Privacy Policy

We collect the information you provide directly, including account details, profile details, team and project information, contact details, photos, videos, audio, documents, messages, submissions, RSVP answers, survey responses, event registrations, listings, posts, billing selections, and any other content you upload or create inside Filmclusive.

Profile and directory data may include your name, email address, phone number, company, location, social links, credits, expertise tags, role selections, availability information, representative information, portfolio media, headshots, resumes, work samples, and other professional information you decide to add.

If you use contact-import features, we may collect names, email addresses, phone numbers, role, company, location, notes, credits, portfolio links, recruiter-provided context, profile photos, source labels, and social identifiers from CSV files, Google contacts, call sheets, Instagram imports, manual entry, or similar tools that you choose to use.

Depending on the feature, we may also collect payment and transaction records, invoice and subscription identifiers, donation or ticketing details, support requests, consent decisions, suppression or unsubscribe signals, and records needed to investigate fraud, abuse, legal complaints, or account security incidents.

We also collect technical and operational data such as authentication events, cookies, local storage values, consent preferences, security logs, device and browser information, IP-derived or general location signals, session and activity data, and page or performance analytics when those features are enabled by your settings and applicable consent controls.

We use personal information to run the service, authenticate users, host and display content, manage projects and teams, process uploads, deliver messages and notifications, complete event and directory workflows, process payments, prevent fraud and abuse, comply with legal obligations, and support users.

We also use information to maintain logs, troubleshoot incidents, measure product performance, and improve workflows. Some improvement and analytics uses depend on consent or opt-out controls described on our cookie and Do Not Sell pages.

If you choose to use AI or audio features, we use submitted content only to generate the requested result and operate the related workflow. Filmclusive does not use that content to train, fine-tune, evaluate, or improve a Filmclusive model. External AI or speech providers may process the content as described below.

We may also use contact and communication data to send transactional emails, outreach you initiate, account notices, roster notices, opportunity checks, unsubscribe confirmations, support replies, ticketing messages, and other workflow communications tied to the service you are using.

Filmclusive currently uses Firebase and related Google Cloud services for authentication, database storage, backend processing, and some application infrastructure. User uploads and file workflows may also use Bunny.net object storage. Billing data is processed through Stripe. Optional product analytics may use PostHog, and optional performance tooling may use Vercel Speed Insights. Error monitoring may use Sentry. Upstash supports rate limiting, while Cloudflare supports bot protection, workers, and managed DNS. Scheduling workflows may use Zoom. Email is sent through the currently configured SMTP provider. Some AI and speech features use Google Gemini, OpenAI, Google Cloud text-to-speech, or a browser-managed speech-recognition service.

If you connect Google services, we process Google OAuth tokens and the Google API data needed for the feature you turned on. Gmail access can read messages, headers, bodies, snippets, labels, filters, and attachments, and can send messages you compose or approve. Calendar access is limited to availability and meetings on calendars you own. Google Contacts access is read-only, supports separate connections for multiple accounts, and imports contact details into private roster drafts for your review. Optional weekly checks draft only newly created Google contacts; Filmclusive does not write to Google Contacts. Additional purpose, storage, retention, deletion, and Limited Use details appear in our Google API disclosure.

Filmclusive uses the YouTube API Services when a user supplies a YouTube video identifier for supported media workflows. We send the video identifier and ordinary request metadata to retrieve video metadata, statistics, or available caption metadata. YouTube and Google control the source data. Use of those features is subject to the YouTube Terms of Service; Google's privacy practices are described in the Google Privacy Policy.

Service providers may process data in the United States and other jurisdictions where they operate. By using Filmclusive, you understand that data may be processed on infrastructure controlled by those providers on our behalf.

The current service-provider categories are listed on our Service Providers page.

Uploaded files can include headshots, portfolio media, project documents, legal or onboarding documents, event photos, receipts, and other workflow assets. We store and process those files to provide the feature that required the upload.

Some guest or temporary document flows are stored for short-lived processing and may be deleted automatically. Authenticated account data may remain until you delete it, the related record is removed, or retention rules require cleanup.

If you use AI processing on uploaded or pasted material, do not submit anything you cannot accept being handled by a third-party model provider. Filmclusive requires verified zero-retention controls before model requests can leave the application, but a provider may still preserve material for a safety investigation or legal obligation.

AI processing is off unless an authenticated account explicitly allows it. Accounts known to belong to minors are blocked. Every supported outbound model request passes through one server control that checks the account preference, known-minor status, provider destination, request storage settings, and a provider evidence record reviewed within 90 days. Missing or stale evidence blocks the request.

