Privacy Policy

1. Who we are

‍

1.1 This policy explains how FilmTailor AI Ltd ("FilmTailor AI", "we", "us"), a company registered in England and Wales (company number 15669660) with its registered office at 21 Hibernia Street, Ramsgate, Kent, England, CT11 8HP, handles personal data on filmtailor.ai, app.filmtailorai.com and our Help Center (together, the "Service").

FilmTailor AI Ltd support@filmtailor.ai

1.2 You can contact us about privacy at support@filmtailor.ai.

1.3 This policy sits alongside our Terms of Service and Data Processing Agreement (DPA). Words such as "Content" and "Output" have the meanings given in the Terms of Service.

We may update this policy. For material changes we will give notice by email or in the Service before they take effect, and we will change the version and effective date above.

2. Our role: controller or processor

We act in two different roles, and which one applies depends on whose data it is.

The Service may link to third-party sites such as social media pages. We are not responsible for their content or privacy practices, so please read their policies.

• Your account, billing, usage and support details; website visitors; mailing list subscribers. We are the controller: we decide why and how it is used. To ask about this data, contact us using this policy.
• Personal data inside your Content, such as cast and crew names, contact details and call times. We are the processor: we act on your instructions under the DPA, and you or your production company is the controller. To ask about this data, contact the production company or person who added it.

If you are a cast or crew member and a production has added your details to FilmTailor AI, the production decides what is held about you and why. Ask them first. If you contact us, we will help you reach the right person.

We protect personal data with technical and organisational measures described in our Security Statement.  If we become aware of a personal data breach that puts people's rights at risk, we will notify the people and organisations the law requires, including the ICO within 72 hours where applicable and affected customers without undue delay.

3. Personal data we collect

3.1 Data you give us

The Service is for people aged 18 or over, and we do not knowingly collect data from anyone under 18 for our own purposes. If you think a child has given us personal data, please contact us and we will delete it. Production Content may include details of child performers; see clause 3.4.

• Account data: name, email address, password (stored only as a hash), organisation name.
• Content: scripts, treatments, images, reference material, schedules, call sheets, notes, and any cast, crew or contact details you add.
• Payment data: billing name, address and subscription details. Our payment provider (Mollie) collects and holds full card details. We store only the card brand and the last four digits.
• Communications: messages to our support team and Help Center chat, survey replies, and any email you send us.
• Mailing list data: your email address and name if you sign up for updates.

3.2 Data collected automatically

10.4 Browser storage. The app also uses your browser's local storage to remember your cookie choice and tutorial setting, to track a payment in progress, and to keep unsaved call sheet drafts, which can contain cast and crew names. This is stored on your own device.

• Usage data: features used, pages and screens viewed, actions taken, timestamps and AI usage counts.
• Device and technical data: IP address, browser and operating system, device type, language and approximate location derived from the IP address.
• Cookies and similar technologies: see section 10.

• next-auth session token (FilmTailor AI): keeps you signed in. Duration: up to 30 days. Type: essential.
• signup-token, login-token, reset-token, reset-password-token, invite-token (FilmTailor AI): complete a sign-up, sign-in, password reset or invite step. Duration: 15 minutes. Type: essential.
• _ga, _gid (Google Analytics): usage statistics. Duration: 2 years and 24 hours (Google defaults). Type: analytics, only after consent.
• Intercom cookies (Intercom): Help Center and support chat. Duration: . Type: support chat, consent needed.

3.3 Data from other sources. We do not currently receive data from third-party sign-in providers. If we turn on Google or Microsoft sign-in, we will receive your name and email address from that provider, and we will update this policy first. We receive payment confirmations from Mollie. Google Analytics collects usage data only after you consent to cookies.

10.3 The cookies we use:

3.4 Special category and children's data. Our tools have no fields for health, dietary or access information, and we do not ask for it. Free-text notes and uploaded documents can still contain it, and sometimes details of child performers. We do not use it for any purpose of our own. If you add it, you must have a lawful basis to do so (see clause 12.3 of the Terms of Service). Please add only what is necessary.

10.2 Essential cookies are always on. We ask for your consent before setting analytics cookies.

4. Why we use personal data

10.1 We use cookies and similar technologies to keep you signed in, complete sign-up and sign-in steps, understand how the Service is used, and run our Help Center and support chat.

Where we are the controller, UK GDPR requires a lawful basis for each use. This list shows ours. For data in your Content, we only process it on your instructions as your processor.

