[{"data":1,"prerenderedAt":702},["ShallowReactive",2],{"legal:\u002Flegal\u002Fprivacy":3},{"id":4,"title":5,"body":6,"description":693,"extension":694,"meta":695,"navigation":696,"path":697,"seo":698,"stem":699,"updated":700,"__hash__":701},"legal_en\u002Flegal\u002Fprivacy.md","Privacy policy",{"type":7,"value":8,"toc":664},"minimark",[9,13,17,26,31,34,54,57,61,69,85,89,94,97,111,114,118,121,139,142,146,149,166,170,173,176,179,186,190,193,197,200,220,223,235,239,242,254,258,261,328,331,338,342,362,365,369,372,376,379,382,401,408,422,425,432,436,442,454,458,469,473,476,561,564,567,571,574,578,581,585,588,640,643,647,650,654,657,661],[10,11,5],"h1",{"id":12},"privacy-policy",[14,15,16],"p",{},"This policy explains what personal data FilmKit processes when you visit\nfilmkit.app, use the FilmKit web app or the FilmKit apps for iOS and Android,\nor connect an AI assistant to FilmKit. It also explains why we process it,\nwho helps us and what rights you have.",[14,18,19,20,25],{},"How we use cookies and similar technologies is explained in more detail in\nour ",[21,22,24],"a",{"href":23},"\u002Fcookies","cookie policy",".",[27,28,30],"h2",{"id":29},"_1-who-is-responsible","1. Who is responsible",[14,32,33],{},"The controller under the EU General Data Protection Regulation (GDPR) is:",[14,35,36,37,40,41,43,44,46,47,49,50],{},"Léonce Aklin",[38,39],"br",{},"\nSonneckstrasse 4",[38,42],{},"\n4416 Bubendorf",[38,45],{},"\nSwitzerland",[38,48],{},"\nEmail: ",[21,51,53],{"href":52},"mailto:info@zebrapig.com","info@zebrapig.com",[14,55,56],{},"Our data protection officer is Léonce Aklin, reachable at the same address\nand email.",[27,58,60],{"id":59},"_2-our-role-controller-or-processor","2. Our role: controller or processor",[14,62,63,64,68],{},"FilmKit is a workspace that production companies, schools and other teams\n(each a ",[65,66,67],"strong",{},"Space",") use to make films. Two situations need to be told apart:",[70,71,72,79],"ul",{},[73,74,75,78],"li",{},[65,76,77],{},"Your own account, our website and our public directory."," For this data\nwe decide why and how it is processed. We are the controller.",[73,80,81,84],{},[65,82,83],{},"What a Space stores about other people."," Screenplays, schedules, call\nsheets, the address book with crew and cast contacts, casting submissions\nand everything else in a Space's projects is processed on behalf of the\nSpace. The organisation running the Space is the controller of that data,\nand we act as its processor under Art. 28 GDPR. If you are listed in a\nSpace's address book or applied to one of its casting calls, the\norganisation behind that Space is your first point of contact. We will\nforward requests that reach us.",[27,86,88],{"id":87},"_3-what-we-process-why-and-on-which-legal-basis","3. What we process, why, and on which legal basis",[90,91,93],"h3",{"id":92},"_31-visiting-the-website-and-using-the-app","3.1 Visiting the website and using the app",[14,95,96],{},"Whenever your browser or app talks to FilmKit, our hosting provider\nCloudflare receives technical data: your IP address, the date and time, the\nrequested address, the response, your browser and operating system (user\nagent) and the referring page. We need this to deliver FilmKit, to keep it\nsecure and to find errors.",[70,98,99,105],{},[73,100,101,104],{},[65,102,103],{},"Legal basis:"," our legitimate interest in a working, secure service\n(Art. 6(1)(f) GDPR).",[73,106,107,110],{},[65,108,109],{},"Retention:"," request logs are kept for a short period, normally no longer\nthan 30 days, unless they are needed to investigate a specific security\nincident.",[14,112,113],{},"We also measure how fast pages load and respond (Core Web Vitals). These\nmeasurements contain the name of the page type, timings and the app version,\nbut no user ID, no