Privacy Notice

This privacy notice explains how Overshow ("we", "us") collects, uses and protects your personal data when you use our website and services.

By using our website or contacting us, you acknowledge this notice.

Who we are

Overshow is a local-first AI application developed and operated by San Digital Limited, a company registered in England and Wales.

• Company name: San Digital Ltd
• Company number: 12957488
• VAT number: GB361512914
• Registered office: San Digital Limited, Kendal House, Oxenholme Road, Kendal, England, LA9 7RL
• Email: hi@over.show

San Digital Limited is the data controller for personal data collected through the Overshow website and for the account, licensing, security and business-relationship data that we determine how to use.

When a customer organisation uses the hosted organisation repository, that organisation is the data controller for personal data in the approved records it chooses to publish. San Digital Limited acts as its data processor: we store the published record, serve it to authorised organisation members and carry out retention, export or deletion instructions on the organisation's behalf. The customer organisation is responsible for its lawful basis, transparency to affected people and its users' authority to publish. We act as an independent controller only for the limited account, security, abuse-prevention and legal-compliance records whose purposes we determine ourselves. These roles may be supplemented by the customer's order, data-processing agreement or other written terms.

Personal data we collect

We collect and process the following categories of personal data:

• Contact form data
  • Name
  • Email address
  • Company name
  • Any other information you choose to include in your message
• Licensing and single sign-on (SSO) data
  • Name
  • Work email address
  • Company/organisation
  • SSO identifiers and metadata (for example, unique ID from your identity provider, role or group membership where required for access control)
• Mobile account and installation data
  • Microsoft account name, email address and identity identifier used to sign in
  • Overshow user ID, random mobile installation ID, platform, app version, and account/session lifecycle timestamps
  • IP address and limited security metadata used to protect sign-in and rate-limit abuse
• Optional connected provider data
  • Identity provider name and account identifiers for Google or Microsoft sign-in, calendar, and mail connections
  • Granted permissions or scopes, token expiry, and connection status metadata
  • Encrypted access tokens and refresh tokens used to maintain authorised Google Workspace or Microsoft 365 connections
  • Google Calendar or Microsoft 365 calendar names, event titles, attendees, locations, descriptions, times, response status, recurrence data, and meeting links exposed by the provider
  • Gmail or Microsoft 365 message and thread identifiers, sender and recipient details, subject, date, labels, snippets, message headers, and qualifying message body text
  • Local full-text search indexes, source links, and reply state derived from authorised calendar or mail data
  • Transcript text, meeting identifiers, dates and available speaker attribution from selected eligible Microsoft Teams meetings, imported into the consultant's private local history for review
• Microsoft 365 Copilot connector data
  • Connection records: your Overshow user ID, the sign-in identity used to approve the connection, granted permissions, and approval, expiry and revocation times
  • Encrypted authorisation state, such as authorisation codes and refresh credentials, and single-use markers showing that a relay connection came from your registered computer
  • Security events recording the event kind, status and a bounded error code, without queries, excerpts, source identifiers or tokens
  • For a consultant's personal connection, queries from Microsoft 365 Copilot and the source excerpts their computer returns, which pass through our relay without being stored by Overshow
  • For an organisation connection, queries and the published engagement records and approved source excerpts returned to the authorised user or agent
• Explicitly published organisation records
  • Organisation and engagement identifiers, approved daily-record titles, summaries, structured items, dates, and content hashes
  • Source kind, capture time, application name, and frozen source excerpts that the consultant reviewed and approved for publication. These excerpts can contain another person's words
  • Publication author and audit metadata, without a frozen copy of the author's email address or name
• Technical and usage data
  • IP address
  • Browser type and version
  • Device information
  • Pages visited and actions taken on our site
  • Date and time of access

Overshow is designed as a local-first AI application. Model inputs and outputs processed locally by your organisation are not transmitted to us by default. The local capture index is not replicated to our servers. Data crosses that boundary only through an explicit feature or action, including support material you choose to submit, an integration you approve, or publishing an approved record to the organisation repository.

Approval and publication are separate. Approval freezes a daily record locally. If you then choose Publish, the approved record, its approved source excerpts, and publication audit metadata are stored in the hosted organisation repository so authorised organisation members can use that record. Drafts, original sources, the wider local capture index, window titles, URLs, file paths, device details, and mail-derived content are not included in that publication.

