showsup.ai. Two things changed with it. You can now see and edit your calendar events in ShowsUp, including events from calendars other than your main one (section 2). And our marketing site is now separate from the app, so the visitor identification in section 8 can run there even if you have a ShowsUp account. The company behind ShowsUp has not changed. ## 1\. Who we are ShowsUp is operated by Pipeline Engine Ltd, registered in England and Wales. When we say "ShowsUp", "we", "us", or "our" in this policy, we mean Pipeline Engine Ltd. Contact us at [jonny@showsup.ai](mailto:jonny@showsup.ai). ShowsUp plays two different roles. For your own account information (your name, email, company, billing) we are the data controller. For the information you bring into ShowsUp about your meeting attendees (their names, emails, phone numbers, and whether they joined a call) we act as a data processor on your behalf: you decide why that data is processed, and you are responsible for having a lawful basis and for telling those attendees how their data is used. Our responsibilities as your processor are set out in our [Data Processing Agreement](https://showsup.ai/dpa). ## 2\. What data we collect We collect the minimum data necessary to operate the reminder service: - **Account data:** name, email address, company name, and password when you sign up. - **Calendar data:** meeting titles, times, attendee names and emails from your connected calendar (Google Calendar or Microsoft Outlook). We read this to schedule reminders and to show you your events. If you edit an event in ShowsUp, we write that change (title, time, location, description or guests) back to the calendar, only when you ask us to. - **Your list of calendars:** if you choose to have more than one calendar checked for busy time, we store the name of each calendar and which ones you have switched on. Calendar names are shown to you in Settings so you can tell them apart, and nowhere else. From any calendar other than your main one we store the start and end times of events, and for 24 hours after an event ends we also keep its title, location, link, attendees and description so we can show them to you; events marked private, confidential or personal are stored and shown like any other, to the account owner and to any agency managing the account. We only send our own messages to people on events from those calendars if you choose to add a reminder sequence to that event. If you choose to notify guests when you edit an event, Google or Microsoft sends that update on your behalf, and Outlook always emails guests about changes. - **Meeting attendance data:** whether a participant joined a Google Meet, Microsoft Teams, or Zoom call. We check join status only. We do not record meeting content, audio, video, chat, or transcripts. - **Contact details:** attendee names, email addresses, and phone numbers for sending reminders. - **OAuth tokens:** encrypted access and refresh tokens for Google, Microsoft, and Zoom integrations. These are stored encrypted at rest and never exposed in API responses. - **Usage data:** token balance, reminder delivery status, and template content you create. - **AI voice call data:** when you use AI voice reminders, our voice provider generates a transcript of the call so the agent can hold a conversation. Calls made by our current voice agent are never recorded as audio — only the call transcript is kept, and it is deleted 30 days after the meeting it relates to. This is separate from meeting recordings: we never access recordings, audio, video, chat, or transcripts of your actual meetings. - **Replies to reminders:** when an attendee replies to a reminder we sent on your behalf, their reply is delivered to an ShowsUp reply address. We store the sender's address, the subject, the message text, and any attachments, so that we can pass the reply on to you and stop sending further reminders about a meeting they have already answered. We delete the contents of these messages 30 days after we receive them. - **Replies found in your Gmail:** if you switch on reply spotting, we read the Gmail thread of each reminder we sent from your mailbox and, when an attendee replies in it, store the sender's address, the subject and the message text so that we can show you the reply in ShowsUp and stop the remaining reminders for that meeting. We read nothing else in your mailbox. We delete the contents of these messages 30 days after we find them. - **Replies found in your Outlook mailbox:** if you switch on reply spotting for a connected Microsoft account, we read the Outlook thread of each reminder we sent from your mailbox and, when an attendee replies in it, store the sender's address, the subject and the message text so that we can show you the reply in ShowsUp and stop the remaining reminders for that meeting. We read nothing else in your mailbox. We delete the contents of these messages 30 days after we find them. - **Names from your Google contacts:** if you switch this on, when a calendar guest arrives without a name we look their email address up in your Google contacts and store the one name that matches, so reminders can greet them by name. We store nothing else from your contacts. - **Names from your Microsoft contacts:** if you switch this on for a connected Microsoft account, when a calendar guest arrives without a name we look their email address up in your Microsoft contacts and people you work with (via the Graph Contacts and People APIs) and store the one name that matches, so reminders can greet them by name. We store nothing else from your contacts. - **What a reply appears to say:** we read the words of a reply to work out whether it looks like a confirmation, a request to move or cancel, or neither, so that we can tell you which kind of reply arrived. This is a single short label — one of three fixed values — and never a summary or a copy of what was written. We keep the label after the message itself is deleted, because it records that a reply of that kind arrived without