address of the page and no IP address. They are stored in\nCloudflare Workers Analytics Engine. Legal basis: our legitimate interest in a\nfast product (Art. 6(1)(f) GDPR).",[90,115,117],{"id":116},"_32-waitlist","3.2 Waitlist",[14,119,120],{},"If you join the waitlist, we store your email address, your first and last\nname, the page you signed up from, the date, and the country derived from\nyour IP address. To keep out bots, the form uses Cloudflare Turnstile, which\nchecks your browser for signs of automation.",[70,122,123,129,134],{},[73,124,125,128],{},[65,126,127],{},"Purpose:"," to invite you to FilmKit and, when your spot comes up, to send\nyou a sign-up link.",[73,130,131,133],{},[65,132,103],{}," steps taken at your request before entering into a contract\n(Art. 6(1)(b) GDPR); for the bot check, our legitimate interest in\nprotecting the form from abuse (Art. 6(1)(f) GDPR).",[73,135,136,138],{},[65,137,109],{}," until you create an account or ask us to remove you.",[14,140,141],{},"Our product analytics (section 3.11) also records that a waitlist request was\nmade, from which page, and whether it was a repeat request. It never receives\nyour email address or your name.",[90,143,145],{"id":144},"_33-your-account","3.3 Your account",[14,147,148],{},"To create and run your account we process your email address, your name,\npreferred language and time zone, and the public keys of your passkeys\n(FilmKit has no passwords; the private key never leaves your device). For\nevery sign-in session we store a session token, its expiry, the IP address and\nthe user agent. You can also connect calendar apps through a personal\ncalendar link.",[70,150,151,156,161],{},[73,152,153,155],{},[65,154,127],{}," to provide FilmKit, sign you in and keep your account secure.",[73,157,158,160],{},[65,159,103],{}," performance of our contract with you (Art. 6(1)(b) GDPR);\nfor security records, our legitimate interest (Art. 6(1)(f) GDPR).",[73,162,163,165],{},[65,164,109],{}," for as long as your account exists. Sessions end when they\nexpire or you sign out. To delete your account, write to the address in\nsection 1.",[90,167,169],{"id":168},"_34-projects-and-collaboration","3.4 Projects and collaboration",[14,171,172],{},"Everything you and your collaborators create in a Space is stored so it can be\nshared with the people you invite: screenplays, breakdowns, schedules, call\nsheets, storyboards, whiteboards, comments, footage logs, budgets and files.\nThe address book can hold names, roles, email addresses, phone numbers,\npostal addresses, emergency contacts and food preferences of cast and crew.",[14,174,175],{},"Food preferences can reveal health or religious beliefs. Spaces should only\nrecord them with the person's agreement, and only as far as needed for\ncatering.",[14,177,178],{},"The FilmKit apps and the web app keep a copy of the projects you open on your\ndevice, so you can keep working offline. Signing out removes your private\ncopies from the browser.",[70,180,181],{},[73,182,183,185],{},[65,184,103],{}," for your own use, performance of our contract\n(Art. 6(1)(b) GDPR). For data about other people, we process it on behalf\nof the Space (see section 2).",[90,187,189],{"id":188},"_35-emails-we-send","3.5 Emails we send",[14,191,192],{},"We send emails that belong to the service: sign-up and recovery links,\ninvitations, call sheets, screenplay deliveries, and casting messages such as\nself-tape requests and release notices. They are sent through Cloudflare's\nemail service. We record whether an address bounces, so we stop sending to\naddresses that do not exist.",[90,194,196],{"id":195},"_36-public-profiles-and-the-directory","3.6 Public profiles and the directory",[14,198,199],{},"You can create a profile as cast, crew or an organisation. Each