Privacy Policy

Last updated: July 3, 2026

This Privacy Policy describes how Production Slate LLC ("Production Slate," "we," "us," or "our"), a New York limited liability company located at 418 Broadway STE N, Albany, NY 12207, United States, collects, uses, stores, and shares your personal information when you use our web-based production management platform ("the Service").

Production Slate LLC is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR), UK GDPR, and other applicable data protection laws.

1. Information We Collect

Account information: Name, email address, and profile picture (via Google OAuth or manual registration). This is collected to create and manage your account.

Google user data: When you sign in with Google, we access your Google account name, email address, and profile picture via Google OAuth 2.0. This data is used solely for account creation and identification within the Service. We do not access any other Google data such as Gmail, Google Drive, Google Calendar, or any other Google services. We do not transfer Google user data to third parties except as described in section 5.

Production data: Projects, budgets, schedules, crew information, locations, shot lists, call sheets, equipment, talent, and other data you create within the Service.

Payment information: Processed securely by Stripe. We store your Stripe customer ID and subscription status but do not store credit card numbers or bank details.

Usage data: Pages visited, features used, browser type, device type, IP address, and referring URLs. Collected via Google Analytics 4 only with your consent.

Notification preferences: Your email notification settings, stored in your user profile.

2. Legal Basis for Processing (GDPR/UK GDPR)

We process your personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)): Account information and production data are processed to provide the Service you signed up for.
  • Legitimate interests (Art. 6(1)(f)): Usage data (when consented), security monitoring, and fraud prevention. Our legitimate interest is maintaining and improving the Service.
  • Consent (Art. 6(1)(a)): Analytics cookies and marketing communications. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): Where we are required to retain data by law (e.g., tax/billing records).

3. How We Use Information

We use your information to:

  • Provide, maintain, and improve the Service
  • Process payments and manage subscriptions
  • Send in-app and email notifications based on your preferences
  • Provide customer support
  • Monitor for security threats and abuse
  • Comply with legal obligations
  • Analyze usage patterns to improve the Service (with your consent via analytics cookies)

4. Data Storage & International Transfers

Your data is stored securely in Supabase (hosted on AWS) in the United States. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Encrypted database backups are stored with Backblaze in the United States and automatically deleted after 30 days.

International transfers: If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your data is transferred to the United States. These transfers are protected by:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Appropriate supplementary measures including encryption and access controls

If you are located in Australia, your data is transferred overseas as described above. By using the Service, you acknowledge this transfer. We take reasonable steps to ensure overseas recipients handle your data in accordance with the Australian Privacy Principles.

5. Data Sharing & Sub-Processors

We do not sell your personal data. We share data only with the following service providers (sub-processors) who process data on our behalf:

  • Supabase (AWS) — Database hosting (United States) — stores all account and production data
  • Backblaze — Backup storage (United States) — stores encrypted nightly database backups, retained for up to 30 days
  • Stripe — Payment processing (United States) — processes subscription payments
  • Vercel — Application hosting (United States) — serves the web application
  • Google Analytics — Usage analytics (United States) — collects anonymized usage data with your consent only
  • Resend — Email delivery (United States) — sends invitation and notification emails, and call sheet distribution emails with delivery-confirmation tracking
  • Meta & LinkedIn — Advertising measurement (United States) — receive marketing-page interaction events only after you grant cookie consent (see section 9)

We may also disclose your information if required by law, regulation, legal process, or governmental request.

6. Administrative Access

Authorized employees of Production Slate LLC ("super administrators") may access, view, and review any user account information, project data, production content, and usage activity within the Service. This access is used for customer support, troubleshooting, enforcing our Terms of Service, ensuring platform integrity, investigating potential violations, and improving the Service. Administrative actions — including account changes, password resets, and account deletions — are logged in an internal audit trail.

7. Project Sharing & Directory Connections

When you share a project with another user, they gain access to that project's data based on their assigned role (viewer or editor). You control who has access and can revoke it at any time.

