Privacy notice
Information under Articles 13 and 14 GDPR · Datenschutzerklärung
Three fields still missing: the postal address, the Supabase project's region, and how long the web server keeps its access logs — that last one is a setting on the server, so the number here has to match what is actually configured. Everything else describes how the service works.
1. Who is responsible
Controller for the processing described here:
Fabian Schier, trading as Camwood
STREET AND NUMBER · POSTCODE AND TOWN, Germany
Email: info@camwood.de ·
Imprint
No data protection officer has been appointed. One is required under Art. 37 GDPR and § 38 BDSG only in cases that do not apply here — in particular from twenty people regularly engaged in processing personal data.
2. Visiting this website
The landing page and these legal pages load no third-party resources. There is no analytics, no advertising network, no social plugin, no external font service and no tracking cookie — the typeface is served from this domain, and there is nothing on these pages that needs consent under § 25 TTDSG.
Like any website, the pages you request are delivered by a web server, which writes the usual access data to a log file: the requested address, the date and time, the amount of data transferred, whether the request succeeded, your browser and operating system, and your IP address. This is necessary to deliver the page and to recognise attacks, and it is processed on the basis of a legitimate interest, Art. 6 (1) (f) GDPR. It is not used to identify you and it is not combined with any other data.
This site runs on a server rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a German data centre. A data processing agreement under Art. 28 GDPR is in place with Hetzner. Access logs are kept for NUMBER OF DAYS — must match the log rotation actually configured on the server and are then deleted.
3. Using the tool
Everything in this section happens only once you have an account and are signed in.
What is processed
| Data | Why |
|---|---|
| Your email address and a password hash | To create the account and to sign you in. This is what identifies you in your organisation. |
| Organisation name, membership and role | To decide what you may see and do, and to show your colleagues who is on the team. |
| The screenplays you upload and everything derived from them — scenes, elements, ratings, notes, comments, sticky notes | This is the service. It is your production data, kept for your organisation only. |
| An activity log: who did what, and when | So a team can see how a breakdown came about, and so a change can be traced. It contains the acting person's identifier. |
| Your settings, including the reader font and the brightness position | So the tool looks the same on your next machine. Also kept in your browser's local storage. |
Legal basis: performance of the contract with your organisation, Art. 6 (1) (b) GDPR. A screenplay you upload may itself contain personal data; in that case your organisation is the controller for it and we process it on your instructions as a processor under Art. 28 GDPR.
What is not done with it
- Screenplays, breakdowns and account data are never sold or passed to anyone for their own purposes.
- They are not used to train any AI model.
- Nothing is sent to an AI provider by this service. The AI passes work by giving you a prepared prompt that you paste into your own ChatGPT or Claude and paste the answer back from — whatever you paste there is governed by your agreement with that provider, not by this one.
- There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR.
Sign-in and session
Signing in stores an access token and a refresh token in your browser's local storage, and nothing else. These are strictly necessary to keep you signed in, so no consent banner asks about them. Signing out deletes them.
4. Processors
The service runs on infrastructure operated by others. Each of them is bound by a data processing agreement under Art. 28 GDPR and may use the data only as instructed.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | The server this site and the application run on | Germany |
| Supabase, Inc., United States | Database and sign-in: accounts, organisations, scripts, breakdown data, the activity log and settings | Project region: CONFIRM IN THE SUPABASE PROJECT SETTINGS, e.g. eu-central-1 (Frankfurt) |
Transfer outside the EU
Supabase, Inc. is established in the United States, so a transfer to a third country cannot be ruled out even where the database itself runs in an EU region — for example for support access. That transfer takes place on the basis of the standard contractual clauses adopted by the European Commission, which form part of Supabase's data processing agreement, together with the additional safeguards agreed there. You can request a copy of those clauses at the contact address above.
On the Studio plan the database can be operated by the customer or hosted in a region the customer chooses. In that case the data never reaches the providers listed above.
5. How long it is kept
Account and production data are kept for as long as the organisation uses the service. Deleting a script or a project deletes it and everything belonging to it. The activity log is kept for the life of the organisation, because it is what makes a breakdown traceable — it holds identifiers of the acting person, not the content of a script. When an account is closed, its data is deleted unless a statutory retention period applies, in particular the six and ten year periods for commercial and tax records.
6. Your rights
You have the right to obtain information about the data we hold about you (Art. 15), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to restriction of processing (Art. 18), to receive your data in a portable form (Art. 20), and to object to processing based on a legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.
Requests go to the contact address in section 1. You may also complain to a data protection supervisory authority, in particular the authority of your habitual residence or of the federal state in which we are established.
7. Changes
This notice will be updated when the service changes. The current version always applies. Last changed: 31 July 2026.