profile has a\nvisibility you choose:",[70,201,202,208,214],{},[73,203,204,207],{},[65,205,206],{},"Hidden"," (the default): only you see it.",[73,209,210,213],{},[65,211,212],{},"Unlisted:"," anyone with the link can see it.",[73,215,216,219],{},[65,217,218],{},"Public:"," it appears in the FilmKit directory and in FilmKit's search,\nand search engines may index it.",[14,221,222],{},"Cast profiles can include physical attributes (such as height, hair and eye\ncolour, build, gender presentation, playing age), your birth year if you\nchoose to show it, languages, skills, credits, training, photos and\nshowreels. Only fill in what you want casting directors to see.",[70,224,225,230],{},[73,226,227,229],{},[65,228,103],{}," performance of our contract with you (Art. 6(1)(b) GDPR).\nWhere a profile contains special categories of data, you make it public\nyourself (Art. 9(2)(e) GDPR).",[73,231,232,234],{},[65,233,109],{}," until you delete the profile or your account.",[90,236,238],{"id":237},"_37-casting-calls-applications-and-self-tapes","3.7 Casting calls, applications and self-tapes",[14,240,241],{},"When you apply to a casting call or crew posting, we pass your application to\nthe Space that published it: your name, email address, message, profile,\nheadshots, showreel and any self-tapes you upload. Self-tapes and showreels\nare stored and streamed with Cloudflare Stream.",[70,243,244,249],{},[73,245,246,248],{},[65,247,103],{}," your request to apply (Art. 6(1)(b) GDPR). The Space then\nprocesses your application as its own controller.",[73,250,251,253],{},[65,252,109],{}," applicants who are not booked and did not agree to stay in\nthe Space's talent pool are anonymised automatically after the period the\nSpace sets, by default 6 months after the call closes.",[90,255,257],{"id":256},"_38-ai-features","3.8 AI features",[14,259,260],{},"FilmKit's AI features are optional. They only run when someone in your Space\nuses them, and only with the content needed for the request:",[262,263,264,280],"table",{},[265,266,267],"thead",{},[268,269,270,274,277],"tr",{},[271,272,273],"th",{},"Feature",[271,275,276],{},"Provider",[271,278,279],{},"Location",[281,282,283,295,306,317],"tbody",{},[268,284,285,289,292],{},[286,287,288],"td",{},"AI assistant, storyboard text suggestions",[286,290,291],{},"Mistral AI SAS",[286,293,294],{},"EU",[268,296,297,300,303],{},[286,298,299],{},"Storyboard frames, character reference images",[286,301,302],{},"IONOS SE (AI Model Hub)",[286,304,305],{},"Germany",[268,307,308,311,314],{},[286,309,310],{},"Image generation (alternative provider, when enabled)",[286,312,313],{},"Microsoft Ireland Operations Ltd. (Azure OpenAI)",[286,315,316],{},"EU (Sweden)",[268,318,319,322,325],{},[286,320,321],{},"Search over project content, handwriting recognition, assistant fallback",[286,323,324],{},"Cloudflare, Inc. (Workers AI)",[286,326,327],{},"Cloudflare network",[14,329,330],{},"You can also connect your own AI assistant (for example Claude) to FilmKit\nthrough our MCP server. When you do, the assistant reads and writes what you\nallow, and the provider of that assistant processes it under your agreement\nwith them.",[70,332,333],{},[73,334,335,337],{},[65,336,103],{}," performance of our contract (Art. 6(1)(b) GDPR); for data\nabout other people, on behalf of the Space (section 2).",[90,339,341],{"id":340},"_39-maps-addresses-and-weather","3.9 Maps, addresses and weather",[70,343,344,350,356],{},[73,345,346,349],{},[65,347,348],{},"Map tiles"," for locations are loaded by your browser from Stadia Maps\n(USA), which therefore receives your IP address.",[73,351,352,355],{},[65,353,354],{},"Addresses"," you enter for locations are turned into coordinates by our\nserver using OpenStreetMap's Nominatim service (OpenStreetMap Foundation,\nUK). Nominatim