Crew directory connections: Organizations can add your email to their crew directory. If your email matches a Production Slate account, you will receive a connection request notification. You choose whether to accept or decline:

  • Accept: Your display name and profile photo are shared with the organization's directory. The organization retains their own role, department, and notes for you.
  • Decline: No profile data is shared. The organization keeps only the contact information they entered manually. Your user account is unlinked from their directory entry.

You can respond to each organization's request independently. Connection requests are visible on your Notifications page.

8. Data Retention

We retain your data as follows:

  • Account and production data: Retained as long as your account is active.
  • After account deletion: All associated data is immediately removed from our live database. This includes your profile, projects, crew, budget, schedule, and all related records. Residual copies may persist in encrypted backups for up to 30 days before being automatically purged; backups are used only for disaster recovery and are never used to reconstruct deleted accounts.
  • Backups: Encrypted database backups are created nightly and automatically deleted after 30 days.
  • Billing records: Retained for 7 years as required by tax law.
  • Server logs: Retained for up to 90 days for security and debugging purposes.
  • Analytics data: Google Analytics retains data for 14 months (Google's default setting).

9. Cookies & Analytics

Essential cookies: Used for authentication and session management. These are strictly necessary for the Service to function and are always active. Legal basis: contract performance.

Analytics cookies: We use Google Analytics 4 (property G-TJ6CYJTNBE) to understand how the Service is used. Analytics cookies are only set after you provide consent via our cookie banner. You may decline analytics cookies and the Service will continue to work normally. You can change your preference at any time by clearing your browser's local storage and revisiting the site.

Marketing tags: Our public marketing pages (not the logged-in application) use the Meta (Facebook) Pixel and the LinkedIn Insight Tag to measure the effectiveness of our advertising. These tags are only activated after you grant consent via our cookie banner; if you decline, they do not set cookies or send data. We do not use cross-context behavioral advertising within the Service itself, and we never share your production data with advertising platforms.

10. Email Notifications

We send email notifications for events such as task assignments, project invitations, equipment updates, and administrative broadcasts. You control which types of email notifications you receive through your notification preferences in Settings. You may disable all email notifications at any time. Disabling email notifications does not affect in-app notifications.

11. Your Rights

Depending on your location, you have the following rights regarding your personal data:

All users

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your account and data

EU/UK residents (GDPR / UK GDPR)

  • Data portability: Receive your data in a structured, commonly used, machine-readable format
  • Restrict processing: Request restriction of processing in certain circumstances
  • Object to processing: Object to processing based on legitimate interests
  • Withdraw consent: Withdraw consent at any time (for consent-based processing like analytics)
  • Lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority (e.g., the ICO in the UK, CNIL in France, or the relevant authority in your EU member state)

California residents (CCPA/CPRA)

  • Right to know: You may request the categories and specific pieces of personal information we have collected about you
  • Right to delete: You may request deletion of your personal information
  • Right to opt out of sale: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising
  • Non-discrimination: We will not discriminate against you for exercising your CCPA rights

Australian residents (Privacy Act 1988)

  • You have rights under the Australian Privacy Principles (APPs) to access and correct your personal information
  • If you believe we have breached the APPs, you may lodge a complaint with us first, and then with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

Canadian residents (PIPEDA)

  • You have the right to access your personal information and challenge its accuracy
  • You may withdraw consent for non-essential processing at any time
  • You may lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, contact us at hello@prodslate.com. We will respond within 30 days (or sooner if required by your local law).

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Row Level Security (RLS) policies on all database tables
  • JWT-based authentication with secure session management
  • Access controls limiting employee access to authorized personnel
  • Audit logging of administrative actions

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by GDPR)
  • Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms
  • Notify the Australian Information Commissioner as required under the Notifiable Data Breaches scheme
  • Report to the Office of the Privacy Commissioner of Canada as required under PIPEDA

14. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at hello@prodslate.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 30 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

16. Contact & Data Protection Inquiries

For privacy-related questions, data access requests, or complaints, contact us at:

Production Slate LLC
418 Broadway STE N
Albany, NY 12207
United States
Email: hello@prodslate.com

We aim to respond to all requests within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

We use cookies for analytics to improve your experience. See our Privacy Policy.