SashBoard

Pageant Agreement

Draft · October 12, 2026

This agreement is between Cresta Studios LLC (“Cresta Studios”, “we”, “us”), which makes and runs SashBoard, and each pageant organization that subscribes to SashBoard (“the pageant”, “you”). It is part of our Terms of Service and covers the personal information the pageant keeps in SashBoard about its members, applicants, fans, buyers, sponsors and others (“pageant data”). Where it differs from the Terms on how pageant data is handled, this agreement wins.

1. Our roles

The pageant decides what pageant data to collect, why, who in the pageant can see it and how long to keep it. For pageant data, the pageant is the business (or controller) and we are its service provider (or processor). We handle pageant data only to run SashBoard for the pageant, on its instructions, which are these terms, the pageant’s settings, and what its administrators ask of us in writing.

2. What the pageant is responsible for

• Permission. Having a lawful basis and any notice or consent the law requires for the pageant data it collects, including a parent’s or guardian’s consent for anyone under 18. SashBoard is for people 13 and older; the pageant doesn’t invite anyone younger.
• Its own privacy policy, telling its members and fans what it collects and why. SashBoard shows it on the pageant’s website.
• Publishing. Permission from each person (a parent or guardian for anyone under 18) before publishing their name, photo or biography in its program, program book, website or anywhere else public, and taking it down when asked.
• Access. Giving people only the roles they need, keeping administrator accounts secure, and removing access when someone leaves the pageant.
• Content. Having the rights to the photos, logos, music, designs and documents it uploads.
• Sales and voting. Following the laws and its national organization’s rules for its ticket sales, fundraising, raffles and paid voting.
• What not to collect. Not using SashBoard for Social Security numbers, bank or card numbers, passwords, or health information beyond the emergency card.
• AI. If it connects its own AI provider account, the terms of that account, its cost, and reviewing what AI suggests before using it.

3. What we commit to

• Only for SashBoard. We don’t sell or share pageant data, use it for advertising, combine it with other pageants’ data, or use it to train AI. We don’t keep, use or disclose it outside our direct relationship with the pageant, except as the law requires.
• People. Only Cresta Studios people who need to, to support the pageant or keep SashBoard running, can reach pageant data, and they keep it confidential.
• Security. Encrypted connections; each pageant’s data kept separate from every other pageant’s by the database itself; each person seeing only what their role allows; private files opened only with short-lived links; AI provider keys stored encrypted; and sign-in by one-time code or Apple, with no passwords to steal.
• Help with requests. SashBoard lets the pageant see, correct and delete its members’ information itself, and we provide copies on request. When someone asks us directly, we send them to the pageant; when the pageant can’t do something itself, we help.
• Problems. If we learn that pageant data was accessed or disclosed without permission, we tell the pageant’s administrators without undue delay, and within 72 hours of confirming it, with what we know and what we’re doing about it, and we help the pageant meet any duty it has to tell people.
• Records. We keep a record of what we do to protect pageant data and answer a pageant’s reasonable questions about it in writing.

4. Services we use

We use these services to run SashBoard, each only for its job and under its own data protection terms: Supabase (database, sign-in and file storage, in Canada), Vercel (hosting, in the United States), Resend (email), Apple (notifications, Wallet passes and Sign in with Apple), Google Firebase Cloud Messaging (Android notifications), Stripe (subscriptions, and the pageant’s own sales, through the pageant’s own Stripe account), OpenStreetMap and Photon by Komoot (maps and address search) and Open-Meteo (weather). AI providers (Anthropic, OpenAI or Google) receive what a director sends only when the pageant connects its own account. We’ll list any new service here and tell pageant administrators at least 30 days before it handles pageant data; a pageant that objects may leave SashBoard and take its data.

5. Where pageant data is kept

Pageant data is stored in Canada and processed in Canada and the United States.

6. When a pageant leaves

While its plan is closed for non-payment or cancellation, nothing is deleted and renewing opens everything back up. A pageant’s administrators can ask us at any time for a copy of its information, in common formats such as CSV and the original files, and can ask us to delete it. We delete pageant data from SashBoard within 30 days of that request, and from any backups as they cycle out, except billing records and anything else the law requires us to keep. Published pages and the program book are removed from the app and website when the pageant’s information is deleted.

7. Fees, liability and everything else

Plans, fees, disclaimers, limits on liability, Utah law and how disagreements are handled are as the Terms of Service describe.

8. Changes

We may update this agreement. We’ll tell pageant administrators at least 30 days before a significant change takes effect; a pageant that doesn’t agree may leave SashBoard and take its data. The date at the top shows when it was last updated.

9. Contact

Questions about this agreement? Send us a message. Our privacy policy covers the information we collect for ourselves.