receives the address, not your IP address.",[73,357,358,361],{},[65,359,360],{},"Weather forecasts"," for shooting days come from Open-Meteo (Switzerland),\nwhich receives the coordinates and date from our server.",[14,363,364],{},"Legal basis: performance of our contract (Art. 6(1)(b) GDPR).",[90,366,368],{"id":367},"_310-link-previews","3.10 Link previews",[14,370,371],{},"When you paste a link on a whiteboard, our server fetches the page to show a\ntitle and preview image. For some sites (for example YouTube or Google\nDrive), your browser loads the preview image directly from that site, which\nthen receives your IP address.",[90,373,375],{"id":374},"_311-product-analytics-with-posthog","3.11 Product analytics with PostHog",[14,377,378],{},"We use PostHog to understand how FilmKit is used, to find errors and to\ndecide what to improve. PostHog is our only analytics service. Your browser\nsends events to r.filmkit.app, our own address that forwards them to\nPostHog's EU cloud (PostHog Inc., data hosted in Frankfurt, Germany).",[14,380,381],{},"What PostHog receives: the pages you view, clicks on buttons and links,\nerrors, the type of browser and device, screen size, the referring page and\nyour approximate location (country and city). We have set up PostHog so\nthat:",[70,383,384,390,396],{},[73,385,386,389],{},[65,387,388],{},"Your IP address is discarded"," before events are stored. With your\nconsent, the approximate location is derived from it first; without\nconsent, no location is recorded.",[73,391,392,395],{},[65,393,394],{},"No text from the page is captured."," Clicks are recorded without the text\nof what you clicked, page titles are removed, and secret links (review,\ninvite, casting and similar links) are removed from addresses before they\nleave your browser.",[73,397,398],{},[65,399,400],{},"Session recording is off.",[14,402,403,404,407],{},"PostHog processes this data only on our behalf and under our instructions\n(a data processing agreement), so it has no switch of its own: your choice for\n",[65,405,406],{},"Analytics"," in the cookie banner decides how PostHog works:",[70,409,410,416],{},[73,411,412,415],{},[65,413,414],{},"With consent",", PostHog stores an identifier in a cookie and in\nyour browser's local storage, so it can recognise your browser across\nvisits. If you are signed in, we link the events to your FilmKit user ID\nand record only three facts about you: whether you are a FilmKit staff\nmember (so we can leave our own use out), the language you use FilmKit in,\nand the date your account was created. Never your name, email address or\nanything you write. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1)\nTDDDG).",[73,417,418,421],{},[65,419,420],{},"Without consent",", or before you choose, PostHog stores nothing on your\ndevice and reads nothing from it (\"cookieless mode\"). To count visitors\nwithout a cookie, PostHog's servers compute a code from your IP address\nand browser type together with a secret that changes every day, and keep\nonly that code, not the IP address or browser type. Because the code\nchanges daily, visits on different days cannot be connected, and we do not\nlink events to your account. Legal basis: our\nlegitimate interest in understanding how FilmKit is used in aggregate\n(Art. 6(1)(f) GDPR). You can object at any time by writing to us.",[14,423,424],{},"Some events are sent by our servers rather than your browser (for example\nwhen an action completes on the server). They follow the same choice: our\nservers read your cookie-banner choice, and without consent they neither link\nthe event to your account nor to your browser.",[14,426,427,428,431],{},"Every event records which purposes, and which advertising partners, you\nconsented to, so later processing can respect