• Create and run your account, and provide the Service. Data used: account data, Content, usage data. Lawful basis: contract, because it is needed to provide the Service you signed up for.
• Take payment, manage subscriptions, issue invoices. Data used: account and payment data. Lawful basis: contract; legal obligation (tax and accounting records).
• Provide customer support and respond to requests. Data used: account data, communications, usage data. Lawful basis: contract; legitimate interests in helping users.
• Keep the Service secure, prevent fraud and abuse, enforce our terms. Data used: usage and technical data, account data. Lawful basis: legitimate interests in protecting the Service and users.
• Understand how the Service is used and improve it. Data used: usage and technical data. Lawful basis: legitimate interests in improving the product; consent where cookies require it.
• Send service messages such as receipts, security alerts and changes to terms. Data used: account data. Lawful basis: contract; legitimate interests.
• Send news, tips and offers about FilmTailor AI. Data used: name, email address. Lawful basis: consent, which you can withdraw at any time; or legitimate interests for existing customers where the law allows.
• Meet legal duties and respond to lawful requests. Data used: any data needed. Lawful basis: legal obligation.
• Manage customer email and contact records (Brevo). Data used: name, email address, plan, activity. Lawful basis: Legitmate interest and marketing.

9.5 If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment using the contact details above.

9.4 You can unsubscribe from marketing emails at any time using the link in them.

We do not sell personal data. Nothing in the Service scores, ranks or blocks people. The only automatic restrictions are limits when you run out of credits, and content moderation by our image provider, which may reject a prompt.

9.3 If your data is in a production's Content, we are the processor and will pass your request to the relevant customer, as the DPA requires.

5. AI features and your Content

9.2 To use a right, email support@filmtailor.ai. We may ask you to prove who you are. We will reply within one month, and tell you if we need longer for a complex request. There is no fee unless a request is clearly unfounded or excessive.

5.1 The Service uses AI models to analyse scripts, generate breakdowns and schedules, create moodboards and produce costume designs. To do this, we send the relevant parts of your Content and prompts to these providers: Azure OpenAI (UK South) for script text and prompts; Anthropic for the same data, where that feature is enabled; Stability AI for image prompts and reference images, together with an internal user ID; and Azure AI Document Intelligence for uploaded script PDFs. They act as our sub-processors (see section 6).

• be informed about how we use your data (this policy);
• access a copy of your personal data;
• correct data that is wrong or incomplete;
• erase your data in some circumstances;
• restrict how we use it in some circumstances;
• object to uses based on legitimate interests, and to direct marketing at any time;
• data portability, to receive data you gave us in a usable format where we process it by consent or contract; and
• withdraw consent at any time where we rely on it, without affecting earlier processing.

5.2 We do not use your Content or Output to train AI models offered to other customers, and we do not allow our AI providers to do so.

9.1 Under UK data protection law you have the right to:

5.3 We send only what the feature needs. Providers keep inputs and outputs only as their own terms allow, apart from short periods for abuse monitoring . We also keep a copy of the prompts you submit in your account.

5.4 Output is generated by software and can be inaccurate or can contain details that look like real people or existing works. Please review it before use, as set out in clause 9 of the Terms of Service.

We may keep data for longer where needed for a legal claim, a dispute, or to meet a legal duty.

5.5 Please think before you upload personal data. Production documents often name real people. Add only what a feature needs, and avoid sensitive details (such as medical information) unless your production has a lawful basis and a real need for them.

• Account data: while your account is open.
• Content and Output: while your account is open.
• AI prompts we store: stored prompts are never deleted.
• Invoices and payment records: Six years, as tax and accounting law requires.
• Support messages: Two years after the conversation closes.
• Application logs: 30 days.
• Mailing list: until you unsubscribe, or 24 months without engagement.

6. Who we share data with

We share personal data only where needed to run the Service, and never to sell it.

7.2 Where we send personal data from the UK to a country without a UK adequacy decision, we use an approved safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or rely on a provider's certification under the UK-US Data Bridge where it applies. You can ask us for a copy of the safeguards at the contact address above.

