Privacy policy

This policy explains what personal data FilmKit processes when you visit filmkit.app, use the FilmKit web app or the FilmKit apps for iOS and Android, or connect an AI assistant to FilmKit. It also explains why we process it, who helps us and what rights you have.

How we use cookies and similar technologies is explained in more detail in our cookie policy.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Léonce Aklin
Sonneckstrasse 4
4416 Bubendorf
Switzerland
Email: info@zebrapig.com

Our data protection officer is Léonce Aklin, reachable at the same address and email.

2. Our role: controller or processor

FilmKit is a workspace that production companies, schools and other teams (each a Space) use to make films. Two situations need to be told apart:

• Your own account, our website and our public directory. For this data we decide why and how it is processed. We are the controller.
• What a Space stores about other people. Screenplays, schedules, call sheets, the address book with crew and cast contacts, casting submissions and everything else in a Space's projects is processed on behalf of the Space. The organisation running the Space is the controller of that data, and we act as its processor under Art. 28 GDPR. If you are listed in a Space's address book or applied to one of its casting calls, the organisation behind that Space is your first point of contact. We will forward requests that reach us.

3. What we process, why, and on which legal basis

3.1 Visiting the website and using the app

Whenever your browser or app talks to FilmKit, our hosting provider Cloudflare receives technical data: your IP address, the date and time, the requested address, the response, your browser and operating system (user agent) and the referring page. We need this to deliver FilmKit, to keep it secure and to find errors.

• Legal basis: our legitimate interest in a working, secure service (Art. 6(1)(f) GDPR).
• Retention: request logs are kept for a short period, normally no longer than 30 days, unless they are needed to investigate a specific security incident.

We also measure how fast pages load and respond (Core Web Vitals). These measurements contain the name of the page type, timings and the app version, but no user ID, no address of the page and no IP address. They are stored in Cloudflare Workers Analytics Engine. Legal basis: our legitimate interest in a fast product (Art. 6(1)(f) GDPR).

3.2 Waitlist

If you join the waitlist, we store your email address, your first and last name, the page you signed up from, the date, and the country derived from your IP address. To keep out bots, the form uses Cloudflare Turnstile, which checks your browser for signs of automation.

• Purpose: to invite you to FilmKit and, when your spot comes up, to send you a sign-up link.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for the bot check, our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).
• Retention: until you create an account or ask us to remove you.

Our product analytics (section 3.11) also records that a waitlist request was made, from which page, and whether it was a repeat request. It never receives your email address or your name.

3.3 Your account

To create and run your account we process your email address, your name, preferred language and time zone, and the public keys of your passkeys (FilmKit has no passwords; the private key never leaves your device). For every sign-in session we store a session token, its expiry, the IP address and the user agent. You can also connect calendar apps through a personal calendar link.

• Purpose: to provide FilmKit, sign you in and keep your account secure.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); for security records, our legitimate interest (Art. 6(1)(f) GDPR).
• Retention: for as long as your account exists. Sessions end when they expire or you sign out. To delete your account, write to the address in section 1.

3.4 Projects and collaboration

Everything you and your collaborators create in a Space is stored so it can be shared with the people you invite: screenplays, breakdowns, schedules, call sheets, storyboards, whiteboards, comments, footage logs, budgets and files. The address book can hold names, roles, email addresses, phone numbers, postal addresses, emergency contacts and food preferences of cast and crew.

Food preferences can reveal health or religious beliefs. Spaces should only record them with the person's agreement, and only as far as needed for catering.

The FilmKit apps and the web app keep a copy of the projects you open on your device, so you can keep working offline. Signing out removes your private copies from the browser.

• Legal basis: for your own use, performance of our contract (Art. 6(1)(b) GDPR). For data about other people, we process it on behalf of the Space (see section 2).

3.5 Emails we send

We send emails that belong to the service: sign-up and recovery links, invitations, call sheets, screenplay deliveries, and casting messages such as self-tape requests and release notices. They are sent through Cloudflare's email service. We record whether an address bounces, so we stop sending to addresses that do not exist.

3.6 Public profiles and the directory

You can create a profile as cast, crew or an organisation. Each profile has a visibility you choose:

• Hidden (the default): only you see it.
• Unlisted: anyone with the link can see it.
• Public: it appears in the FilmKit directory and in FilmKit's search, and search engines may index it.

Cast profiles can include physical attributes (such as height, hair and eye colour, build, gender presentation, playing age), your birth year if you choose to show it, languages, skills, credits, training, photos and showreels. Only fill in what you want casting directors to see.

• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Where a profile contains special categories of data, you make it public yourself (Art. 9(2)(e) GDPR).
• Retention: until you delete the profile or your account.

3.7 Casting calls, applications and self-tapes

When you apply to a casting call or crew posting, we pass your application to the Space that published it: your name, email address, message, profile, headshots, showreel and any self-tapes you upload. Self-tapes and showreels are stored and streamed with Cloudflare Stream.

• Legal basis: your request to apply (Art. 6(1)(b) GDPR). The Space then processes your application as its own controller.
• Retention: applicants who are not booked and did not agree to stay in the Space's talent pool are anonymised automatically after the period the Space sets, by default 6 months after the call closes.

3.8 AI features

FilmKit's AI features are optional. They only run when someone in your Space uses them, and only with the content needed for the request:

You can also connect your own AI assistant (for example Claude) to FilmKit through our MCP server. When you do, the assistant reads and writes what you allow, and the provider of that assistant processes it under your agreement with them.

