Legal
Privacy Policy
What Ringmaster Cloud collects, why, who it is shared with, and how to get it removed.
This policy covers two different kinds of people, and which one you are changes who is answerable to you.
If you joined a room as part of an audience, almost nothing about you is collected, and what is collected is collected for the event organiser running that room. Start at If you joined a room as a participant.
If you hold an operator account, we are answerable to you directly for your account, organisation and billing data. Start at If you hold an operator account.
Contents
1Who we are
1.1
Ringmaster Cloud is operated by BigBrave (Pty) Ltd in South Africa, through The BIG IDEA, a division of BIGBrave.
1.2
As POPIA requires, we have designated an Information Officer, responsible for our compliance with it, for dealing with requests about personal information, and for liaising with the Information Regulator (South Africa). For questions about this policy or to exercise any right described in it, write to info@bigbrave.co.za, marked for the attention of the Information Officer.
1.3
This policy is written around the Protection of Personal Information Act, 2013 (POPIA). Where the General Data Protection Regulation applies — because a participant is in the EU or UK when they join a room — the section If you are in the EU or UK sets out the differences.
2The short version
We do not track you. There is no analytics, advertising, profiling or third-party tracking code anywhere in this service.
One cookie. A single sessionId cookie identifies a device to the room it joined. Nothing else is stored on your device by us.
Your location never leaves your phone. When a room is geofenced, your browser gives the page your coordinates, the page checks the distance on the device, and the result — in range or not — is all that anything else ever sees. We never receive or store your location.
We never see your card. Payment happens on our provider's hosted checkout. We receive a subscription status, never card details.
We do not sell personal information. Not to anyone, for any purpose.
3If you joined a room as a participant
3.1
You do not need an account to join a room, and in the ordinary case we never learn your name. The service needs to know that a device is present so that the show can reach it and so that a draw can include it — not who you are.
3.2
The event organiser is the responsible party. They chose to run the room, they decide whether to run a prize draw, and anything you submit to them is theirs. We process it on their instruction, as their processor. If you want your details corrected or deleted, ask the organiser first — and if you cannot reach them, write to us at info@bigbrave.co.za and we will help.
Here is everything a participant device produces:
| What | Why | How long |
|---|---|---|
A sessionId cookie holding a random identifier | Tells the room this is the same device it saw before, so a draw cannot count one phone twice | Until you clear your browser's cookies |
| The time your device first joined the room | Forms the entry log the prize draw is drawn from | Until the room is deleted |
| A live presence heartbeat while the room is open in front of you | Makes a device eligible to be drawn only while it is actually watching | Removed the moment you close the tab |
| Your poll answers | Produces the aggregate tally shown on screen | Until the room or the poll is deleted |
| Your name, email address and mobile number — only if you are drawn as a winner and choose to submit them | So the event organiser can contact you about your prize | Held for the organiser; see How long we keep things |
3.3
Winner details are the only personal information a participant ever gives this service, and they are given by choice, on a form, after being drawn. If you would rather not be contacted, do not submit the form.
Geofenced rooms
Some rooms only display content to devices inside a set radius. Your browser will ask your permission for location, and if you agree, the page compares your coordinates with the room's centre on your own device. Your coordinates are not sent to us, not sent to the organiser, and not written to any database. Declining means the room's content will not display for you.
3.4
Winner contact details are deliberately stored apart from the public room data, so that they cannot be read by other participants in the room. Only the event organiser and their team can see them.
4If you hold an operator account
4.1
For your own account, organisation and billing data, we are the responsible party.
| What | Where it comes from | Why |
|---|---|---|
| Email address, and a password or a Google or Facebook sign-in | You, when you register | To authenticate you and secure your account |
| Display name, profile photo, mobile number and postal address | You, in your profile — all optional beyond your name | To identify you in the interface and to your team-mates |
| Organisation membership and role | Whoever invited you, and your own actions | To decide what you may do and what you may spend |
| Invitations you send, including the invitee's email address | You | To grant access when that person signs in |
| Billing profile: registered name, VAT number, invoice email, purchase-order reference and address | An organisation owner | To issue correct invoices |
| Subscription and payment status | Our payment provider | To know what your plan entitles you to, and whether it is paid |
| Content you upload: logos, images, video, scenes and room configuration | You | To run your shows |
| Operational logs recording errors and requests to our server functions | Automatically | To keep the service working and to investigate faults and abuse |
4.2
We use this to provide the service, to bill you, to support you, to secure the service against abuse, and to send you service messages about your account, your plan and material changes to these documents. We do not send marketing email unless you asked for it, and any we do send can be unsubscribed from in one click.
4.3
Our lawful bases are the performance of our contract with you, our legitimate interest in securing and improving the service, and our legal obligations for tax and accounting records.
5Cookies and similar technologies
5.1
This service uses one cookie: sessionId, a random identifier that tells a room it has seen this device before. It carries no personal information and is not used to track you across sites.
5.2
Signing in as an operator additionally stores an authentication token in your browser, which is what keeps you signed in. Signing out clears it.
