Privacy
Policy

Effective 2 August 2026 · Last reviewed 2 August 2026

This policy explains what information is collected when you visit this website, why, who it goes to, and what you can do about it. It covers this website only. It does not cover the ticketing, merchandise, or social media services we link out to — each of those has its own policy and its own practices.

1. Who we are

This website is operated by Boundary Road Productions ("we", "us", "our"), producer of September L. Davis: The Apology Tour. For data protection purposes, Boundary Road Productions is the controller of the limited information described in this policy.

Privacy enquiries: boxoffice@boundaryroadproductions.com.

2. Categories of information we collect

Information you give us

None through this site. There is no sign-up, no mailing list form, no comment field, and no checkout here. If you choose to email us, we receive the contents of that email and any contact details you put in it.

Information collected automatically

Our hosting provider, Vercel Inc., records standard technical data for every request so that pages can be delivered, kept secure, and counted in aggregate:

We look at this only in aggregate. We do not build profiles, we do not attempt to identify individual visitors from it, and we do not combine it with information from any other source.

3. Sensitive personal information

We do not collect any category of sensitive personal information as defined by the California Privacy Rights Act. That means no government identifiers, no financial account or payment credentials, no precise geolocation, no racial or ethnic origin, no religious or philosophical beliefs, no union membership, no contents of your private communications, no genetic, biometric, or health data, no information about sex life or sexual orientation, and no neural data. Because we do not collect it, we have nothing to limit the use of, and no "Limit the Use of My Sensitive Personal Information" mechanism is required.

4. Cookies and similar technologies

This site sets no tracking cookies of its own, does no fingerprinting, and uses local storage for one thing only: remembering your answer to the consent banner. One third-party tag, Meta's pixel, sets cookies when it loads — the conditions are set out below.

4.1 The Meta pixel

We run Meta's measurement pixel so we can tell which advertising is actually selling tickets. When it loads, it tells Meta that a browser visited a page on this site, along with your IP address, user agent, and referring page, and it sets the cookies above. If you have a Facebook or Instagram account, Meta may be able to connect that visit to it. We do not send Meta your name, email address, or any purchase information — ticket sales happen on a separate platform we do not control.

Whether it loads depends on where you are. We work that out from your device's time zone, which is known before the page finishes drawing, and confirm it against the country your IP address resolves to. Anything ambiguous is treated as requiring consent:

• UK, EEA and Switzerland — a banner appears and nothing loads unless you accept. Declining is a single click and is remembered.
• Everywhere else — it loads on page view. You can switch it off at any time using Privacy choices in the footer of every page; the page reloads and the tag is gone.
• Anywhere, always — if your browser sends a Do Not Track or Global Privacy Control signal, it never loads and no banner is shown. We do not ask you to repeat a decision you have already made.

The site is also built to support Google and TikTok tags. Neither is configured, so neither loads. If we enable one we will update this section and the table above before doing so.

5. Do Not Track and third-party tracking

Some browsers send a "Do Not Track" (DNT) signal. There is no common industry standard for how sites should respond to it. This site honours DNT signals: when your browser sends one, no measurement tag loads, in any region, regardless of configuration, and no banner is shown. We treat Global Privacy Control (GPC) signals identically, and additionally as a valid opt-out of sale and sharing under California law.

As to other parties tracking you across sites: yes, one can. When Meta's pixel is loaded under the conditions in section 4.1, Meta is capable of collecting information about your activity on this site and combining it with what it knows about you from other sites and from your Meta account. That is the entire purpose of an advertising pixel and we would rather say so plainly than bury it. Turning it off — via the banner, via Privacy choices in the footer, or via GPC — stops it. The third-party services we link out to, being the ticketing platform, the merchandise shop and social media, may also track you once you arrive there, under their own policies.

6. Categories of third parties we share with

We may also disclose information if legally compelled to do so, or to establish or defend legal claims. We do not sell personal information for money, and we do not disclose it to data brokers. Under the CPRA's broad definition, loading Meta's pixel may count as "sharing" personal information for cross-context behavioural advertising. We would rather tell you that than argue about it — see section 11 for how to opt out.

7. How we use information

• To deliver the pages, images, and fonts you request.
• To keep the site available, and to detect and prevent abuse.
• To understand in aggregate how many people visit and which pages they read.
• To measure whether our ticket advertising is working, using Meta's pixel under the conditions in section 4.1.
• To reply to you if you email us.

We do not use this information for automated decision-making, and we do not build our own profiles of visitors. Meta may use the pixel data for its own advertising purposes under its own terms, which is a decision you can decline as described above.

8. Legal bases (UK and EU visitors)

• Legitimate interests — serving the site, keeping it secure, and understanding aggregate traffic. We have weighed this against your interests and consider the impact minimal given how little is collected and that it is never used to identify you.
• Consent — Meta's measurement pixel. In the UK, EEA and Switzerland it does not load until you accept, and withdrawal is as easy as giving it: one click on Privacy choices in the footer.
• Legitimate interests — replying to correspondence you initiate.