The consultancy decides who can access each engagement's published records and which AI connections it allows. Access to an engagement does not grant access to a consultant's unpublished history. A separate, explicitly approved personal cloud AI connection can return excerpts from that history to its provider. In Microsoft 365 Copilot, the questions, returned source excerpts, answers and citations are processed and retained in the organisation's Microsoft 365 under its policies, where authorised compliance administrators can access them. This is separate from publication to the organisation repository.

The Android recorder processes microphone audio and produces transcripts on the phone. It does not send microphone audio or transcript content to Overshow's account service. The account service receives only the mobile account and installation data described above.

If you enable optional Google Workspace or Microsoft 365 sync, app.over.show stores encrypted provider tokens and related connection metadata so the desktop app can refresh access securely. In normal operation, the desktop app calls the provider APIs directly to fetch authorised calendar or mail data. Overshow servers do not proxy normal calendar event or message payloads, and we do not routinely ingest or store those payloads in the web portal as part of normal sync.

For Gmail, Overshow first reads message lists, identifiers, labels, snippets, and selected headers. For messages that pass its on-device filtering, it temporarily retrieves message body text so the local mail pipeline can determine whether a reply is owed and produce a useful excerpt. Overshow stores only a bounded excerpt, relevant metadata, source links, derived reply state, and local full-text search indexes in the encrypted local database. It does not persist full message bodies in normal operation.

For the encrypted connected-provider token store at app.over.show, San Digital Limited acts as data controller for the account and connection metadata needed to operate licensing and delegated provider access. Google and Microsoft remain separate controllers for the source data held in their own services.

Optional enterprise trial diagnostics

For an explicitly enrolled enterprise desktop trial, Overshow can share operational measurements with a dedicated PostHog EU project to improve capture, parsers, quality and reliability. These measurements include your Overshow account and existing installation identifiers, software version and build capabilities, event times, approved app families, numeric counters, timing buckets and fixed health outcomes. They are account-linked personal data, not anonymous analytics. Trial participation is governed by the agreement and notice provided for that trial.

Optional structural samples describe an application's accessibility structure using roles, synthetic values, coarse size buckets and a small reviewed selector vocabulary. Overshow sanitises these samples on your computer before storage in the diagnostic queue or transfer. Captured text, screenshots, audio, document names, window titles, URLs, file paths, query and answer text, and unapproved application or selector names are excluded.

You can disable diagnostics or structural samples in desktop Settings > Privacy. Disabling clears the corresponding queued diagnostics on that computer. An authorised device can collect while offline until its signed policy expires, for up to seven days. Revoked authority stops collection and clears the queue when the device learns of the revocation.

Uploaded diagnostic history is scheduled for deletion after roughly 90 to 97 days, plus PostHog's asynchronous deletion time. Stopping collection leaves that deletion process running. Account erasure remains pending until PostHog deletion is verified and account-linked relay bookkeeping has been removed. Processor backups follow the processor's separate backup lifecycle and are outside the product's own delete call.

Voice data

Meeting audio is optional. When enabled, the Overshow desktop app captures audio during active or manually started meetings and transcribes it on the user's computer. Raw audio stays on that computer and is removed after terminal processing. Bounded encrypted recovery files can remain through interruptions, including quarantined speech that produced no usable transcript, until processing succeeds, the user deletes it, or oldest-first eviction removes it within the shared ten-hour recovery cap. Transcript text and meeting metadata remain in the encrypted local database under the user's retention choices.

Overshow stores no voice embeddings. Speaker labelling runs locally within each meeting and does not create a stored voiceprint or compare voices across meetings. Cross-meeting identity comes from names, calendar context, and links the user confirms.

Imported Teams transcripts are a separate source. Microsoft processes the meeting audio and creates the transcript under the organisation's Microsoft 365 settings. The local processing and audio-retention statements above describe Overshow's own recording, not Microsoft's transcription service.

The Android recorder (described below) is a separate product surface. It does not store voice embeddings either. Speaker labelling within a recording session, if present, is not persisted as a voiceprint and voices are not matched across meetings.

