Screendibs Privacy Policy

Draft for review by Jonathan Nuss. Not yet in force.

Last updated: [date]

Effective date: [1 November 2026 — ASSUMPTION: same as the launch date]

Words in square brackets are placeholders, assumptions or decisions for review. They must all be resolved or removed before this policy is published.

1. Who we are and what this policy covers

This policy explains how Screendibs Technologies Inc. ("Screendibs", "we", "us" or "our"), of Montreal, Canada, collects, uses, shares and protects personal information. [Registered office address — Jon to confirm whether one must be published.]

It applies to:

• the Screendibs platform at [screendibs.com], including the web application, reports and emails (the "Platform");
• our company website at [company.screendibs.com] (the "Website"); and
• our business communications with customers, prospective customers and partners.

We are responsible for the personal information described in this policy. In the language of the European Union General Data Protection Regulation (GDPR), we are the controller. We have written this policy to meet the requirements of the Quebec Act respecting the protection of personal information in the private sector (as amended by Law 25), the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the GDPR and the UK GDPR.

"Personal information" means any information about an identifiable individual. It does not include information that has been anonymised so that it can no longer identify anyone.

2. Person in charge of the protection of personal information

Our person in charge of the protection of personal information is:

[Name, title — Law 25 requires one; by default the CEO. ASSUMPTION: John Feifer, Co-founder and CEO, unless the role is delegated in writing.]

Email: [privacy@screendibs.com — PLACEHOLDER]

Mail: Screendibs Technologies Inc., attention: Person in charge of the protection of personal information, Montreal, Canada [Mailing address — PLACEHOLDER]

You can contact this person with any question, request or complaint about privacy.

3. Personal information we collect

Information you give us

• Account information: your email address and password when you create an account. Your password is handled by Google Firebase Authentication. We never see it in readable form.
• Personalisation information (optional): if you complete onboarding or use personalisation features, the genres you like or avoid, films and books you like, the formats you work in (for example film, television or stage), your budget range, a description of your mandate or of what you are looking for, and your "swipes" (whether you liked or passed on suggested titles, with the title, author, year, type, genre and time).
• Searches and requests: what you type into the search assistant and other requests you make, and the works you view, unlock or add to your watchlist.
• Purchases: the plan you choose, the reports and unlock packs you buy, and the titles you unlock. Your card details are entered directly into Stripe's secure payment form. Stripe also collects billing details such as your name, country and postal code where needed.
• Report delivery: the email address to which you ask us to send a report.
• Messages: what you write to us by email or through the Website contact form, such as your name, email address, organisation and message.

Information we collect automatically

• Technical information: IP address, browser type, device and operating system, the pages and features you use, timestamps, and error and server logs, collected by our hosting and authentication providers.
• Sign-in information: a unique user identifier and sign-in tokens created by Firebase Authentication and stored in your browser so that you stay signed in.
• Usage counters: the number of searches and free unlocks you have used, so that we can apply plan limits.
• Fraud-prevention signals: when you use a payment page, Stripe collects device and browsing information to detect and prevent fraud.

We do not use advertising cookies, third-party analytics or social media tracking pixels. See our Cookie Notice.

Information we receive from others

• Stripe tells us whether a payment succeeded, the status of your subscription and limited card information (such as card brand, last four digits and expiry date).
• Business contacts. For our business-to-business outreach, we may collect the professional contact details of people working in the entertainment industry (name, job title, company, business email address and publicly available professional information) from public sources such as company websites and professional directories. [ASSUMPTION: the outreach database uses public professional sources, including IMDbPro. Jon to confirm that each source's terms allow this use.]

Information we do not want

Please do not give us sensitive information, such as health, financial account, government identification, racial or ethnic origin, religious or political information, about yourself or anyone else. The Platform does not need it.

4. How we use personal information and our legal bases

We use personal information only for the purposes below, or for purposes compatible with them, or as the law requires. For people in the European Union or the United Kingdom, we give the GDPR legal basis for each purpose.