• Service providers (sub-processors). They help us with hosting, storage, AI processing, email, analytics and customer support. Examples: Microsoft Azure (hosting, database, storage, email sending, sign-in, monitoring), Azure OpenAI, Azure AI Document Intelligence, Anthropic, Stability AI, Intercom (Help Center and support chat), Google Analytics, Brevo (customer email and contact records).
• Payment provider. It takes payments and helps prevent fraud. Example: Mollie.
• Other people in your workspace. Team members and guests you invite can see the Content you share with them, such as your own colleagues and crew.
• Professional advisers and insurers. They give us legal, accounting and insurance advice, such as our solicitors and accountants.
• Authorities and courts. We share data where the law requires it, or to protect rights and safety, for example with regulators and law enforcement.
• A buyer or investor. If we sell, merge or raise funds, we may share data under confidentiality with prospective acquirers.

7.1 Our hosting, database, file storage and Azure OpenAI processing are in the UK (Microsoft Azure, UK South). Some of our other providers may process personal data outside the UK, including in the United States.

Our providers may use personal data only on our instructions and under written contracts that require appropriate security. The current list of sub-processors for Content is in Annex 3 of our Data Processing Agreement, and we will tell customers before adding or replacing one.

7. International transfers

7.1 Our hosting, database, file storage and Azure OpenAI processing are in the UK (Microsoft Azure, UK South). Some of our other providers may process personal data outside the UK, including in the United States .

7.2 Where we send personal data from the UK to a country without a UK adequacy decision, we use an approved safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or rely on a provider's certification under the UK-US Data Bridge where it applies. You can ask us for a copy of the safeguards at the contact address above.

8. How long we keep data

• Account data: while your account is open.
• Content and Output: while your account is open.
• AI prompts we store: stored prompts are never deleted today.
• Invoices and payment records: Six years, as tax and accounting law requires.
• Support messages: Two years after the conversation closes.
• Application logs: 30 days.
• Mailing list: until you unsubscribe, or 24 months without engagement.

We may keep data for longer where needed for a legal claim, a dispute, or to meet a legal duty.

9. Your rights

9.1 Under UK data protection law you have the right to:

• be informed about how we use your data (this policy);
• access a copy of your personal data;
• correct data that is wrong or incomplete;
• erase your data in some circumstances;
• restrict how we use it in some circumstances;
• object to uses based on legitimate interests, and to direct marketing at any time;
• data portability, to receive data you gave us in a usable format where we process it by consent or contract; and
• withdraw consent at any time where we rely on it, without affecting earlier processing.

9.2 To use a right, email [support@filmtailor.ai. We may ask you to prove who you are. We will reply within one month, and tell you if we need longer for a complex request. There is no fee unless a request is clearly unfounded or excessive.

9.3 If your data is in a production's Content, we are the processor and will pass your request to the relevant customer, as the DPA requires.

9.4 You can unsubscribe from marketing emails at any time using the link in them.

9.5 If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

10. Cookies and similar technologies

10.1 We use cookies and similar technologies to keep you signed in, complete sign-up and sign-in steps, understand how the Service is used, and run our Help Center and support chat.

10.2 Essential cookies are always on. We ask for your consent before setting analytics cookies.

10.3 The cookies we use:

• next-auth session token (FilmTailor AI): keeps you signed in. Duration: up to 30 days. Type: essential.
• signup-token, login-token, reset-token, reset-password-token, invite-token (FilmTailor AI): complete a sign-up, sign-in, password reset or invite step. Duration: 15 minutes. Type: essential.
• _ga, _gid (Google Analytics): usage statistics. Duration: 2 years and 24 hours (Google defaults). Type: analytics, only after consent.
• Intercom cookies (Intercom): Help Center and support chat. Duration: . Type: support chat, consent needed.

10.4 Browser storage. The app also uses your browser's local storage to remember your cookie choice and tutorial setting, to track a payment in progress, and to keep unsaved call sheet drafts, which can contain cast and crew names. This is stored on your own device.

11. Children

The Service is for people aged 18 or over, and we do not knowingly collect data from anyone under 18 for our own purposes. If you think a child has given us personal data, please contact us and we will delete it. Production Content may include details of child performers; see clause 3.4.

12. Security

We protect personal data with technical and organisational measures described in our Security Statement.  If we become aware of a personal data breach that puts people's rights at risk, we will notify the people and organisations the law requires, including the ICO within 72 hours where applicable and affected customers without undue delay.

13. Links to other sites

The Service may link to third-party sites such as social media pages. We are not responsible for their content or privacy practices, so please read their policies.

14. Changes to this policy

We may update this policy. For material changes we will give notice by email or in the Service before they take effect, and we will change the version and effective date above.

15. Contact us

FilmTailor AI Ltd support@filmtailor.ai

‍