Android recorder

The Android recorder is a separate, local-first meeting recorder:

• Recording starts only after you take an explicit action and Android displays a foreground recording notification.
• Microphone audio is held in bounded memory while an on-device speech model produces text. The app does not write raw audio to storage or send it to Overshow, Microsoft, or another transcription service.
• Confirmed transcript text and meeting metadata are stored in a per-account SQLCipher-encrypted vault on the phone. There is no transcript cloud sync in this release.
• The app uses Microsoft only for account authentication and requests openid email profile. It does not request calendar access or store Microsoft provider access or refresh tokens for mobile sign-in.
• The current Android app contains no analytics or advertising SDK. It emits local, content-free performance diagnostics to Android's device log for testing and troubleshooting.
• Export happens only when you choose Share. The app creates a short-lived plaintext transcript file for Android's share sheet. The destination app or service then controls that copy.

Deleting your account in the Android app first removes the local transcript database and its wrapped encryption key, then requests deletion of the online Overshow account. Signing out does not delete local transcripts. Revoking an installation or deleting an account remotely locks the vault when that phone next checks the account service, but an offline or lost phone cannot be remotely erased. Use a device passcode and Android's device-management controls to reduce that risk.

Meeting transcripts can contain personal data about other people. You are responsible for telling participants and obtaining any consent or other lawful basis required in the place where you record.

Cookies and similar technologies

What are cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember preferences and provide certain functionality.

Cookies we use

• Marketing site (over.show): no cookies at all. There are no advertising or marketing cookies, no tracking pixels, and therefore no cookie banner. The analytics described below are cookieless.
• Web app (app.over.show): first-party cookies only, used to sign you in and for compatibility with authentication flows started before public self-service closed:
  • Session cookie: keeps you signed in while you use your account and billing area.
  • Security cookies: anti-CSRF and sign-in flow tokens used to protect authentication.
  • Legacy flow cookies: older links and in-flight authentication flows may use short-lived signup_intent (24 hours), referral_code, or referral_token (1 hour). They are retained for backward compatibility only. They do not admit an account, create a new referral or affiliate attribution, or create a reward after self-service closes.

Account admission is controlled by Overshow and cannot be obtained through a URL, source parameter, referral code, cookie, or stale authentication flow. A validated referral code may be carried from an older affiliate URL into a walkthrough or contact enquiry as bounded sales context only. It does not create an account, referral relationship, reward, or commission.

These cookies are essential or functional first-party cookies for services you have asked for, such as signing in or completing a compatible authentication attempt. They are not shared with anyone, are not used for advertising, and do not require a consent banner.

You can manage or block cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in to the web app.

No advertising trackers

We do not run any advertising pixels or conversion trackers on our websites, and we do not send visitor data to advertising platforms.

Consent choices recorded under the previous cookie banner are retained server-side as a historical audit trail. Each record holds a random subject identifier, the IP address, and the browser user agent captured with the choice. Records are not linked to your account, and no new records are created.

Cookieless analytics

We use Vercel Web Analytics and Vercel Speed Insights on the marketing site and web app to understand aggregated usage (which pages are visited, rough performance metrics such as Web Vitals). These products do not set cookies and do not use cross-site identifiers. Data is aggregated at Vercel's edge and contains no personal identifiers we can link back to an individual.

• Lawful basis: legitimate interests (understanding site usage and performance to improve the service). There is no consent requirement because no information is stored on, or retrieved from, your device for analytics purposes.
• Sub-processor: Vercel Inc. See "Sharing your personal data" below.
• What is collected: canonical page path visited, approximate country, anonymised device and browser class, and Web Vitals (LCP, CLS, INP, TTFB). Query strings and fragments are removed before collection, and personalised affiliate paths are grouped under one generic path. No IP addresses are retained.