• To create and manage your account and sign you in. Legal basis: performance of our contract with you.
• To provide the Platform: run searches, show details, adaptability assessments and rights-status indications, generate reports, deliver them as PDF files and by email, and send the rights-status notifications you ask for. Legal basis: contract.
• To personalise results using your onboarding answers, swipes and recent searches. This is optional and only happens if you choose to provide this information. Legal basis: consent, which you can withdraw at any time.
• To take payments, manage subscriptions, unlocks, credits and plan quotas, and keep accounting records. Legal basis: contract and legal obligation (tax and accounting law).
• To communicate with you about your account, purchases, changes to our terms and support requests. Legal basis: contract and legitimate interests.
• To send marketing emails about Screendibs. Legal basis: consent, or where the law allows, our legitimate interests (for business contacts). Every marketing email has an unsubscribe link.
• To keep the Platform secure, prevent fraud and abuse, enforce our terms and limits, and fix errors. Legal basis: legitimate interests and legal obligation.
• To improve the Platform, using aggregated or de-identified information where possible. Legal basis: legitimate interests.
• To contact business prospects about our services. Legal basis: legitimate interests, and consent where required by anti-spam law.
• To comply with the law and respond to lawful requests from authorities, and to establish, exercise or defend legal claims. Legal basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this assessment.

Under Quebec and Canadian law, we collect only the information necessary for these purposes and we rely on your consent, which may be implied where the purpose is obvious and the information is not sensitive. If we want to use your information for a new purpose that is not compatible with these, we will ask for your consent first, unless the law allows otherwise.

5. Artificial intelligence and personalisation

How AI is used

Your searches, requests, personalisation information and the details of the works you select are sent to Google's Gemini API (and, for illustrations, Google's Imagen models) to generate results and reports. We send only what is needed to answer your request. [ASSUMPTION: we use Google's paid Gemini API services, under which Google does not use prompts or responses to improve its products. Ben to confirm all production keys are on a billed account; see README.]

Google may keep prompts and responses for a limited period to detect abuse, under its terms for the Gemini API.

Profiling and your choice

Personalisation uses your answers and swipes to rank and tailor suggestions. Under Quebec law this is a profiling function. It is off unless you turn it on by completing onboarding or swiping, and you can skip it. You can ask us at any time to switch it off and delete your personalisation information. [PLACEHOLDER: Ben to add a setting to reset or switch off personalisation in the profile page; until then, by request to privacy@screendibs.com.]

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects. AI-generated content is about literary works, not about you.

6. Who we share personal information with

We do not sell personal information, and we do not share it for targeted advertising.

We share personal information only with the following, and only as needed:

Service providers (processors)

These providers process personal information on our behalf, under contracts that require them to protect it and use it only to provide their services to us.

• Google LLC (United States) and its affiliates: Firebase Authentication (accounts and sign-in), Cloud Firestore (saved reports, watchlists and usage counters), the Gemini API and Imagen (AI generation) and Google Fonts (fonts loaded from Google's servers, which receive your IP address).
• Google (Gmail SMTP): sending report deliveries, rights-status notifications and other service emails. [ASSUMPTION: a Google Workspace account. The code defaults to a consumer Gmail address; see README.]
• Supabase, Inc. (United States): database for personalisation information and billing entitlements (plan, unlocks, credits, purchases and quota usage). [ASSUMPTION: Supabase project hosted in a United States region. Ben to confirm.]
• Vercel Inc. (United States): hosting of the Platform and the Website, and the server functions that run them, including server logs.
• Cloudflare, Inc. (United States), through the cdnjs service: delivery of open-source software libraries used to build PDF files, which receives your IP address.

Stripe

Stripe (Stripe Payments Canada, Ltd. and Stripe, Inc., United States) processes card payments and subscriptions. Stripe acts as our service provider for payments and, for some purposes such as fraud prevention and its legal obligations, as an independent controller under its own privacy policy. [ASSUMPTION: contracting Stripe entity. Jon to confirm from the Stripe account.]

Others

• Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
• Authorities, when the law requires it, or to protect the rights, property or safety of Screendibs, our users or others.
• A buyer or successor, if all or part of our business is sold, merged or reorganised. The law requires the recipient to use the information only for the purposes in this policy unless you consent otherwise.
• People you choose, for example when you ask us to email a report to someone.