your choice. We keep analytics events for\n24 months and then delete them. You can change your choice at\nany time under ",[65,429,430],{},"Cookie settings"," at the bottom of every public page or in\nyour account menu.",[90,433,435],{"id":434},"_312-your-cookie-banner-choice","3.12 Your cookie-banner choice",[14,437,438,439,441],{},"We store your choice in a cookie on your device (see the\n",[21,440,24],{"href":23},"). When you are signed in, we also store it on your\naccount: which purposes and which advertising partners you allowed, when you\ndecided, and on which kind of device (web, iOS, Android). That way your choice\napplies on your other devices once you sign in there, the most recent choice\nwins, and our servers respect it too. We keep a history of your choices so we\ncan show that we had your consent (Art. 7(1) GDPR).",[70,443,444,449],{},[73,445,446,448],{},[65,447,103],{}," our legal obligation to be able to demonstrate consent\n(Art. 6(1)(c) GDPR) and our legitimate interest in respecting your choice on\nevery device (Art. 6(1)(f) GDPR).",[73,450,451,453],{},[65,452,109],{}," for as long as your account exists.",[90,455,457],{"id":456},"_313-advertising-partners","3.13 Advertising partners",[14,459,460,461,464,465,468],{},"With your consent to the ",[65,462,463],{},"Marketing"," purpose and to the partner concerned,\nwe may in future pass selected events (for\nexample that you signed up) from PostHog to advertising partners such as\nMeta, to measure whether our advertising works. Only events from people who\nconsented to that partner will be passed on. ",[65,466,467],{},"At present we do not pass any\ndata to advertising partners."," Before we start, we will name each partner\nhere and in the cookie policy, and the cookie banner will ask you about it. Legal basis: your consent (Art. 6(1)(a) GDPR).",[27,470,472],{"id":471},"_4-who-receives-data","4. Who receives data",[14,474,475],{},"We use the following service providers, bound by data processing agreements:",[262,477,478,487],{},[265,479,480],{},[268,481,482,484],{},[271,483,276],{},[271,485,486],{},"Purpose",[281,488,489,497,505,513,521,529,537,545,553],{},[268,490,491,494],{},[286,492,493],{},"Cloudflare, Inc. (USA)",[286,495,496],{},"Hosting, databases and file storage (EU jurisdiction for our main databases and files), video (Stream), email delivery, bot protection (Turnstile), Workers AI, logs",[268,498,499,502],{},[286,500,501],{},"PostHog Inc. (USA), EU cloud in Germany",[286,503,504],{},"Product analytics (section 3.11)",[268,506,507,510],{},[286,508,509],{},"Mistral AI SAS (France)",[286,511,512],{},"AI assistant (section 3.8)",[268,514,515,518],{},[286,516,517],{},"IONOS SE (Germany)",[286,519,520],{},"AI image generation (section 3.8)",[268,522,523,526],{},[286,524,525],{},"Microsoft Ireland Operations Ltd.",[286,527,528],{},"AI image generation, when enabled (section 3.8)",[268,530,531,534],{},[286,532,533],{},"Infomaniak Network SA (Switzerland)",[286,535,536],{},"Self-hosted search (Meilisearch) for public profiles, open calls, docs and per-Space project content",[268,538,539,542],{},[286,540,541],{},"Stadia Maps, Inc. (USA)",[286,543,544],{},"Map tiles (section 3.9)",[268,546,547,550],{},[286,548,549],{},"OpenStreetMap Foundation (UK)",[286,551,552],{},"Address lookup (section 3.9)",[268,554,555,558],{},[286,556,557],{},"Open-Meteo (Switzerland)",[286,559,560],{},"Weather forecasts (section 3.9)",[14,562,563],{},"Besides these, data goes to the people you share it with: members of your\nSpaces, people you send call sheets, screenplays or share links to, and the\nSpaces you apply to. Public profiles are visible to everyone.",[14,565,566],{},"We do not sell personal data.",[27,568,570],{"id":569},"_5-transfers-outside-the-eu","5. Transfers outside the EU",[14,572,573],{},"Some