Privacy Policy

This Privacy Policy explains how [PLACEHOLDER: legal entity name] ("Production Swell," "we," "us") collects, uses, and shares information in connection with the Production Swell platform at productionswell.com and related services (the "Service"). By using the Service you agree to this Policy.

1. Who this Policy covers, and our role

Production Swell is a business-to-business tool used by creative-production studios ("Studios") to run their operations.

• Studio account data. When a Studio enters information about its own clients, contractors, crew, projects, and finances, the Studio is the controller of that information and Production Swell acts as a processor handling it on the Studio's behalf and instructions.
• Studio and account-holder data. For information about the Studio and its account holders (for example, your name, email, billing details, and how you use the Service), Production Swell acts as a controller.

If you are a client, contractor, or crew member of a Studio, please direct privacy requests to that Studio; we will assist them as their processor.

2. Information we collect

You or your Studio provide

• Account information — name, email, organization name, and authentication data, handled through our authentication provider.
• Operational data you enter — leads, clients, projects, proposals, contracts, invoices, contractor and crew records, deal memos, budgets, locations, call sheets, and similar records.
• Uploaded files — for example contracts, signed documents, tax forms (such as W-9s), receipts, photos, and other media you upload.
• Payment information — processed by our payment provider (Stripe). We do not store full card numbers; we retain limited billing metadata such as plan, status, and transaction references.
• AI inputs — text, transcripts, images, or documents you submit to AI-powered features.
• Communications — messages you send us (for example, support requests).

Collected automatically

• Usage and device data — log data, IP address, browser and device information, pages viewed, and feature usage.
• E-signature metadata — for documents signed through the Service, we record the signer name, timestamp, IP address, and user agent as part of the signature audit trail (required for electronic-signature compliance).
• Cookies — see our Cookie Policy.

3. How we use information

• To provide, operate, secure, and improve the Service.
• To authenticate users and manage organizations and subscriptions.
• To process payments and, where you enable it, to facilitate payouts to your crew and vendors through our payment provider.
• To power AI features you choose to use.
• To send transactional messages by email and, where configured, SMS (for example, call-sheet distribution and reminders).
• To respond to support requests and communicate with you.
• To detect, prevent, and address fraud, abuse, and security or technical issues, and to comply with legal obligations.

4. AI features

Certain features send your inputs to third-party AI providers (currently Anthropic for text and vision, and OpenAI for audio transcription) to generate output. We send only the data needed to perform the requested action. We do not use your data to train our own models, and our providers process API inputs under their commercial terms (which, as of the date above, do not train their models on API content). AI output may be inaccurate; you are responsible for reviewing it before relying on it.

5. Service providers and sub-processors

We share information with vendors who process it on our behalf to run the Service, under contracts that require appropriate protection:

• Clerk — authentication and organization management.
• Supabase — database, file storage, and realtime data.
• Stripe — payments, subscription billing, and crew/vendor payouts (Stripe Connect).
• Anthropic — AI text and vision features.
• OpenAI — audio transcription.
• Resend — transactional email delivery.
• Twilio — SMS delivery.
• Vercel — application hosting and infrastructure.

[PLACEHOLDER: confirm this list is complete and current before launch.] We do not sell your personal information.

6. How we share information

We may disclose information:

• To the Studio whose account the data belongs to, and to users within that organization per its access controls.
• To the service providers listed above.
• To comply with law, legal process, or enforceable governmental requests, and to protect our rights, users, and the public.
• In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. Data retention

We retain information for as long as your account is active or as needed to provide the Service, and thereafter as required to comply with legal obligations, resolve disputes, and enforce agreements. Certain records, such as electronic-signature audit records, are retained for compliance and are not deleted on request where the law requires their preservation. [PLACEHOLDER: confirm specific retention periods.]

8. Security

We use technical and organizational measures designed to protect information, including encryption in transit, access controls, and tenant-isolation so that each Studio's data is segregated. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International transfers

We and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers. [PLACEHOLDER: confirm transfer mechanism, e.g. SCCs.]

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object to certain processing. To exercise these rights, contact us at hello@productionswell.com. If your data is held by a Studio as controller, we will refer your request to that Studio. We will not discriminate against you for exercising your rights. [PLACEHOLDER: add jurisdiction-specific disclosures (e.g. GDPR/UK GDPR, CCPA/CPRA) as applicable.]

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the "Last updated" date, and will provide additional notice where required.

13. Contact us

Questions about this Policy or our data practices? Contact hello@productionswell.com [PLACEHOLDER: add legal entity, postal address, and any required EU/UK representative or DPO contact.]