7. Where your information is stored and transfers outside Quebec

Our service providers store and process personal information outside Quebec and outside Canada, mainly in the United States, and their affiliates and sub-processors may process it in other countries. Information processed in another country is subject to that country's laws and may be accessible to its authorities.

• Quebec: before communicating personal information outside Quebec, we assess whether it will receive adequate protection, considering its sensitivity, the purposes, the safeguards and the legal framework of the destination, and we put written agreements in place. [PLACEHOLDER: privacy impact assessment for transfers outside Quebec to be completed and documented before launch; see README.]
• Canada: we remain accountable for information transferred to our service providers and use contracts to ensure a comparable level of protection.
• European Union, European Economic Area, Switzerland and United Kingdom: Canada benefits from a European Commission adequacy decision for organisations subject to PIPEDA. For onward transfers to the United States, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses or other safeguards recognised by law. [PLACEHOLDER: Jon and Ben to confirm each provider's certification or data processing agreement.] You can ask us for a copy of the relevant safeguards.

8. How long we keep personal information

We keep personal information only for as long as needed for the purposes described in this policy, or as long as the law requires. We then destroy it or anonymise it. [ASSUMPTION: all periods below are proposals for Jon and Ben to confirm.]

• Account information: while your account is open. Deleted within [30 days] after you close your account, except as described below.
• Personalisation information and swipes: while your account is open, or until you ask us to delete it or switch personalisation off. We keep only your 20 most recent search descriptions in your personalisation profile.
• Saved reports and watchlists: while your account is open, or until you delete them.
• Purchase, subscription and accounting records: for [6 years] after the end of the tax year to which they relate, as required by Canadian and Quebec tax law. Stripe keeps its own records under its own policy.
• Usage counters: while your account is open.
• Support emails and Website contact form messages: [24 months] after our last exchange.
• Business contact information: until you ask us to stop contacting you, or [24 months] after our last interaction. We keep a minimal record of unsubscribe requests so that we can respect them.
• Server and security logs: up to [30 days], unless needed longer to investigate an incident. [ASSUMPTION: Vercel log retention per plan.]
• Backups: deleted information may remain in backups for up to [30 days] until they are overwritten. [ASSUMPTION: depends on the Supabase and Firebase plans.]
• Inactive accounts: [DECISION: close and delete accounts with no sign-in for 3 years, after giving 30 days' notice by email.]

9. Your rights

Depending on where you live, you have the following rights. Quebec law, PIPEDA and the GDPR give rights that overlap but are not identical. We apply them in a consistent way for everyone where we reasonably can.

• Access: to know whether we hold personal information about you and to get a copy.
• Correction: to have inaccurate, incomplete or ambiguous information corrected.
• Deletion: to have your information deleted where it is no longer needed, was collected unlawfully, or you withdraw consent, subject to legal retention obligations.
• Withdrawal of consent: to withdraw consent at any time, for example to personalisation or marketing emails. This does not affect processing before withdrawal, and may mean we can no longer offer some features.
• Portability: to receive information you gave us in a structured, commonly used technological format, or to have it sent to another organisation.
• De-indexation (Quebec): to ask us to stop disseminating your information or to de-index a hyperlink to it, where the law allows.
• Information about automated processing: to be informed of, and to comment on, any decision based exclusively on automated processing of your information. We do not currently make such decisions.
• Objection and restriction (EU and UK): to object to processing based on legitimate interests, and always to direct marketing, and to ask us to restrict processing in certain cases.
• Complaint: to complain to us and to a supervisory authority (see section 15).

How to exercise your rights

Write to our person in charge of the protection of personal information at [privacy@screendibs.com — PLACEHOLDER]. You can also close your account by writing to the same address. [ASSUMPTION: no in-app account deletion or data export at launch.]

• We may ask you to confirm your identity, for example by writing from the email address on your account.
• We will answer in writing within 30 days of receiving your request. If the law allows us to extend this period, we will tell you why.
• Requests are free. We may charge a reasonable fee, or refuse, only where the law allows, for example for requests that are manifestly unfounded or excessive. If we refuse a request, we will explain why and tell you how to challenge our decision.