Gemini requests require an attested paid service with training disabled and zero data retention. OpenAI requests require training disabled, zero data retention, and store: false. Google Cloud text-to-speech requires the provider's stateless, no-customer-content-logging control. Filmclusive does not currently operate fine-tuned models, embeddings, vector stores, or model-training datasets for product user content.

Content may include prompts, system instructions, scripts, documents, notes, tasks, profile and roster information, business-card images, audio, transcripts, event or scheduling details, and model outputs. Filmclusive stores minimized usage records such as provider, model, purpose, token counts, cost, and the governing evidence version; those usage records do not contain prompt or response text.

Temporary AI intake and usage records have bounded expiry fields. Filmclusive's intended schedule for saved call transcripts and their sessions is one year. Until an automatic deletion control is verified in the production environment, these records remain subject to account deletion or a verified privacy request. Provider-held data, historical records without ownership metadata, legal holds, and backups may require separate handling and may not be removed immediately.

You can allow or turn off future AI processing in Privacy Settings. Turning it off is enforced before the next provider call. It cannot recall a request already processed, reverse a provider safety review, or remove information already incorporated into a result you chose to save. Contact privacy@filmclusive.com for a verified provider-side deletion request.

Known minor accounts cannot use server-side AI or cloud speech processing. Do not submit another person's minor, health, government-identifier, financial-authentication, or similarly sensitive information to an AI workflow. Browser speech recognition is separate: Filmclusive does not upload that audio, but the browser or device provider may process it remotely under controls Filmclusive cannot verify.

If you use paid features, subscriptions, ticketing, donations, bookings, invoices, or related commerce tools, we and our payment providers may process customer identifiers, billing contacts, plan or product selections, invoices, payment status, transaction metadata, refunds, disputes, taxes, and accounting records.

Filmclusive does not store full payment card numbers in its application databases. Payment card handling is performed by payment processors such as Stripe according to the checkout or billing flow you choose to use.

Some service, booking, donation, or event workflows may include separate cancellation windows, refund policies, or payout records set by the applicable creator, provider, organizer, or payment flow.

If you upload or import contacts, you are responsible for making sure you have the rights and permissions needed to provide that information to Filmclusive and to use it for your workflow. This includes names, emails, phone numbers, social handles, profile photos, and any notes or classifications you attach to those contacts.

Imported contact data may be stored as private records tied to your account or team so you can manage rosters, recruiting, referrals, work opportunities, outreach, trusted collaborators, directory workflows, and related features. Filmclusive does not create a public profile from imported contact data, does not sell imported roster contact data, and does not share imported roster contact data into other customers' rosters.

Recipients can update private roster information, remove themselves from a roster, request deletion of imported contact data, stop opportunity emails from a sender, block a sender where supported, or report misuse. If a contact later creates or claims an account, some information may be linked to the new user record according to the relevant workflow, permissions, and privacy settings.

Sensitive identity fields should be supplied by the person, not imported by recruiters. EU and UK contact imports may be restricted until the relevant GDPR notice flow is complete.

Filmclusive includes roster relationship, opportunity email, and contact-control tools. We may store contact-permission decisions, suppression records, unsubscribe choices, delivery metadata, and related audit records so communication preferences can be honored and abuse can be investigated.

Roster owners may use imported private contacts for limited, relevant recruiting, referral, roster update, and work opportunity communications. They must not upload scraped, purchased, or unrelated email lists, and first outreach should identify who added the recipient, why they are being contacted, how to remove or delete contact data, how to stop opportunity emails, and where to review the privacy policy.

We share information with service providers that help us run Filmclusive, including providers for hosting, authentication, storage, payments, analytics, email, speech, AI processing, and connected Google features. We also share information when needed to comply with law, protect rights or safety, investigate abuse, or complete a transaction you request.

We may also share information with other users, team owners or admins, event organizers, project collaborators, booking counterparties, survey owners, applicants, invitees, or public viewers when that is the expected result of a feature you choose to use, such as public profiles, shared links, directory visibility, booking flows, group participation, survey responses, or event submissions.

We do not sell profile data as a separate data brokerage product. CPRA and related opt-out details are described on our Do Not Sell or Share page.

We do not sell imported roster contact data or share it into other customers' rosters.

Some processors are operational and may run to provide the service, keep accounts secure, complete requested transactions, or meet legal obligations. These include Firebase and Google Cloud, Stripe, Bunny.net, the configured SMTP provider, Sentry, Cloudflare, Slack security alerts, Zoom scheduling, OpenSRS domain registration, Google Maps and Places, Meta or Instagram import services, and Printful merch fulfillment when those features are used.

Other processors are consent-based or feature-choice based. Optional analytics uses PostHog and Vercel Speed Insights only after analytics consent and Do Not Sell or Global Privacy Control checks. Gmail, Google Calendar, and Google Contacts require a user-initiated Google connection and Google consent. YouTube metadata lookup runs only for a user-supplied video. All supported outbound model and cloud text-to-speech calls require server-enforced AI processing consent.