keeping the attendee's words. ## 3\. How we use your data - **Send reminders:** email, SMS, and AI voice call reminders to your meeting attendees. - **Check attendance:** determine whether an attendee has joined the meeting so we can send a no-show nudge if they haven't. We check participant join status via the Google Meet REST API, Microsoft Graph API, or Zoom webhooks. We do not access meeting content, recordings, or transcripts. - **Handle replies:** pass an attendee's reply on to you and stop the remaining reminders for that meeting, so nobody is chased after they have already answered. - **Spot replies in your Gmail:** if you switch it on, notice a reply in the thread of a reminder we sent, stop the remaining reminders for that meeting, and show you the reply. This never involves any AI service or other third party. - **Spot replies in your Outlook mailbox:** if you switch it on for a connected Microsoft account, notice a reply in the thread of a reminder we sent, stop the remaining reminders for that meeting, and show you the reply. This never involves any AI service or other third party. - **Tell you what kind of reply arrived:** work out whether a reply looks like a confirmation, a request to move or cancel, or neither, and show that alongside the reply so you can see at a glance which need your attention. The result never changes what we send, pause, or do on your behalf — it is shown to you, and a person decides. - **Manage your account:** billing, authentication, and support. - **Improve the service:** aggregated, anonymised usage patterns. We do not sell or share individual user data. ## 4\. Our lawful bases We rely on the following lawful bases under UK GDPR: - **Performance of a contract,** to create and run your account, authenticate you, and provide the reminder service you signed up for. - **Legitimate interests,** to keep the service secure, to send reminders to your attendees on your instructions, and to improve ShowsUp using aggregated, anonymised usage data. You can object to processing based on legitimate interests at any time. - **Legal obligation,** to meet our tax, accounting, and other legal duties. - **Consent,** for optional things you switch on, such as session replay. You can withdraw consent at any time without affecting anything done beforehand. ## 5\. Google and Microsoft user data ShowsUp's use of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: - We only request scopes necessary for the features you use: sending email (Gmail API), reading replies to the reminders we have sent if you switch on reply spotting (Gmail API, read-only), looking up your calendar guests' names in your Google contacts if you switch that on (People API, read-only), reading and managing calendar events, and changing an event only when you ask us to (Calendar API), listing the calendars on your account so you can choose which ones count as busy time (Calendar API, read-only), and checking meeting attendance (Meet REST API). - Reading your email is limited to the threads of reminders ShowsUp sent on your behalf. We record the Gmail thread identifier when we send a reminder and read only that thread. We do not list, search, scan or index the rest of your mailbox, and messages unrelated to an ShowsUp reminder are never read. - We use what we read in those threads for one purpose only: to notice that someone has replied, stop the remaining reminders for that meeting, and show you the reply in ShowsUp. It is never sent to any AI service or other third party, and we do not use it to write or send anything. - Looking up your contacts reads names and email addresses only. We keep the one name that matches a guest's email address and nothing else, and we never contact anyone from your contacts. - We do not use Google user data for advertising, market research, or profiling. - We do not transfer Google user data to third parties except as necessary to provide the service — for example Twilio for SMS and voice delivery, and Anthropic or OpenAI to generate the wording of a reminder from your calendar event. The content of your email is never transferred. - We do not use Google user data to develop, train, or improve any machine learning or AI model. - We do not allow our staff to read Google user data, except where you have asked us to in order to resolve a support issue, or where we are required to by law. - We store OAuth tokens encrypted at rest using AES-256-GCM. Tokens are never logged, exposed in API responses, or accessible to frontend code. - Meeting attendance checks read participant join status only. We do not access meeting recordings, transcripts, chat messages, or any other meeting content. The same principles apply to a connected Microsoft (Outlook) account: - We only request scopes necessary for the features you use: sending email, reading replies to the reminders we have sent if you switch on reply spotting (Microsoft Graph, read-only Mail.Read), and looking up your calendar guests' names in your Microsoft contacts and the people you work with if you switch that on (Microsoft Graph Contacts.Read and People.Read, both read-only), and reading and changing calendar events, only when you ask us to (Microsoft Graph Calendars.ReadWrite). - Reading your Outlook mailbox is limited to the threads of reminders ShowsUp sent on your behalf. We record the Graph message/conversation identifier when we send a reminder and read only that thread. We do not list, search, scan or index the rest of your mailbox, and messages unrelated to an ShowsUp reminder are never read. - We use what we read in those threads for one purpose only: to notice that someone has replied, stop the remaining reminders for that meeting, and show you the reply in ShowsUp. It is never sent to any AI service or other third party, and we do not use it to write or send anything. - Looking up your Microsoft contacts and people reads names and email addresses only. We keep the one name that matches a guest's email address and nothing else, and we never contact anyone from your