Privacy Policy

Last updated: February 23, 2026

CinePlan is operated by Cherrium LLC (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the CinePlan web application at cineplan.cherrium.com (the “Service”).

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name and email address. If you sign in with GitHub or Google OAuth, we receive your name, email, and profile image from the provider. Passwords are stored as bcrypt hashes — we never store plaintext passwords.

1.2 Production Data

Data you enter into CinePlan, including production titles, shooting day schedules, activity types, locations, equipment, budget items, shot lists, task boards, storyboard images, and file uploads.

1.3 Contact Data

You may add production contacts (crew members, vendors, talent) including their name, role, email, phone, and company. Contact email addresses and phone numbers are encrypted at rest using AES-256-GCM encryption before storage.

You are responsible for having appropriate consent or legitimate interest to store another person's contact information in CinePlan. We act as a data processor for contact data — you are the data controller.

1.4 Payment Information

Payment processing is handled entirely by Stripe, Inc. We never receive, see, or store your credit card number. We store only Stripe customer and subscription identifiers to manage your billing.

1.5 Analytics Data

We collect anonymous page view analytics using a cookie-less, privacy-by-design system. Visitor identity is derived from a SHA-256 hash of your IP address, user agent, and the current date — this hash rotates daily and cannot be reversed. We do not use tracking cookies or third-party analytics services. No consent banner is required because no personal data is stored for analytics purposes.

1.6 Technical Data

Standard server logs (IP address, browser type, request timestamps) are processed by our hosting provider and retained temporarily for security and operational purposes.

2. How We Use Your Information

• Provide, operate, and improve the Service
• Authenticate your identity and secure your account
• Process payments and manage subscriptions (via Stripe)
• Send transactional emails — password resets, team invitations, email verification, and notification emails (via Resend)
• Generate AI-powered features such as schedule suggestions, script breakdowns, and call sheets (via OpenAI — see Section 3)
• Provide real-time collaboration for Team plan subscribers (via Liveblocks)
• Aggregate anonymous analytics to understand usage patterns

Legal Basis for Processing (GDPR)

Where the EU General Data Protection Regulation (GDPR) applies, we process personal data under the following legal bases:

• Contractual necessity (Art. 6(1)(b)): Account data and production data — required to provide the Service you signed up for.
• Legitimate interest (Art. 6(1)(f)): Anonymous analytics — to understand usage patterns and improve the Service. Security logging — to detect and prevent abuse.
• Consent (Art. 6(1)(a)): Optional transactional email preferences — you can opt out in Settings at any time.

3. AI Data Processing

When you use AI features (script breakdown, smart scheduler, call sheet generation), your production data — including schedule rows, locations, equipment, and production contacts (names, roles, emails, phones) — is sent to OpenAI for processing.

• OpenAI processes data per their API data usage policy: API inputs and outputs are not used to train models.
• Data is transmitted over encrypted connections (TLS).
• We send only the minimum data necessary for the AI feature.
• You can choose not to use AI features — all core scheduling, catalog, and collaboration features work without AI.

4. Sub-Processors

We use the following third-party services to operate CinePlan. Each processes data only as necessary to provide their service:

All sub-processors are US-based. Data is stored and processed in the United States.

5. Data Security

• All data in transit is encrypted via TLS (HTTPS enforced via HSTS).
• Passwords are hashed with bcrypt.
• Two-factor authentication secrets are encrypted with AES-256-GCM.
• Contact email and phone fields are encrypted at rest with AES-256-GCM.
• Security tokens (password reset, email verification, team invitations) are stored as SHA-256 hashes.
• Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
• Rate limiting on authentication endpoints and sensitive operations.
• Upload security: allowlist validation, magic byte verification, file count caps.

6. Data Retention

• Account data: Retained until you delete your account.
• Production data: Retained until you delete the production or your account.
• Analytics: Page views and events purged after 90 days. Resolved error logs purged after 30 days.
• Uploaded files: Retained until you delete the file or the production. Stored in Vercel Blob.
• Server logs: Retained per Vercel's standard log retention policy.

7. Your Rights

Depending on your jurisdiction (including under GDPR, CCPA/CPRA, and other applicable laws), you may have the following rights:

• Access: Request a copy of your personal data (available via “Download My Data” in Settings).
• Correction: Update your profile information in Settings.
• Deletion: Delete your account via Settings → Danger Zone. This permanently removes all your data.
• Portability: Export your data as JSON via the “Download My Data” feature.
• Opt out of AI processing: Simply don't use AI features. No production data is sent to OpenAI unless you initiate an AI action.

To exercise any right not covered by the self-service features above, contact us at hello@cherrium.com.

8. Children's Privacy

CinePlan is not intended for users under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. International Data Transfers

All data is processed and stored in the United States. If you access CinePlan from outside the US, your data will be transferred to and processed in the US. We rely on our sub-processors' Standard Contractual Clauses (SCCs) and DPAs to provide appropriate safeguards for international transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice in the Service. Continued use after changes constitutes acceptance.

11. Contact Us

Cherrium LLC
Email: hello@cherrium.com
Website: cherrium.com

For data protection inquiries or to request a Data Processing Agreement, see our DPA page.