Privacy Policy

Effective Date: 20/12/2025 | Last Updated: 25/10/2026

This Privacy Policy (hereinafter referred to as “Policy”) describes how Cinemate Technologies Private Limited, a company incorporated under the laws of India, having its registered office in Mumbai, India (hereinafter referred to as “Cinemate,” “Company,” “we,” “us,” or “our”), receives, uses, stores, processes, transfers, and protects the personal information and data of individuals (hereinafter referred to as “User,” “you,” or “your”) who access or use the Cinemate™ platform, including the website at www.cinemate.tech, all associated sub-domains, mobile applications, software-as-a-service (SaaS) offerings, APIs, and related services (collectively, the “Platform”).

By ticking the box at sign-up you agree to the Terms and acknowledge this Policy.

1. Information We Receive

1.1. Information You Provide Directly

• Account registration information, including your full name, email address, phone number, and password. Your password is stored in a securely hashed format and is never stored or accessible in plain text.
• Billing and payment information, including billing address, organisation name, GSTIN (for Indian business Users), and payment method details. Full payment card details are processed and stored exclusively by our payment gateway provider (Razorpay) and are never stored on the Company’s servers.
• Profile information, including your role in the film industry, professional background, and any other details you choose to provide.
• User Content, including screenplays, scripts, production documents, media files, notes, and any other material you upload, create, or store on the Platform. Your User Content remains your intellectual property at all times, as described in the Terms and Conditions.
• Communications, including messages sent to our support team, feedback, survey responses, and any other correspondence.

1.2. Information Received Automatically

• Device and browser information, including IP address, browser type and version, operating system, device identifiers, screen resolution, and language preferences.
• Usage data, including pages viewed, features used, clickstream data, session duration, referring URLs, and interaction patterns within the Platform.
• Log data, including server logs, error reports, access timestamps, and API call records.

1.3. Information from Third Parties

• Authentication providers, if you choose to sign in using a third-party service (e.g., Google, Apple).
• Payment gateway data, including transaction confirmations, payment status, and billing identifiers provided by Razorpay.

1A. Data We Collect, Why, Legal Basis and Retention

2. How We Use Your Information

We use the information received for the following purposes:

• To create, maintain, and administer your Account and provide the Services.
• To process payments, manage subscriptions, and generate invoices.
• To communicate with you regarding your Account, including service announcements, security alerts, billing notifications, and responses to your enquiries.
• To personalise your experience on the Platform, including displaying pricing in your local currency.
• To improve, develop, and optimise the Platform, including through aggregated and anonymised analytics, testing, and research. We do not use individually identifiable User Content for this purpose.
• To provide AI-powered features, which may involve processing User Content through AI models to generate suggestions and outputs at the User’s request. Text you choose to run through AI features is sent to the AI providers listed in Section 5 to produce the result. We do not use your User Content to train AI models. See Section 5A for AI chat history and the AI notice.
• To detect, prevent, and address fraud, security incidents, and violations of our Terms and Conditions.
• To comply with applicable legal obligations, regulatory requirements, and lawful requests from governmental authorities.
• To enforce our Terms and Conditions and protect the rights, property, and safety of the Company, our Users, and the public.

3. Legal Basis for Processing

Depending on your jurisdiction, we process your personal data on one or more of the following legal bases:

Contractual Necessity: Processing is necessary for the performance of the contract between you and the Company.

Consent: You have provided explicit consent for specific processing activities (e.g., marketing communications, optional analytics). You may withdraw such consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Legitimate Interests: Processing is necessary for the legitimate interests pursued by the Company, including improving the Platform, ensuring security, and preventing fraud.

Legal Obligation: Processing is necessary for compliance with a legal obligation to which the Company is subject.

4. Data Storage, Security, and Retention

4.1. Your data is stored on secure cloud infrastructure. We employ industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption of data in transit and at rest using industry-standard encryption protocols.
• Access controls and role-based permissions limiting access to personal data to authorised personnel on a need-to-know basis.
• We review our security regularly.
• Encrypted backups (see Section 4.2).

4.2. Personal data shall be retained only for as long as is necessary to fulfil the purposes for which it was received, or as required by applicable law. When a User requests deletion of their Account, the Account is deactivated immediately and a backup of the Account and its User Content is held for twenty-eight (28) days. After that period the backup is permanently deleted and the Account record is anonymised. Payment, invoice, and tax records are kept for as long as the law requires. Encrypted backups of the live system are kept for up to sixty (60) to ninety (90) days and are then overwritten; a deleted Account may therefore remain in backups for that period, but is not restored into the live system except as described in Section 4.3. For the avoidance of doubt, deletion of User Content from the Company’s servers does not extinguish, transfer, or otherwise affect the User’s intellectual property rights in such Content.

4.3. Deleting Your Account

You can delete your Account from Settings > Account. If you own projects that are shared with other people, you must first transfer each of them to a member or choose to delete them before the deletion can proceed.

