Privacy Policy

1. Who We Are

SceneSend is operated by Castingcrowd Ltd, a company registered in England and Wales.

Registered with Companies House.

Registered Office:
3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE

Company Number: 16975080

For the purposes of UK data protection law, Castingcrowd Ltd is the Data Controller.

Contact:
Email: support@castingcrowd.com

2. Personal Data We Collect

A. Registered Users (Uploaders)

When you create an account, we collect:

• First name
• Last name
• Email address
• Encrypted password
• IP address
• Device/browser information
• Account activity logs
• Payment transaction data (via Stripe)

We do not store full card details. Payments are processed securely by Stripe.

B. Recipients (Code Access Users)

Recipients do not create accounts. However, we automatically collect:

• IP address
• Browser/device information
• Access timestamps
• Download logs

We do not require Recipients to provide names or email addresses to download files.

C. Uploaded Content

Uploaded files may contain personal data, including:

• Names
• Images
• Scripts and production documents
• Contact details
• Other identifiable information

Registered Users are responsible for ensuring they have a lawful basis to upload such data.

3. How We Use Personal Data

We process personal data to:

• Provide and operate the Service
• Authenticate Registered Users
• Enable temporary file transfer
• Process payments
• Maintain security and prevent abuse
• Comply with legal obligations

We do not sell personal data.

4. Lawful Bases for Processing

Under UK GDPR, we rely on:

Contractual Necessity
To create and maintain user accounts and provide the Service.

Legitimate Interests
To secure, monitor, and improve the Service.

Legal Obligation
To comply with applicable laws and regulatory requirements.

5. International Data Transfers

Our hosting infrastructure is located in the United States.

This means personal data may be transferred outside the United Kingdom.

Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• The UK International Data Transfer Addendum
• Transfers to providers participating in recognised adequacy mechanisms (where applicable)

Payment processing via Stripe may also involve international transfers subject to Stripe's compliance mechanisms.

6. Data Retention

Uploaded Files

Files are automatically deleted from active systems after 1 hour, 24 hours, or 48 hours (as selected).

Residual encrypted backup copies may persist temporarily for security and integrity purposes but are not accessible and are routinely purged.

Account Data

Account data is retained while the account remains active.

If an account is deleted, personal data will be removed unless retention is required for legal or regulatory purposes.

Security Logs

IP logs and security records may be retained for fraud prevention, abuse detection, and legal compliance.

7. Data Sharing

We may share data with:

• Hosting and infrastructure providers (including US-based providers)
• Payment processors
• IT and security service providers
• Legal authorities where required

All service providers are required to process data securely and lawfully.

8. Security Measures

We implement appropriate technical and organisational safeguards, including:

• Encryption of passwords
• Secure server environments
• Access controls
• Monitoring for unauthorised access
• Account-level two-factor authentication (2FA)
• Row-level security (RLS) policies ensuring user data isolation

SceneSend employs account-level 2FA and row-level security policies to ensure that your data is protected and isolated from other users at the database level.

However, no internet-based service can guarantee absolute security.

Users are responsible for safeguarding login credentials and access codes.

9. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
• Request correction
• Request erasure
• Restrict processing
• Object to processing
• Request data portability (where applicable)
• Lodge a complaint with the UK supervisory authority

The UK supervisory authority is the Information Commissioner's Office.

To exercise your rights, contact: support@castingcrowd.com

10. Children

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The most recent version will always be published on our website.