contacts. - We do not use Microsoft user data for advertising, market research, or profiling, and we do not use it to develop, train, or improve any machine learning or AI model. - We do not allow our staff to read Microsoft user data, except where you have asked us to in order to resolve a support issue, or where we are required to by law. - We store OAuth tokens encrypted at rest using AES-256-GCM. Tokens are never logged, exposed in API responses, or accessible to frontend code. ## 6\. Third-party services We use the following third-party services to operate ShowsUp: - **Supabase:** database and authentication (primary region: EU, Frankfurt). - **Twilio:** SMS and voice call delivery. - **LiveKit:** routes AI voice calls and runs the AI voice agent, hosted in the EU. LiveKit does not use this data to train its models. - **Deepgram:** converts what the caller says into text (speech-to-text) during an AI voice call. - **Cartesia:** generates what the AI voice agent says (text-to-speech) on an AI voice call. - **Google (Gemini):** via LiveKit Inference, generates what the AI voice agent says on an AI voice call. Google does not use this data to train its models. - **Retell AI (legacy voice agent):** AI voice call agent for accounts not yet moved to LiveKit (generates the call transcript). - **Resend:** delivery of transactional and account emails, and receipt of replies sent to an ShowsUp reply address. - **Anthropic:** generates and checks reminder message content and suggested replies. We send meeting details, the recipient's first name and, for a suggested reply, the text of the reply sent to an ShowsUp reply address that it answers. Anthropic does not use this data to train its models. - **OpenAI:** drafts reminder message content and suggested replies, and reads replies sent to an ShowsUp reply address to pick out what the attendee is asking for, such as a new time. We send meeting details, the recipient's first name and, for those reply features, the text of the reply. OpenAI does not use data sent through its API to train its models. - **PostHog:** product analytics and optional session replay (EU hosting). - **Stripe:** payment processing. We do not store card details. - **GetLeads (Delivr):** identifies business visitors to our public marketing pages. See section 8. - **Cloudflare:** website hosting and DNS. - **Railway:** backend hosting. - **Trigger.dev:** background task scheduling. - **Google Maps Platform (Places):** suggests places as you type a meeting location, and looks up the address of the one you pick. What you type in the location field is sent to Google so it can return matches; we do not keep it or log it. Google processes it under the [Google Privacy Policy](https://policies.google.com/privacy). - **Typesafe:** classifies what a reply sent to an ShowsUp reply address appears to say. The text of the reply is sent so it can be scored. The model returns only a score — it cannot write text, cannot act on your account, and is not trained or improved on what we send it. None of these AI services receives anything we read from your Gmail or Outlook mailbox. We do not sell or share your personal data with any third party for their own purposes. Where a processor is hosted outside the UK or EEA (for example, US-based services), transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) and equivalent UK International Data Transfer mechanisms. ## 7\. AI assistants you connect You can choose to connect an AI assistant, such as Claude or ChatGPT, to your ShowsUp account. When you do, we send that assistant the information it asks for, within the permissions you choose when you connect it. You and the assistant's provider then decide how that information is used, under that provider's own terms. The assistant's provider is not one of our processors, and ShowsUp does not control what it does with the information. Depending on the permissions you choose, this can include: - meeting details, including titles, times and attendees - prospect names, email addresses, phone numbers and company details - your sequences and templates, and reminder messages waiting for your review - the text of SMS and WhatsApp messages between you and your prospects, including their replies - email replies received through an ShowsUp reply address - your account settings, plan, token balance and invoice list - when your calendars are busy (times only, never event titles or attendees) - if you run an agency or team, your clients' and reps' names, email addresses and usage We never send a connected assistant: - the text of replies we read from your Gmail or Outlook mailbox - names that came from your Google contacts An assistant can also make changes for you, within the permissions you choose. Anything that would message a prospect, or change reminders for meetings already booked, waits for your approval in ShowsUp unless you turn that off for that connection. We keep a record of each change an assistant makes, so you can see what it did. You can disconnect an assistant at any time in Settings. It loses access on its next request. Anything it has already received stays with its provider. If you use ShowsUp to contact your own prospects, you are responsible for telling them, where the law requires it, that you may share their details and messages with an AI assistant you choose. ## 8\. Website visitor identification On our public marketing pages only, meaning the home page and the pricing page of showsup.ai and our free resources at showsup.ai/resources (such as the no-show calculator and our reports), we use a visitor identification service provided by GetLeads to work out which businesses are interested in ShowsUp. It never runs anywhere inside the ShowsUp app at app.showsup.ai. Our marketing site is separate from the app and cannot tell whether you are signed in there, so it can run on those marketing pages even if you have a ShowsUp account. On those pages, the service collects: - **Your IP address,** which is matched against third-party business data sources to identify the organisation you are browsing from. Where the provider holds them, this match can also return professional contact details such as a name, job title, work email address and company. - **How you used the page:** the page viewed, the referring site, your browser's screen and window size, clicks and the text of what you clicked, scroll depth, text you copy, file downloads, and how long you stayed. - **Anything you type into a form on those pages,** if you submit one, including the name and email address you enter to unlock one of our free resources. Passwords and payment details are masked before sending, but other field contents, including an email address, are not. - **Advertising identifiers.