• Legal basis: performance of our contract (Art. 6(1)(b) GDPR); for data about other people, on behalf of the Space (section 2).

3.9 Maps, addresses and weather

• Map tiles for locations are loaded by your browser from Stadia Maps (USA), which therefore receives your IP address.
• Addresses you enter for locations are turned into coordinates by our server using OpenStreetMap's Nominatim service (OpenStreetMap Foundation, UK). Nominatim receives the address, not your IP address.
• Weather forecasts for shooting days come from Open-Meteo (Switzerland), which receives the coordinates and date from our server.

Legal basis: performance of our contract (Art. 6(1)(b) GDPR).

3.10 Link previews

When you paste a link on a whiteboard, our server fetches the page to show a title and preview image. For some sites (for example YouTube or Google Drive), your browser loads the preview image directly from that site, which then receives your IP address.

3.11 Product analytics with PostHog

We use PostHog to understand how FilmKit is used, to find errors and to decide what to improve. PostHog is our only analytics service. Your browser sends events to r.filmkit.app, our own address that forwards them to PostHog's EU cloud (PostHog Inc., data hosted in Frankfurt, Germany).

What PostHog receives: the pages you view, clicks on buttons and links, errors, the type of browser and device, screen size, the referring page and your approximate location (country and city). We have set up PostHog so that:

• Your IP address is discarded before events are stored. With your consent, the approximate location is derived from it first; without consent, no location is recorded.
• No text from the page is captured. Clicks are recorded without the text of what you clicked, page titles are removed, and secret links (review, invite, casting and similar links) are removed from addresses before they leave your browser.
• Session recording is off.

PostHog processes this data only on our behalf and under our instructions (a data processing agreement), so it has no switch of its own: your choice for Analytics in the cookie banner decides how PostHog works:

• With consent, PostHog stores an identifier in a cookie and in your browser's local storage, so it can recognise your browser across visits. If you are signed in, we link the events to your FilmKit user ID and record only three facts about you: whether you are a FilmKit staff member (so we can leave our own use out), the language you use FilmKit in, and the date your account was created. Never your name, email address or anything you write. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Without consent, or before you choose, PostHog stores nothing on your device and reads nothing from it ("cookieless mode"). To count visitors without a cookie, PostHog's servers compute a code from your IP address and browser type together with a secret that changes every day, and keep only that code, not the IP address or browser type. Because the code changes daily, visits on different days cannot be connected, and we do not link events to your account. Legal basis: our legitimate interest in understanding how FilmKit is used in aggregate (Art. 6(1)(f) GDPR). You can object at any time by writing to us.

Some events are sent by our servers rather than your browser (for example when an action completes on the server). They follow the same choice: our servers read your cookie-banner choice, and without consent they neither link the event to your account nor to your browser.

Every event records which purposes, and which advertising partners, you consented to, so later processing can respect your choice. We keep analytics events for 24 months and then delete them. You can change your choice at any time under Cookie settings at the bottom of every public page or in your account menu.

3.12 Your cookie-banner choice

We store your choice in a cookie on your device (see the cookie policy). When you are signed in, we also store it on your account: which purposes and which advertising partners you allowed, when you decided, and on which kind of device (web, iOS, Android). That way your choice applies on your other devices once you sign in there, the most recent choice wins, and our servers respect it too. We keep a history of your choices so we can show that we had your consent (Art. 7(1) GDPR).

• Legal basis: our legal obligation to be able to demonstrate consent (Art. 6(1)(c) GDPR) and our legitimate interest in respecting your choice on every device (Art. 6(1)(f) GDPR).
• Retention: for as long as your account exists.

3.13 Advertising partners

With your consent to the Marketing purpose and to the partner concerned, we may in future pass selected events (for example that you signed up) from PostHog to advertising partners such as Meta, to measure whether our advertising works. Only events from people who consented to that partner will be passed on. At present we do not pass any data to advertising partners. Before we start, we will name each partner here and in the cookie policy, and the cookie banner will ask you about it. Legal basis: your consent (Art. 6(1)(a) GDPR).

4. Who receives data

We use the following service providers, bound by data processing agreements:

Besides these, data goes to the people you share it with: members of your Spaces, people you send call sheets, screenplays or share links to, and the Spaces you apply to. Public profiles are visible to everyone.

We do not sell personal data.

5. Transfers outside the EU

Some providers are based in the USA or process data there (Cloudflare, PostHog, Stadia Maps). These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Switzerland and the United Kingdom are covered by adequacy decisions.

6. How long we keep data

We keep personal data for as long as it is needed for the purposes above, as stated in each section. Backups are deleted after 14 days. Where the law requires us to keep records (for example tax records), we keep them for the legally required period.

7. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on our legitimate interest (Art. 21 GDPR);
• withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR), for example under Cookie settings;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

To exercise your rights, write to the address in section 1. For data a Space stores about you, please contact that Space's organisation (section 2).

8. Security

All connections to FilmKit are encrypted (TLS). Sign-in uses passkeys, so there are no passwords to steal. Access to Space data is limited to the Space's members and to the people they share it with. Secret links expire.

9. Children

FilmKit is not meant for children under 16. Casting calls for minors must be handled by a parent or guardian.

10. Changes

We will update this policy when FilmKit or the law changes. The date at the top shows the last change. If a change affects what you consented to, we will ask you again.