9. How long we keep information

• Server request logs — retained by Vercel under its standard retention schedule (raw logs are generally kept for no more than 30 days), after which only aggregate counts remain. We justify this period as the minimum useful window for security investigation and error diagnosis.
• site_access cookie — up to 12 months, or until you clear your cookies, whichever comes first. It is removed entirely once the password gate is lifted.
• Meta pixel cookies — up to 90 days, set and controlled by Meta. What Meta then retains is governed by Meta's own policy, not ours.
• Your consent choice — stored in your browser until you clear site data. It never leaves your device.
• Email correspondence — kept for the run of the production and a reasonable period afterwards for follow-up, then deleted.

10. Your rights and how to exercise them

Depending on where you live, you may have some or all of the following rights: to know what personal information is collected and how it is used; to request access to it or a portable copy; to have it corrected; to have it deleted; to object to or restrict its processing; to withdraw consent; to opt out of sale or sharing; and not to be discriminated against or receive a lesser service for exercising any of these rights.

How to make a request

Email boxoffice@boundaryroadproductions.com and tell us what you would like. You may use an authorised agent. We will acknowledge promptly and respond within the period the applicable law allows — 45 days in California (extendable once by a further 45 days where necessary), and one month in the UK and EU.

One practical caveat, in fairness to you: because this site collects so little and none of it is tied to an identity, we usually cannot verify that a given record relates to you. An IP address alone does not identify a person to us, and we will not collect additional information from you simply to try to make a match. Where we cannot verify a request, we will tell you so and explain why, rather than guess.

Reviewing and changing your information

There is no account or stored profile on this site to review or edit. If you have emailed us and want that correspondence corrected or deleted, write to the address above and we will do it.

Complaints

If you are in the UK or EU and believe we have handled your information improperly, you may complain to your national supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put it right first.

11. California residents

Boundary Road Productions does not currently meet the thresholds that make an organisation a "business" under the California Consumer Privacy Act as amended by the CPRA — we are below the annual gross revenue threshold, we do not buy, sell, or share the personal information of 100,000 or more California consumers or households, and we derive no revenue from selling personal information. We nonetheless honour CCPA/CPRA rights requests as if we were covered, and this policy is written to the CCPA's disclosure standard and to the California Online Privacy Protection Act, which applies to us regardless of size.

Opting out of sharing

Loading Meta's pixel may amount to "sharing" personal information for cross-context behavioural advertising under the CPRA. You have two ways to stop it, and both work immediately:

• Privacy choices — the link in the footer of every page. Decline, and the page reloads without the tag. This is our "Do Not Sell or Share My Personal Information" mechanism; we have given it a plainer name.
• Global Privacy Control — if your browser or extension sends a GPC signal, we treat it as a valid opt-out and the tag never loads. You do not have to tell us twice.

We do not collect sensitive personal information, so there is nothing for a "Limit the Use of My Sensitive Personal Information" link to limit, and none is displayed.

In the twelve months preceding the effective date of this policy, we collected the categories of information listed in section 2, for the purposes listed in section 7, and disclosed them to the recipients listed in section 6. We sold no personal information. We shared internet and device activity with Meta for advertising measurement, as described in section 4.1.

12. International transfers

We operate from the United States, and our hosting is delivered from servers in multiple countries. If you visit from outside the United States, the technical data described above will be processed in the United States and potentially elsewhere. Where information is transferred out of the UK or EEA, our providers rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent approved safeguard.

13. Children

The production is strictly 18+, and this site is not directed at children under 13. We do not knowingly collect personal information from children, and we do not knowingly sell or share the personal information of anyone under 16 — we do not do so for anyone of any age. If you believe a child has provided us with personal information, email us and we will delete it.

14. Security

The site is served exclusively over HTTPS with HTTP Strict Transport Security, and protective headers are applied to every response. Access to the hosting account is limited to the people who need it. No method of transmission or storage is completely secure, but the volume of information at risk here is deliberately kept close to zero.

15. Changes to this policy

We review this policy at least once every twelve months and update the "last reviewed" date above whether or not anything changed. If we make a material change — in particular, enabling any measurement tag, or beginning to collect information you give us directly — we will update this page, change the effective date, and post a notice on the site's homepage before the change takes effect. Continued use of the site after a change means the revised policy applies to you.

16. How to contact us

Boundary Road Productions
Privacy enquiries and rights requests: boxoffice@boundaryroadproductions.com

For anything about a ticket you have already bought, accessible seating, or accommodations, please contact Studio Seaview audience services directly on (212) 542-3147 or at audienceservices@studioseaview.com. For group bookings, email GroupSales@BroadwayPlus.com.

This policy is provided in English. If you need it in another format for accessibility reasons, write to the address above and we will provide one.

Return to the site