Your Account is deactivated immediately. A backup of your Account and its content is held for twenty-eight (28) days, after which it is permanently deleted and the Account record is anonymised so that it can no longer identify you.

If you sign in, or sign up again with the same email address, within twenty-eight (28) days of your deletion request, you will be shown a prompt (right after sign-up and profile confirmation) asking whether to restore your previous data or start fresh. Nothing is restored without your confirmation. If you start fresh, your old data is permanently deleted, including projects you own that are shared with other people (they will lose access).

You may also request deletion of your data by emailing support@cinemate.tech from your registered email address with a subject line starting “Deletion of my Data”. Such a request is processed within twenty-eight (28) days. You may ask for immediate deletion, in which case the 28-day restore option no longer applies.

Payment, invoice, and tax records are kept for the period required by applicable law. Copies held in encrypted backups are overwritten in the course of our normal sixty (60) to ninety (90) day backup cycle. Content you shared in other people’s projects (such as comments and activity) may remain without your personal identifiers.

4.4. Your Data Export

You can download your data from Settings > Account > Download my data. This gives you a zip file containing your profile (without secrets such as passwords), the projects you own, your activity and sign-in history, AI chat history, support tickets, private notes, archive entries, consent records and a billing summary.

5. Sharing and Disclosure of Information

5.1. The Company does not and will never sell, rent, lease, or trade your personal information or User Content to any third party for commercial purposes.

5.2. We may share your personal data in the following limited circumstances:

Service Providers: With trusted third-party service providers who assist us in operating the Platform, including cloud hosting providers, payment processors (Razorpay), email delivery services, and AI model providers. All such service providers are bound by contractual obligations to protect your data and process it solely on our instructions.

Our Service Providers (processors):

• Vercel (hosting and request handling)
• Neon (database)
• Backblaze B2 (file storage)
• Cloudflare (Turnstile anti-bot checks and real-time collaboration)
• ZeptoMail by Zoho (email delivery)
• Razorpay (payments)
• Google (Gemini and Vertex AI for AI features; Google sign-in)
• Anthropic, Hugging Face and RunPod (AI features)
• ipwho.is and ipapi.co (estimating location from IP address)
• Geoapify (place search suggestions)
• jsDelivr (content delivery of code libraries)

Service Provider Categories: The services we rely on to operate the Platform fall into these categories: hosting and request handling, database hosting, file storage, real-time collaboration, transactional email, anti-bot verification, AI features (which may process the text you submit to them), location estimation from IP address (for currency display and account activity records), place search suggestions, and content delivery.

Legal Requirements: When required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers: In connection with a merger, acquisition, reorganisation, or sale of assets, in which case your personal data may be transferred as part of the transaction, subject to the acquirer’s agreement to honour this Policy.

With Your Consent: In any other circumstances where you have provided express consent to the disclosure.

5A. AI Features Notice

Text you choose to run through AI features is sent to the AI providers named in Section 5 to produce the result. Your AI chat history is stored in your Account until you delete it. AI-generated output is machine-generated and may be inaccurate; please review it before relying on it. We do not make decisions about you with legal or similarly significant effect using automated means.

6. Cross-Border Data Transfers

6.1. Your personal data may be transferred to, stored in, and processed in countries other than your country of residence, depending on the location of the Company’s service providers and infrastructure.

6.2. Where such transfers occur, we shall ensure that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection laws, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions by the relevant data protection authority, or other legally recognised transfer mechanisms.

7. Cookies and Tracking Technologies

7.1. The Platform sets only strictly necessary cookies, used for sign-in, session management and security (including anti-bot checks and payment checkout). We do not set analytics, advertising or preference cookies, and we do not use cookies for third-party tracking.

7.2. Because only strictly necessary cookies are used, no cookie consent banner is shown. If this changes, we will add a consent banner before any non-essential cookie is set. You can block cookies in your browser settings, but the Platform will not work without the necessary ones.

8. Your Rights

Subject to the law that applies to you, you have these rights over your personal data:

• Access: get a copy of the data we hold about you (Settings > Account > Download my data).
• Correction: have inaccurate or incomplete data corrected.
• Erasure: delete your Account from Settings > Account (see Section 4.3), or email support@cinemate.tech from your registered email address with a subject line starting “Deletion of my Data”.
• Restriction and objection: ask us to restrict, or object to, certain processing.
• Portability: receive your data in a structured, commonly used, machine-readable format (your export).
• Withdraw consent: at any time, for example marketing emails in Settings > Privacy, without affecting earlier processing.
• Nominate a person (India, DPDP Act): name someone to exercise your rights if you die or cannot act, in Settings > Privacy.
• Grievance redressal: contact our Grievance Officer (Section 12.4).
• Complaint: to the Data Protection Board of India (under the DPDP Act) or, if you are in the EU or UK, to your supervisory authority.