10. Cookies and similar technologies

We use only technologies that are necessary for the Platform to work or that remember a choice you made:

• Firebase Authentication stores sign-in tokens in your browser's storage so that you stay signed in.
• Stripe sets cookies on payment pages to prevent fraud and keep payments secure.
• Local storage remembers your light or dark display preference.

We do not use advertising, analytics or social media cookies. The Website uses no cookies. [ASSUMPTION: to be checked on the deployed Website.] Our Cookie Notice gives details.

11. Marketing and anti-spam

We send commercial emails only in accordance with Canada's Anti-Spam Legislation (CASL) and other applicable laws: with your consent, or where the law allows consent to be implied, for example for business contacts whose email address is published in connection with their professional role. Every commercial email identifies Screendibs, includes our contact information and contains a working unsubscribe link. We act on unsubscribe requests within 10 business days.

Service emails, such as receipts and report deliveries, are not marketing emails.

12. Children

The Platform and the Website are not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Security

We use reasonable technical and organisational measures, appropriate to the sensitivity of the information, to protect personal information against loss, theft and unauthorised access, use, disclosure, copying or modification. These include:

• encryption of data in transit (HTTPS);
• authentication through Firebase, and verification of the signed-in user on our servers before billing and personalisation records are read or changed;
• databases configured so that billing and personalisation records can only be read and written by our servers [ASSUMPTION: Firestore security rules restrict saved reports and watchlists to their owner; no rules file was found in the code, Ben to confirm];
• card payments handled entirely by Stripe, which is certified to the payment card industry security standard (PCI DSS), so that we never store card numbers;
• keeping secret keys on our servers only, and limiting access to personal information to people who need it for their work; and
• selecting service providers that maintain recognised security programmes.

No system is completely secure. Please use a strong, unique password for your account and tell us promptly if you suspect unauthorised access.

14. Confidentiality incidents

If we have reason to believe that a confidentiality incident (such as unauthorised access to, or loss of, personal information) has occurred, we will take reasonable measures to reduce the risk of harm and prevent recurrence. We keep a register of all incidents. Where an incident presents a risk of serious injury, or a real risk of significant harm, we will notify the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada and the people affected, as the law requires. Where the GDPR applies, we will notify the competent supervisory authority within 72 hours where required.

15. Questions and complaints

If you have a question or complaint, please contact our person in charge of the protection of personal information first (section 2). We will acknowledge your complaint, look into it and reply in writing within 30 days.

You may also contact a supervisory authority:

• in Quebec, the Commission d'accès à l'information du Québec;
• elsewhere in Canada, the Office of the Privacy Commissioner of Canada;
• in the European Union or European Economic Area, the data protection authority of the country where you live or work; and
• in the United Kingdom, the Information Commissioner's Office.

Representatives in Europe

[PLACEHOLDER: name and contact details of our EU representative under Article 27 GDPR, and UK representative under the UK GDPR, if appointed. See README.]

16. Our privacy governance

We have adopted internal policies and practices to govern personal information. In summary:

• our person in charge of the protection of personal information oversees compliance with this policy and the law;
• people who handle personal information do so only as needed for their role and are bound by confidentiality;
• we carry out a privacy impact assessment before any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, and before communicating personal information outside Quebec;
• we keep personal information only for the periods in section 8 and then destroy or anonymise it securely;
• we keep a register of confidentiality incidents; and
• we handle complaints as described in section 15.

[PLACEHOLDER: Law 25 requires these governance policies to be adopted by the company and published in clear and simple terms. Jon to confirm whether this summary is enough or whether a separate governance policy should be published.]

17. Changes to this policy

We may update this policy from time to time. If we make a material change, we will tell you by email or by a notice on the Platform before the change takes effect and, where the law requires, ask for your consent. The "Last updated" date at the top shows when it was last changed.

18. Contact us

Screendibs Technologies Inc.

Montreal, Canada

[Registered office address — Jon to confirm whether one must be published]

Privacy: [privacy@screendibs.com — PLACEHOLDER]

General: [contact@screendibs.com — PLACEHOLDER: the brand fact pack uses contact@, the Website currently shows hello@]