5.3
There is no analytics, no advertising pixel, no session-recording, no fingerprinting and no third-party tracking code in this service. There is nothing to opt out of, which is why there is no cookie banner.
6Who else processes your information
We use a small number of providers, each for one job:
| Provider | What they do | What they see |
|---|---|---|
| Google Firebase (Google Cloud) | Authentication, databases, file storage and server functions — the infrastructure the whole service runs on | Everything stored by the service, as our processor |
| PayKit | Subscriptions, checkout and invoicing | Organisation and billing contact details, and your card details, which they take on their own hosted checkout — we never receive them |
| Google Fonts | Delivers a web font when a show uses one | The request from the device rendering that font, including its IP address, as with any web font |
| Instagram / Facebook (Meta) | Only when an operator imports a video from a link | The request our server makes to fetch that video. Participants are not involved |
6.1
We may also disclose information where the law requires it, to enforce our terms, or to protect the rights and safety of people using the service. If we are ever compelled to hand over data, we will tell you unless we are prohibited from doing so.
6.2
If the business is sold or merged, information may transfer to the buyer, who will remain bound by this policy until they give you notice of any change.
6.3
We do not sell personal information, and we never have.
7Where your information is stored
7.1
The service runs on Google Cloud infrastructure, and our payment provider operates in South Africa. Some data is therefore stored or processed outside South Africa, in countries whose data-protection law may differ from ours.
7.2
Where we transfer personal information across a border, we do so on the bases POPIA allows — the recipient being bound by rules affording comparable protection, the transfer being necessary to perform our contract with you, or your consent. Google's contractual data-protection commitments apply to the infrastructure we use.
8How long we keep things
| Information | Kept for |
|---|---|
| Live presence in a room | Removed the moment the tab closes |
| A device's join record and poll answers | The life of the room. Deleting the room deletes them |
| Winner contact details | Held for the event organiser until they delete them, and in any event no longer than 12 months after the draw, after which we delete them |
| Operator account and profile | While your account exists. Closing it removes the profile |
| Organisation, rooms and uploaded content | While the organisation exists, then for 30 days so that it can be recovered in error, then deleted |
| Invoices and payment records | Five years from the end of the tax year they relate to, as tax law requires. This is why closing an account does not erase your billing history |
| Operational and security logs | Up to 12 months |
8.1
Where we are obliged to keep something, we keep only what the obligation covers, and we do not use it for anything else.
9How we protect it
9.1
Traffic is encrypted in transit. Access to stored data is enforced by server-side security rules, so that a room's private data — winner contact details in particular — cannot be read by participants, by other organisations, or by anyone whose account has not been granted access to it.
9.2
Our staff access personal information only where they need it to run or support the service.
9.3
No system is perfectly secure. If a breach occurs that is likely to harm the people affected, we will notify them and the Information Regulator (South Africa) as POPIA requires.
10Your rights
Whether you are an operator or a participant, you may:
ask what personal information we hold about you and get a copy of it;
have it corrected if it is wrong, or completed if it is incomplete;
have it deleted where we no longer have a reason to keep it;
object to processing based on our legitimate interests; and
withdraw consent you previously gave, which does not undo processing already carried out on it.
10.1
Write to info@bigbrave.co.za. We will respond within 30 days. We may need to confirm your identity first — which, for a participant, ordinarily means matching the details you submitted.
10.2
For information you submitted to an event organiser, the request is properly theirs to answer, and we will pass it on and support them in answering it.
10.3
If you are unhappy with how we handle a request, you may complain to the Information Regulator (South Africa) at https://inforegulator.org.za or complaints.IR@inforegulator.org.za. We would rather you came to us first.
11If you are in the EU or UK
11.1
Where the GDPR or UK GDPR applies, the rights above are supplemented by the right to data portability, the right to restrict processing, and the right not to be subject to a decision based solely on automated processing that produces legal effects. We do no such automated decision-making.
11.2
In GDPR terms, we are the controller of operator account data and a processor of participant data on the event organiser's behalf. Our lawful bases are contract, legitimate interests, and legal obligation, as described above.
11.3
You may complain to your local supervisory authority.
12Children
12.1
Operator accounts are for adults; you must be 18 or older to hold one.
12.2
Audiences at an event may include children, and joining a room requires no account and collects nothing that identifies a person. Event organisers must not use the draw mechanic to collect contact details from children without the consent of a competent person, as POPIA requires. If you believe we hold a child's personal information without that consent, write to info@bigbrave.co.za and we will delete it.
13Changes to this policy
13.1
If we change this policy we will update the effective date at the top of the page. For changes that materially affect you, we will give notice by email to operators or in the product before they take effect.
13.2
Any change that would let us use information we already hold for a genuinely new purpose will be put to you for consent rather than announced.
14How to contact us
14.1
Privacy questions, and any request to see, correct or delete your information: info@bigbrave.co.za. Put Privacy in the subject line, and tell us whether you are asking as an operator or as someone who joined a room — as this policy explains, the answer is different.
14.2
The same address handles support and everything else. The commercial agreement for the service is the Terms of Service.