Custom events

In addition to page views, we fire a small number of named events to understand how the marketing site and account flow convert. These events are sent to the same Vercel Analytics pipeline as page views, without cookies or cross-site identifiers, and carry only non-personal attributes about the interaction:

• cta_click - the public CTA label, a bounded destination category, and any explicit signup source tag. Other target URL and query-string values are not included.
• walkthrough_cta_click - which public surface a walkthrough CTA sits on and the walkthrough path it links to, including its bounded source tag. No form values or personal data are included. A click made before the page finishes loading may be recorded via our own server endpoint with the same fields.
• faq_interaction - the FAQ question text and whether it was opened or closed.
• form_start, form_submit, form_submit_error - which enquiry form was started or submitted, the path of the confirmation page for a submission (its query string, including any referral code, is removed first), and, on error, an HTTP status or network error category. We do not send any form field values with these events.
• signup_page_view, platform_detected, pc_deflect_to_platform_support_clicked - legacy compatibility events for older account flows, carrying only the bounded acquisition source, referral presence, supported-platform result or deflection action. Unknown source strings are grouped as other. These events do not admit an account or create attribution or rewards.
• platform_interest_recorded - the bounded platform requested when a new availability or Mac-link record is stored. The submitted email address is not included.
• auth_method_selected, auth_success - the selected provider and login or legacy-signup mode, or whether an admission-controlled account was created and its bounded acquisition source.
• desktop_download_click, desktop_exchange_redeemed, desktop_device_registered, desktop_device_conflict - download intent and server-observed desktop exchange, registration or device-limit outcomes. These contain only a bounded transaction flag or registration outcome.
• affiliate_application_started, affiliate_application_submitted, affiliate_application_error - legacy compatibility events for applications submitted before the programme paused, carrying only milestones and a bounded error category. Application answers, links and payout references are never included, and no new applications, attributions or rewards are created.

No personally identifying fields from forms (such as name, email, or free-text responses) are included in custom events. Events are stored in the same aggregated Vercel Analytics counters as page views and are subject to the same retention.

You can block browser-originated Vercel Analytics requests at the network level via browser extensions if you prefer. The site works with these requests blocked. Server-observed platform-interest and desktop events are sent from our app server after a successful record, exchange, or registration request, so browser network blockers cannot suppress them.

How we use your personal data

We use your personal data for the following purposes:

• To respond to enquiries
  • Handling queries submitted through the contact form.
  • Providing information about our products, services and pricing where requested.
• To manage licensing and access
  • Verifying your identity via SSO and authorising access to Overshow.
  • Allocating and managing licences within your organisation.
  • Monitoring licence usage at an aggregate level for capacity planning and contract management.
• To operate the organisation repository
  • Storing an approved record and its approved source excerpts only after the consultant takes the separate Publish action.
  • Making published records available to authorised members of the relevant organisation and engagement.
  • Returning published records and approved source excerpts to approved AI connections within the engagement access granted by the consultancy.
  • Recording publication events for integrity, accountability, conflict handling, and support.
• To operate mobile account access
  • Authenticating the Android app, binding sessions to a specific installation, preventing abuse, and supporting installation revocation and account deletion.
  • We do not receive microphone audio or transcript content through this account flow.
• To operate optional Google Workspace and Microsoft 365 features
  • Storing and refreshing encrypted provider tokens for authorised calendar and mail connections.
  • Allowing the desktop app to list authorised calendars and read event metadata on your behalf.
  • Powering meeting detection, calendar correlation, attendee matching, and pre-meeting briefs in the desktop app.
  • We do not use this access to create, edit, delete, or share calendar events on your behalf.
  • Allowing the desktop app to read authorised mail metadata and content for reply-owed detection, local search and Ask, meeting preparation, and links back to the source message.
  • We do not use this access to compose, send, edit, or delete messages on your behalf.
  • Importing transcripts from selected eligible Teams meetings into the consultant's private local history for review, under the permissions agreed at set-up.
• To operate the optional Microsoft 365 Copilot connector
  • Relaying Copilot's queries to your approved computer and its returned excerpts back to Microsoft.
  • Giving authorised users and organisation agents access to published engagement records and their approved source excerpts through the separately configured organisation connection.
  • Keeping connection and security records so you can review and revoke connections and we can protect the service.
• To operate and improve our website and services
  • Ensuring the security and integrity of our systems.
  • Analysing anonymised or aggregated usage trends to improve usability and performance.

We do not sell your personal data.

Google Workspace and Microsoft 365 integrations

When you choose to connect a calendar or cloud mailbox in the desktop app, Overshow requests delegated, read-only access for the feature you enable.