** The provider may ask your browser to load small tracking images from its advertising partners, which allows those partners to recognise a browser across other websites. The provider's script also attempts to load additional third-party advertising code that would match your browser against a wider identity network, including via hashed email addresses. We block this on every page where the service runs: our Content Security Policy does not permit that code to load, so that matching does not take place on our sites. The lawful basis is our legitimate interest in understanding which businesses are interested in our product and contacting relevant organisations about it. We do not use it to build profiles of individuals, and we do not run it anywhere in the app. You can object at any time, and ask us to delete anything collected about you, by emailing jonny@showsup.ai. To prevent it entirely, most ad and tracker blockers stop it, as does browsing our marketing pages with a VPN. ## 9\. Data retention We retain your data for as long as your account is active. If your account becomes inactive, we email you a warning after 6 months of inactivity and a further reminder shortly before the 12-month mark. After 12 months of continuous inactivity, your account and all associated data are permanently deleted. Any login resets this clock. You can also delete your account at any time from Settings → Danger Zone; doing so deactivates your account immediately and permanently deletes all associated data after 30 days. You can undo the deletion at any point within those 30 days by logging back in. Aggregated, anonymised data may be retained indefinitely. Message content is deleted sooner than the account itself, and while your account is still active: the text of the reminders we send is deleted 30 days after the meeting it relates to, and the contents of any reply we receive are deleted 30 days after we receive it. This includes anything a reply was scored against — the scoring service's full response is deleted on the same clock, because it repeats the text back. The transcript of an AI voice call is deleted on the same 30-day clock, measured from the meeting it relates to; calls made by our current voice agent are never recorded as audio at all. Two things about a reply are kept after its contents go: that it arrived and who it came from in the sense of which meeting it belongs to, and the short label describing what kind of reply it appeared to be. Neither contains what was written. We keep them so your meeting history still shows that an attendee answered, and what kind of answer it was, once the words themselves have been deleted. Zoom data specifically (OAuth tokens and account linkage) is deleted immediately when you disconnect Zoom or uninstall the app; on uninstall we also confirm the deletion to Zoom's Data Compliance API. ## 10\. Your rights Under UK GDPR, you have the right to: - **Access** your personal data. - **Correct** inaccurate data. - **Delete** your data (right to erasure). Contact us or use the in-app account deletion feature. - **Export** your data in a portable format. - **Object** to processing based on legitimate interests. - **Withdraw consent** for optional processing at any time. To exercise any of these rights, email [jonny@showsup.ai](mailto:jonny@showsup.ai). You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We would appreciate the chance to address your concern first, so please contact us before you do. ## 11\. Security OAuth tokens are encrypted at rest using AES-256-GCM. All data is transmitted over HTTPS. Access to production systems is restricted. We follow the principle of least privilege for all integrations and API scopes. ## 12\. Cookies We keep cookies to a minimum. - **Essential cookies:** we use a small number of strictly necessary cookies for authentication (keeping you logged in). These do not require consent. - **Analytics:** we use PostHog to understand how ShowsUp is used. It runs in a cookieless mode, so it does not store cookies or other identifiers on your device, and does not track you across other websites. - **Visitor identification:** on the home and pricing pages of showsup.ai and our free resources only, the service described in section 8 does not store cookies of its own, but may load tracking images from advertising partners that do. It never runs inside the ShowsUp app. - **Session replay (optional):** with your consent, we record your clicks and navigation inside the ShowsUp app to help us spot and fix usability problems. Input fields and personal details are masked in your browser before anything is sent, so we do not see your data. It never captures your wider screen or other tabs. We ask before turning this on, and you can turn it off at any time in Settings. The lawful basis is your consent. ## 13\. Changes to this policy We may update this policy from time to time. We will notify you of material changes by email or in-app notification. Continued use of the service after changes constitutes acceptance. ## 14\. Contact Pipeline Engine Ltd 71-75 Shelton StreetCovent GardenLondonWC2H 9JQUnited Kingdom Registered in England and Wales, company number 16707608. VAT registration number GB508523988. Email: [jonny@showsup.ai](mailto:jonny@showsup.ai) ShowsUp is a product of Pipeline Engine Ltd.