Filmclusive uses essential cookies to keep the service working and to preserve privacy choices. Optional analytics and some internal activity tracking are gated by consent and Do Not Sell controls in the current app.

When enabled, analytics is limited to application-defined event names, validated categorical or count properties, query-free route categories, bounded page-duration summaries, and aggregate performance metrics. Filmclusive disables PostHog autocapture, session replay, exception capture, surveys, persistent identity, and automatic page tracking. When disabled or opted out, these optional analytics flows should not run.

For current cookie and tracking details, see our Cookie Policy.

Users can manage many profile visibility settings in the app, including whether certain contact information is shown publicly. We also maintain consent controls for areas such as analytics, email tracking, marketing, AI processing, and Google-connected features. AI processing can be changed in Privacy Settings.

Authenticated users can request a self-service data export through the privacy export flow currently wired to Filmclusive's privacy route. Users can also schedule account deletion, cancel a scheduled deletion during the waiting period, or request immediate deletion in supported cases.

The current account deletion flow supports a scheduled deletion window of 24 hours or immediate deletion, depending on the option you choose in settings. Some legal, security, fraud-prevention, audit, or rights-fulfillment records may be retained even after deletion because they are excluded from self-service deletion.

We may ask you to verify your identity before completing certain privacy requests, especially when the request would expose, delete, or transfer account data. Team, organizational, or shared-workspace data may also require additional review before release or deletion.

Filmclusive is not intended for independent use by children under 13. A parent or guardian may create and manage a minor account through the family-account workflow after the required parental verification. Minor profiles are not eligible for public profile or directory visibility, server-side AI, or cloud speech processing. If you believe a child has provided personal information without appropriate authorization, contact us so we can review and remove it where appropriate.

Filmclusive may process photos, videos, audio, and identity-related professional information that can depict or describe a person. We do not intentionally require users to provide biometric identifiers for identity-recognition purposes, and we do not describe the service as a biometric-identification product.

Optional profile, project, casting, and roster workflows can include identity or lived-experience information such as ethnicity, disability, religion, Indigenous identity, gender, or sexual orientation. These fields can create heightened discrimination, harassment, or outing risk. Profile identity fields default to private unless the user makes a more permissive field-level choice, and minor profiles remain non-public. Sensitive HR document ingestion, including government IDs, passports, Social Security cards, tax forms, and bank-verification documents, is disabled unless Filmclusive completes and explicitly activates the required legal, access-isolation, retention, incident-response, and deletion controls.

Filmclusive is not approved to process protected health information on behalf of a HIPAA covered entity or business associate, and Filmclusive must not receive full payment-card numbers, CVV, PIN, magnetic-stripe data, or other sensitive authentication data. If you submit restricted material outside an approved workflow, we may restrict or remove it while securing the service, investigating the disclosure, or complying with law.

Depending on where you live, you may have rights to know, access, correct, delete, or opt out of certain processing or sharing. California residents can review our Do Not Sell or Share page for the current opt-out implementation.

We do not discriminate against users for exercising privacy rights, except to the extent a requested change prevents us from providing a feature that depends on the affected data or consent.

Retention depends on the type of data. User-controlled content is generally kept until you delete it, delete the related object, or delete your account. Imported roster contacts remain until the roster owner deletes them, the recipient deletes imported contact data, account retention rules apply, or a suppression record is retained for compliance. Gmail content and metadata are held in signed-in browser memory for the active session, while server-side Gmail label and filter caches expire after 90 days. YouTube API metadata saved into an owning Filmclusive record remains with that record and is removed through the record or account deletion path. Legal, security, audit, and rights-fulfillment records may be retained longer where necessary.

Suppression hashes may be retained after deletion or opt-out to prevent re-contact and honor recipient controls.

Our current privacy-rights map distinguishes user-controlled, operational, analytics, marketing, temporary, vendor, and legal or security retention classes, and some legal or security collections are intentionally excluded from self-service export or deletion.

When account deletion is completed, Filmclusive may also attempt related cleanup steps such as revoking Google OAuth tokens, deleting certain Stripe customer records, and removing user-scoped Bunny storage where supported by the current deletion workflow. Those vendor-side actions are best-effort and may be limited by provider rules, transaction history, or legal retention requirements.

We use technical and organizational controls intended to protect information, but no system is perfectly secure. You should avoid uploading secrets, government identifiers, tax documents, or other highly sensitive material unless the relevant workflow specifically requires it and you accept the risk of online storage and processing.

Questions, requests, or privacy complaints can be sent to privacy@filmclusive.com. General support requests may also be sent to support@filmclusive.com or by phone at (929) 255-4623.