• Google Calendar: https://www.googleapis.com/auth/calendar.events.readonly and https://www.googleapis.com/auth/calendar.calendarlist.readonly.
• Gmail: https://www.googleapis.com/auth/gmail.readonly.
• Microsoft 365 / Microsoft Entra ID: Calendars.Read for calendars and Mail.Read for mail. Microsoft sign-in may also include standard identity permissions and offline_access so the authorised connection can refresh without prompting you on every sync.

We use these permissions only to let the desktop app identify authorised calendars and messages, read the data needed for the connected feature, and provide user-facing calendar and mail features in the desktop app.

Calendar data handled through this integration can include calendar names, event titles, attendees, locations, notes or descriptions, start and end times, recurrence markers, response status, and meeting links or conference URLs present in the event. Sensitive calendar fields stored by the desktop app are encrypted locally. We do not use Google or Microsoft calendar data for advertising, sale to data brokers, or AI model training.

Mail data handled through this integration can include message and thread identifiers, sender and recipient details, subject, date, labels, snippets, selected headers, and the body text of qualifying messages. Message body text is processed on the device to produce a bounded excerpt, source link, derived reply state, and local full-text search indexes. Full message bodies are not persisted by Overshow in normal operation.

Google user data is transferred over HTTPS and provider tokens are encrypted at rest in the app.over.show token relay. Calendar data, mail metadata, bounded excerpts, and derived results kept by the desktop app are stored in its locally encrypted database.

Overshow may use Google Workspace data as context for user-requested on-device search and inference. This processing does not update model weights. Overshow does not use data obtained through Google Workspace APIs to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models.

Overshow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can stop future provider access by revoking Overshow in your Google or Microsoft account, or through your organisation's administrator controls where applicable. If access is revoked or expires, future cloud sync will fail until you reconnect. Revocation does not automatically delete data already stored on your device. Use Settings → Data → Reset local data if you also want to remove the local encrypted database.

Microsoft Teams transcripts

Teams transcript import and Copilot access are separate connections. During set-up, we agree with your consultancy which eligible Teams meetings to include and the Microsoft permissions and administrator consent required. Only the selected eligible meetings are included in this import. A saved transcript must exist and access remains subject to Microsoft's meeting permissions and tenant policies. Speaker names may be unavailable where the tenant restricts speaker attribution.

The selected transcript enters the consultant's private history on their computer for review. It is not automatically published to the organisation repository. The consultant checks and approves the record and its source excerpts before taking the separate Publish action. The original Teams transcript remains subject to Microsoft's storage, access and retention policies; importing it does not change those policies or delete that source copy.

Microsoft 365 Copilot connections

Your consultancy decides whether to enable the organisation connection and which personal AI connections are permitted. Microsoft 365 Copilot requires the relevant Microsoft licence and administrator approval. There are two separate routes.

The consultant's own history

The personal Microsoft 365 Copilot connection is optional. It stays off until you approve it in the desktop app under Settings → Connections → Microsoft 365 Copilot and then connect Overshow from Copilot with the same Overshow account. It lets your Copilot search the history you permit while your computer is online. This route is separate from access to published engagement records and can return excerpts you have not published.

• How content travels. Copilot sends each query to a gateway that Overshow operates on Cloudflare. The gateway relays the query to your computer, which searches your local history and returns bounded excerpts through the same gateway to Microsoft. Your full history stays on your computer.
• What Cloudflare can read. Cloudflare terminates the encrypted connections at its edge, so queries and returned excerpts are readable by the gateway while they pass through. They are not end-to-end encrypted between Microsoft and your computer. The gateway holds them in memory only for the request and does not store or log them. It keeps connection metadata, such as pseudonymous routing identifiers, connection times and request counts, to route requests and apply rate limits.
• Where it runs. The gateway's routing object is placed in Cloudflare's EU jurisdiction, but Cloudflare can terminate connections and process requests and operational metadata outside the UK and EEA.
• What we store. app.over.show keeps the connection records, encrypted authorisation state and security events listed above in Neon, UK (London). Access credentials expire after five minutes, and each connection expires 30 days after you approve it.
• What Microsoft receives. Microsoft receives returned source excerpts to answer your question. Questions, returned source excerpts, answers and citations are processed and retained in your organisation's Microsoft 365 under its contractual terms and tenant policies. Authorised compliance administrators can access retained Copilot conversations using Microsoft 365 compliance tools. Disconnecting in Overshow stops new retrieval but does not erase content already returned to a conversation.

