Privacy Policy

Information We Collect

How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: Provide, maintain, and improve our Services and features
• Account Management: Create and manage your account, authenticate users, and provide customer support
• Transaction Processing: Process payments, subscriptions, and billing through our payment processor (Stripe)
• Communications: Send transactional emails, notifications, updates, and administrative messages via Resend
• Calendar Integration: Sync events with Google Calendar and send meeting invitations
• Email Services: Send emails on your behalf through Gmail API (with your explicit permission)
• Personalization: Customize your experience, remember preferences, and provide relevant content
• Analytics: Monitor and analyze usage, trends, and activities to improve our Services
• Security: Detect, prevent, and address fraud, security threats, and technical issues
• Marketing: Send promotional communications, newsletters, and offers (with your consent; you may opt out)
• Legal Compliance: Comply with legal obligations, enforce our terms, and protect our rights
• Research & Development: Develop new features, products, and services

Third-Party Services We Use

We integrate with the following third-party services to provide our Services:

Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

• With Your Consent: We share information when you explicitly authorize us to do so
• Service Providers: We share with trusted third-party vendors under strict confidentiality agreements
• Team Collaboration: Information is shared with users you invite to collaborate within your account
• Business Transfers: In connection with a merger or acquisition, your information may be transferred (you will be notified)
• Legal Requirements: When required by law, subpoena, court order, or government request
• Fraud Prevention: To detect, prevent, or address fraud, security, or technical issues
• Aggregated Data: We may share anonymized, aggregated data that cannot identify you individually

Google API Data Use & Limited Use Policy

FilmLot360's use and transfer to any other app of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.

• We only request access to Google user data that is necessary to provide our Services
• We use Google user data only for the purposes disclosed in this Privacy Policy
• We do not use Gmail API data to serve advertisements
• We do not allow humans to read Gmail API data unless you give explicit consent, it's necessary for security, or required by law
• We do not transfer Gmail API data to third parties except as necessary to provide our Services or comply with applicable law
• You can revoke FilmLot360's access to your Google account at any time through Google Account settings

Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption: Industry-standard TLS/SSL encryption for data in transit and AES-256 encryption for data at rest
• Secure Authentication: Password hashing (bcrypt), OAuth 2.0, and multi-factor authentication support
• Access Controls: Role-based permissions, least-privilege access, and regular access reviews
• Security Audits: Regular security assessments, vulnerability scanning, and penetration testing
• Infrastructure Security: Secure data centers with physical and network security controls (via Supabase/GitHub)
• Employee Training: Staff trained on data protection, confidentiality, and security best practices
• Monitoring: Real-time monitoring for suspicious activity and security incidents
• Incident Response: Documented procedures for responding to security breaches

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience.

You can control cookies through your browser settings. Note that disabling essential cookies may limit functionality.

Your Rights and Choices

You have certain rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format (JSON/CSV)
• Objection: Object to certain processing activities, such as marketing
• Restriction: Request restriction of processing under certain circumstances
• Opt-Out: Unsubscribe from marketing communications via the link in emails or account settings
• Cookie Control: Manage cookie preferences through your browser settings
• Revoke Consent: Withdraw consent for Google API access through Google Account settings

To exercise these rights, please contact us at privacy@filmlot360.com. We will respond within 30 days.

California Residents: You have additional rights under the CCPA, including the right to know what personal information we collect and the right to opt-out of sale (we do not sell personal information).

EU/UK Residents: You have rights under the GDPR, including the right to lodge a complaint with your local data protection authority.

Data Retention

• Active Accounts: Personal and production data retained while your account is active
• Canceled Accounts: Data deleted within 90 days of account cancellation (unless legal retention required)
• Billing Records: Retained for 7 years to comply with tax and accounting regulations
• Legal Holds: Data retained longer if required by law, legal proceedings, or investigations
• Anonymized Data: Aggregated, de-identified data may be retained indefinitely for analytics

You can request early deletion of your data by contacting us, subject to our legal obligations.

Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@filmlot360.com. If we discover that we have collected personal information from a child under 18, we will delete that information promptly.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. We take appropriate safeguards including:

• Standard contractual clauses approved by the European Commission
• Data processing agreements with service providers
• Privacy Shield frameworks (where applicable)
• Encryption and security measures during transfer

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Last Updated" date at the top
• Sending you an email notification (for material changes)
• Displaying a prominent notice on our website

Your continued use of the Services after changes become effective constitutes acceptance of the modified Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, Cookie Policy, or our data practices, please contact us:

For EU/UK residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.