To exercise a right, use Settings > Privacy (correction, restriction and objection requests), or email legal@cinemate.tech from your registered email address. We respond within 90 days (DPDP Act), one month (GDPR; extendable where the law allows) or 45 days (CCPA), according to where you live. We do not make automated decisions about you with legal or similarly significant effect.

9. Children’s Privacy

The Platform is not intended for individuals under the age of eighteen (18) years, or under the age of legal majority in their jurisdiction, whichever is greater (18+ only). The Company does not knowingly receive personal data from children. If we become aware that personal data has been received from a child, we shall take prompt steps to delete such data. If you believe that a child has provided personal data to us, please contact us at support@cinemate.tech.

10. Third-Party Links

The Platform may contain links to third-party websites, services, or applications. This Policy does not apply to such third-party services, and we are not responsible for their privacy practices. We strongly encourage you to review the privacy policies of any third-party service before providing any personal information.

11. Changes to This Policy

This Policy is version-dated (see “Last Updated”). If we make material changes, we will notify you by email or in the Platform and ask you to accept the updated version again before you continue. Minor corrections that do not change your rights may be posted with a revised “Last Updated” date.

12. Jurisdiction-Specific Privacy Provisions

The following provisions acknowledge certain data protection principles applicable in specific jurisdictions. The governing law for all matters relating to this Policy shall be the law of India, and the exclusive jurisdiction for any disputes shall be the courts at Mumbai, Maharashtra, India.

12.1. European Union / European Economic Area (EU/EEA)

If you are located in the EU/EEA, the following additional provisions are acknowledged under the General Data Protection Regulation (GDPR):

• Data Controller: Cinemate Technologies Private Limited is the data controller responsible for processing your personal data.
• Legal Bases: We process your personal data on the legal bases set forth in Section 3 above, which are aligned with Article 6 of the GDPR.
• For GDPR-related enquiries, please contact us at legal@cinemate.tech with the subject line “GDPR Enquiry.”
• Cross-Border Transfers: Transfers of personal data outside the EU/EEA are conducted pursuant to Standard Contractual Clauses (SCCs) or other legally recognised mechanisms.

12.2. United Kingdom (UK)

If you are located in the United Kingdom, the provisions applicable to EU/EEA Users in Section 12.1 above apply equally to UK Users, with references to the GDPR interpreted as references to the UK GDPR. Cross-border transfers of personal data from the UK are conducted pursuant to the International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as applicable.

12.3. United States of America (USA) — Your Privacy Choices

If you are located in the United States, the following additional provisions are acknowledged:

California (CCPA/CPRA): If you are a California resident, you may have rights under the California Consumer Privacy Act, including:

• The right to know what personal information we receive, use, and disclose.
• The right to request deletion of your personal information.
• The right to opt out of the sale or sharing of your personal information. We do not and will never sell your personal information.
• The right to non-discrimination for exercising your privacy rights.
• The right to correct inaccurate personal information.

Categories collected: identifiers (name, email, phone, IP address), commercial information (plan and billing records), internet and device activity (login history, usage), approximate location (city, from IP address), and content you create (User Content and AI chat history).

Disclosure: we disclose these categories only to the service providers listed in Section 5, to run the Platform. We do not sell or share personal information for cross-context behavioural advertising.

Global Privacy Control: we honour the Global Privacy Control signal sent by your browser.

How to exercise your rights: use Settings > Privacy or email legal@cinemate.tech. An authorised agent may make a request for you with your written permission.

Appeals: if we refuse your request, you may appeal by emailing legal@cinemate.tech with the subject “Privacy appeal”.

Other US States: If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or any other US state with applicable consumer privacy legislation, you may have similar rights. To exercise your rights, contact legal@cinemate.tech; the appeal route above also applies.

12.4. India

If you are located in India, the following additional provisions apply:

• We comply with the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• We will comply with the Digital Personal Data Protection Act, 2023 (“DPDPA”) duties as they come into force.
• Grievance Officer: For any grievances related to the processing of personal data, you may contact our Grievance Team at legal@cinemate.tech. Grievance Team, Cinemate Technologies Private Limited. The Grievance Team shall acknowledge your complaint within twenty-four (24) hours and resolve it within thirty (30) days.

12.5. Australia

If you are located in Australia, we acknowledge the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and endeavour to comply with applicable requirements in our handling of personal data of Australian Users.

12.6. Canada

If you are located in Canada, we acknowledge the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy legislation, and endeavour to comply with applicable requirements in our handling of personal data of Canadian Users.

12.7. Worldwide Compliance

The Company’s data protection and privacy practices are designed and maintained to be compliant with applicable data protection and privacy laws worldwide. Notwithstanding such compliance, the governing law of this Policy and the exclusive jurisdiction for any disputes arising hereunder shall be the law of India and the courts at Mumbai, Maharashtra, India, respectively.

Contact Us

For any questions, concerns, or requests regarding this Policy or our data handling practices, please contact us at:

Cinemate Technologies Private Limited

Email: support@cinemate.tech

Website: www.cinemate.tech

Registered Office: Mumbai, India