Disconnecting in the desktop app stops your computer answering straight away. Revoking the connection in your Overshow account stops it renewing at once, and access already issued ends within five minutes.

The organisation's published engagement records

The organisation connection searches the hosted organisation repository. The consultancy grants access per engagement and chooses the approved AI connections. An organisation agent can retrieve only published records and approved source excerpts for the engagements it has been granted. It cannot use this route to search a consultant's unpublished history or fetch the original messages and transcripts behind a source excerpt.

Published records and source excerpts are already stored in the hosted repository. When an authorised user or agent asks Copilot about them, the permitted content is returned to Microsoft for the answer. The questions, returned source excerpts, answers and citations are then processed and retained in the organisation's Microsoft 365 under its policies and may be accessed by authorised compliance administrators. Repository access and retention are separate from retention of that Copilot conversation. Revoking an engagement grant or disconnecting Copilot stops future retrieval; it does not remove earlier copies held in Microsoft 365.

See Microsoft's explanation of Copilot data, privacy and security for how Microsoft stores and manages these interactions.

Our lawful bases for processing

We rely on the following lawful bases under UK data protection law:

• Legitimate interests
  • Responding to contact form enquiries.
  • Operating, securing and improving our website and licensing services.
  • Managing existing or prospective business relationships.

Where we contract directly with you as an individual, processing needed to administer your account or supply the licensed service may be necessary for performance of that contract. Where our customer is an organisation, controller-side account and licensing processing relies on legitimate interests or another applicable basis. That commercial contract does not determine the lawful basis for personal data in repository content.

For personal data in an approved record published to an organisation repository, the customer organisation determines the lawful basis as controller. We process that data on its documented instructions as processor. Our separate processing of repository access and security logs for service integrity, fraud prevention and legal compliance relies on our legitimate interests or a legal obligation, as applicable.

If we ever rely on consent (for example, for certain types of direct marketing), we will ask for it clearly and separately, and you can withdraw it at any time.

How long we keep your data

We keep personal data only for as long as necessary for the purposes described above:

• Contact form data: normally retained for up to 2 years from the last meaningful interaction, to manage ongoing conversations and potential opportunities.
• Platform availability requests: Mac download-link requests are removed after 30 days. Other platform notification requests are removed after no more than 2 years if the requested version has not shipped sooner.
• Licensing and SSO data: retained for the duration of your organisation's licence plus up to 2 years, to support audit, security and contract management.
• Mobile authentication flows: expire after 10 minutes and are removed after a further 24 hours.
• Mobile installation and session data: retained while the account exists, subject to the shorter session and security-log retention periods described by the service, and deleted or unlinked when the account is deleted except where limited security records must be retained by law or for abuse prevention.
• Connected provider tokens and sync metadata: retained while the connection remains linked to your account. Provider tokens are deleted when the Overshow account is deleted, except where limited records must be retained by law or for abuse prevention.
• Local calendar and mail data: retained in the encrypted local database by default until you use Settings → Data → Reset local data, uninstall and remove the app's local data, or an explicit retention setting or operator policy deletes eligible data. A plan's searchable-history window limits recall. It does not itself delete older local data. Revoking provider access stops future sync but does not remove data already stored locally.
• Imported Teams transcripts: the local copy follows the consultant's local retention and deletion controls. Disconnecting Teams stops future imports but does not delete an existing local copy, an approved record already published, or Microsoft's source transcript. Each has its own retention and deletion boundary.
• Personal Microsoft 365 Copilot connector records: each connection expires 30 days after approval. Expired authorisation state and used proofs are removed by an hourly clean-up. Connection records, including revoked and expired ones, stay in your account until the account is deleted. Security events follow the technical log retention below. The personal relay does not store queries or excerpts; Microsoft retains Copilot interactions under the organisation's policies.
• Published organisation records: approved records, approved source excerpts, and publication audit metadata are retained as the organisation's record until the engagement or organisation is deleted. Deleting an author's account removes their membership and pseudonymises retained authorship and actor links. It does not delete the organisation's approved record.
• Technical logs: retained for short periods (typically up to 12 months) for security, troubleshooting and service improvement, unless a longer period is required for investigation or legal reasons.