providers are based in the USA or process data there (Cloudflare,\nPostHog, Stadia Maps). These transfers rely on the\nEuropean Commission's adequacy decision for the EU-US Data Privacy Framework\nwhere the provider is certified, and otherwise on the EU Standard Contractual\nClauses (Art. 46(2)(c) GDPR). Switzerland and the United Kingdom are covered by\nadequacy decisions.",[27,575,577],{"id":576},"_6-how-long-we-keep-data","6. How long we keep data",[14,579,580],{},"We keep personal data for as long as it is needed for the purposes above, as\nstated in each section. Backups are deleted after 14 days. Where the law\nrequires us to keep records (for example tax records), we keep them for the\nlegally required period.",[27,582,584],{"id":583},"_7-your-rights","7. Your rights",[14,586,587],{},"You have the right to:",[70,589,590,596,603,610,616,619,625,634],{},[73,591,592,595],{},[65,593,594],{},"access"," the data we hold about you (Art. 15 GDPR);",[73,597,598,599,602],{},"have incorrect data ",[65,600,601],{},"corrected"," (Art. 16 GDPR);",[73,604,605,606,609],{},"have your data ",[65,607,608],{},"deleted"," (Art. 17 GDPR);",[73,611,612,615],{},[65,613,614],{},"restrict"," processing (Art. 18 GDPR);",[73,617,618],{},"receive your data in a portable format (Art. 20 GDPR);",[73,620,621,624],{},[65,622,623],{},"object"," to processing based on our legitimate interest (Art. 21 GDPR);",[73,626,627,630,631,633],{},[65,628,629],{},"withdraw your consent"," at any time, with effect for the future\n(Art. 7(3) GDPR), for example under ",[65,632,430],{},";",[73,635,636,639],{},[65,637,638],{},"lodge a complaint"," with a data protection supervisory authority, in\nparticular in the EU country where you live or work.",[14,641,642],{},"To exercise your rights, write to the address in section 1. For data a Space\nstores about you, please contact that Space's organisation (section 2).",[27,644,646],{"id":645},"_8-security","8. Security",[14,648,649],{},"All connections to FilmKit are encrypted (TLS). Sign-in uses passkeys, so\nthere are no passwords to steal. Access to Space data is limited to the\nSpace's members and to the people they share it with. Secret links expire.",[27,651,653],{"id":652},"_9-children","9. Children",[14,655,656],{},"FilmKit is not meant for children under 16. Casting calls for minors must be\nhandled by a parent or guardian.",[27,658,660],{"id":659},"_10-changes","10. Changes",[14,662,663],{},"We will update this policy when FilmKit or the law changes. The date at the\ntop shows the last change. If a change affects what you consented to, we will\nask you again.",{"title":665,"searchDepth":666,"depth":666,"links":667},"",2,[668,669,670,686,687,688,689,690,691,692],{"id":29,"depth":666,"text":30},{"id":59,"depth":666,"text":60},{"id":87,"depth":666,"text":88,"children":671},[672,674,675,676,677,678,679,680,681,682,683,684,685],{"id":92,"depth":673,"text":93},3,{"id":116,"depth":673,"text":117},{"id":144,"depth":673,"text":145},{"id":168,"depth":673,"text":169},{"id":188,"depth":673,"text":189},{"id":195,"depth":673,"text":196},{"id":237,"depth":673,"text":238},{"id":256,"depth":673,"text":257},{"id":340,"depth":673,"text":341},{"id":367,"depth":673,"text":368},{"id":374,"depth":673,"text":375},{"id":434,"depth":673,"text":435},{"id":456,"depth":673,"text":457},{"id":471,"depth":666,"text":472},{"id":569,"depth":666,"text":570},{"id":576,"depth":666,"text":577},{"id":583,"depth":666,"text":584},{"id":645,"depth":666,"text":646},{"id":652,"depth":666,"text":653},{"id":659,"depth":666,"text":660},"How FilmKit collects, uses and protects personal data, and the rights you have.","md",{},true,"\u002Flegal\u002Fprivacy",{"title":5,"description":693},"legal\u002Fprivacy","2026-10-14","XRZLw-TS42An1AcyaJS_zp5B5_hi4lbwqzN_mfpBsOU",1792139018221]