Privacy policy

1. Who is responsible

Controller within the meaning of Art. 4(7) GDPR:

⟨TO BE COMPLETED⟩ (name) ⟨TO BE COMPLETED⟩ (address) ⟨TO BE COMPLETED⟩ (email)

We have not appointed a Data Protection Officer. Given the scale and nature of this service, Art. 37 GDPR does not require one. Write to the address above with any data protection question.

2. What we store, and on what basis

Your account: your email address. We need it to create your account and send you the link you sign in with. Legal basis: Art. 6(1)(b) GDPR — performance of a contract (your membership).

Your profile: handle, display name, an optional alias, short bio, city, profile photo, up to six gallery photos, your role and skill tags, and — if you choose to add them — a contact email address, an Instagram handle and a website. Legal basis: Art. 6(1)(b) GDPR. Being findable by other members is the purpose of a directory.

Your credits: title, your role, year, format, an optional link and note.

Your crew calls: title, description, what you are looking for or offering, a role tag, and an optional image.

Server logs: our hosting providers record IP address, time, the page requested and your browser's user agent, for security and troubleshooting. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in running the service securely.

Moderation: administrators can hide a profile or a post, and mark a member as verified. Legal basis: Art. 6(1)(f) GDPR — keeping the community usable.

We do not profile you, we do not make automated decisions about you, and we do not process any special categories of data under Art. 9 GDPR.

3. Who can see what

Public to anyone, signed in or not: your handle, display name, alias, bio, city, photos, roles, credits, your website link, and any crew call you publish.

Signed-in members only: your contact email address and Instagram handle. They are not readable by anyone who is not signed in — this is enforced in the database, not only in the interface.

Never shown publicly: the email address you sign in with.

A crew call keeps its address after it expires, so a link shared in a chat still works, but it drops off the board and off your public profile.

4. Cookies

We set only the cookies needed to keep you signed in. No analytics, no advertising, no tracking, no third-party cookies. Under § 25(2) TDDDG strictly necessary cookies require no consent, which is why you are not asked to dismiss a banner.

Signing out removes them.

5. Processors

Supabase (database, sign-in, file storage) — data stored in the EU, on a data processing agreement.

Vercel (hosting) — the application runs in the Frankfurt region.

Resend (sign-in emails) — EU region, on a data processing agreement. ⟨TO BE COMPLETED⟩: remove this line if email is not yet wired at launch.

Both Supabase and Vercel are US companies whose EU infrastructure we use. Support and administrative access from outside the EU cannot be ruled out; those transfers are covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

6. How long we keep it

Your profile and everything on it: until you remove it, or until you ask us to delete your account.

Crew calls: they leave the board 30 days after posting and stay on your own page until you delete them.

Server logs: kept by our providers for a short period for security purposes and then deleted.

Ask us to delete your account and we remove your profile, your photos, your credits and your posts. Content that other members have already copied or shared elsewhere is outside our reach.

7. Your rights

You have the right to access your data (Art. 15), correct it (Art. 16), have it deleted (Art. 17), restrict how we process it (Art. 18), receive it in a portable form (Art. 20), and object to processing based on legitimate interest (Art. 21).

Most of this you can do yourself: everything on your profile is editable, you can delete any post at any time, and there is a Delete my account button on your profile that removes your profile, photos, credits and posts immediately. For a full export of your data, write to the address in section 1. We answer within one month.

Where processing rests on your consent, you may withdraw it at any time, without affecting anything done before you did.

You may also complain to a supervisory authority. For us that is: ⟨TO BE COMPLETED⟩ (competent authority — for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin).

8. Do you have to give us this data?

No law obliges you to. But without an email address you cannot have an account, and without a photo and at least one role your profile does not appear in the directory — that is a rule of the directory, not a legal requirement.

9. Changes

If we change how we handle your data, we update this page and the date at the top. Substantial changes will be announced to members.