We may retain data for longer where required to comply with legal or regulatory obligations or to establish, exercise or defend legal claims.

Sharing your personal data

We may share your personal data with:

• Service providers and suppliers who support our website, licensing infrastructure, hosting and security, including Cloudflare, which runs the Microsoft 365 Copilot connector gateway. These providers only process personal data on our instructions and under written contracts.
• Single sign-on, calendar, and mail providers, and your organisation's identity systems, where necessary to authenticate users, refresh delegated tokens, or access authorised data on your behalf.
• Professional advisers, such as legal or accounting advisers, where necessary for our legitimate interests.
• Regulators, law enforcement or courts, where we are legally required to do so or where necessary to protect our rights, users or the public.

We do not allow third parties to use your personal data for their own marketing.

An approved record you publish is shared with the people and approved organisation agents your consultancy has granted access to that engagement. Neon stores the repository in managed Postgres in the UK, and Vercel transiently processes publication and retrieval requests while hosting the account service. The local capture index is not shared with those organisation members or replicated to the repository. Organisation AI connections receive only the published records and approved source excerpts permitted by their engagement access.

Authorised calendar and mail data is not transferred to third parties by default. If you explicitly approve a local or AI client in Overshow, relevant snippets from the encrypted local database may be returned to that client as part of the user-facing feature you requested. A local client keeps that transfer on your device. A cloud client sends its query and returned snippets to its own provider under that provider's terms. The Microsoft 365 Copilot connector also passes its queries and returned excerpts through Overshow's gateway on Cloudflare, as described in the connector section above. Overshow does not transfer Google Workspace data for advertising, sale to data brokers, credit or lending decisions, or development of generalised or non-personalised AI or machine-learning models.

International transfers

Our core services are hosted within the UK or European Economic Area (EEA) wherever practicable. Cloudflare, which runs the Microsoft 365 Copilot connector gateway, can process relayed queries, excerpts and operational metadata outside the UK and EEA.

If we need to transfer personal data outside the UK or EEA, we will ensure appropriate safeguards are in place, such as:

• An adequacy decision by the UK Government or European Commission, or
• Standard contractual clauses or equivalent contractual protections.

You can contact us for more details of these safeguards.

Security of your personal data

We take appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (for example, HTTPS for our website).
• Encryption at rest for connected-provider tokens and SQLCipher encryption for locally stored calendar and mail data.
• Access controls and authentication for administrative systems.
• Regular security updates and vulnerability management.
• Restricted access to personal data on a need-to-know basis.
• Staff awareness and confidentiality obligations.

No system can be guaranteed to be completely secure, but we work to reduce risks to a level appropriate to the nature of the data and our services.

Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access. To obtain a copy of your personal data and information about how it is used.
• Right to rectification. To correct inaccurate or incomplete data.
• Right to erasure. To request deletion of your data in certain circumstances.
• Right to restrict processing. To limit how we use your data in certain situations.
• Right to data portability. To receive your data in a structured, commonly used format and transmit it to another controller, where applicable.
• Right to object. To object to processing based on legitimate interests, and to direct marketing.
• Rights in relation to automated decision-making and profiling. Where these are used in a way that has legal or similarly significant effects on you.

To exercise any of these rights, please contact us using the details above. We may need to verify your identity before responding.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: https://ico.org.uk
• Telephone: 0303 123 1113

We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first if possible via office@sandigital.uk.

Direct marketing

If you have given consent or we otherwise have a lawful basis (for example, where you are a business contact and we rely on legitimate interests), we may use your contact details to send you information about Overshow and related services.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any email, or
• Contacting us using the details above.

Opting out of marketing will not affect essential service or transactional communications.

Third-party websites

Our website may contain links to third-party websites. This privacy notice does not cover those sites, and we are not responsible for their content or privacy practices. You should review their privacy notices before providing any personal data.

Changes to this notice

We may update this privacy notice to reflect changes in our services or legal obligations. When we do, we will update the "Last updated" date at the top of this page.

Where appropriate, we may also notify you of significant changes by email or through our website.