Privacy Notice

Last updated: July 27, 2026

1. Who we are

SceneSmith Studio (the "Service") is operated by Joshua Ellis, a sole proprietor trading as SceneSmith Studio. Joshua Ellis is the data controller for personal data processed through the Service.

2. Personal data we collect

• Account data: name, email address, hashed password or OAuth identifier, profile picture.
• Content you create: screenplays, characters, notes, pitch materials, storyboards, table-read audio, and other project content.
• Collaboration data: invitations, comments, roles, and activity within shared projects.
• Support messages: content of messages you send us.
• Usage and telemetry: pages visited, feature usage, errors, timestamps.
• Device data: browser type, operating system, device identifiers, IP address, approximate location derived from IP.
• Billing data: handled by our Merchant of Record, Stripe. We receive a subscription status and customer identifier — we do not receive your card details.

3. Why we use it (purposes and legal bases)

• Provide the Service (account creation, hosting your content, AI features, collaboration) — performance of a contract.
• Billing and subscription management — performance of a contract and legal obligation (tax records).
• Security, fraud prevention, abuse detection — legitimate interests.
• Product improvement and analytics — legitimate interests.
• Customer support — performance of a contract.
• Service announcements and legal notices — legitimate interests or legal obligation.
• Marketing emails, where applicable — consent, which you can withdraw at any time.

4. AI processing

When you use AI features, the prompts and relevant project context are sent to third-party AI providers (e.g. Lovable AI Gateway, ElevenLabs for voice) to generate a response. We do not sell your content and we do not use your private project content to train foundation models.

5. Who we share it with

• Stripe — Merchant of Record for sales, subscription management, payments, tax compliance, invoicing, and refunds.
• Supabase — database, authentication, and storage hosting.
• Lovable — application hosting and AI gateway.
• ElevenLabs — text-to-speech for the Table Read feature (only when you use it).
• Analytics providers — aggregated, non-identifying traffic analytics.
• Professional advisers — legal, accounting, where necessary.
• Authorities — where required by law or to protect our rights.

We do not sell your personal data.

6. International transfers

Some of our processors are located outside your country, including in the United States and the European Economic Area. Where personal data is transferred out of the UK/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Retention

We keep your personal data for as long as your account is active and as long as needed to provide the Service. If you delete your account, we delete or anonymise your personal data within 90 days, except where we must keep records to comply with legal or tax obligations (typically 6–7 years for billing records).

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. UK/EEA users have these rights under the UK GDPR and EU GDPR, and the right to lodge a complaint with a supervisory authority. We will respond to verified requests within one month. To exercise a right, contact us via the support channel in your account settings.

9. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest for our database and storage, access controls, role-based permissions, row-level security, and regular dependency scanning.

10. Cookies

We use strictly necessary cookies for authentication and session management, and privacy-respecting analytics cookies to understand aggregate usage. We do not use advertising cookies. You can manage cookies via your browser settings.

11. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

12. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be notified via email or an in-app notice.

13. Contact

For any privacy question or to exercise your rights, contact Joshua Ellis via the support channel in your account settings. For billing-related privacy queries, you can also contact Stripe at billing.stripe.com.