Privacy Policy

This Privacy Policy describes how CINEGENY Studio (hereinafter “CINEGENY”, “we”, “our”) collects, uses, stores and protects your personal data when you use the CINEGENY platform (hereinafter “the Platform”), in accordance with Regulation (EU) 2016/679 of 27 April 2016 on data protection (GDPR) and French Act No. 78-17 of 6 January 1978 as amended (Data Protection Act).

1. Data controller

The controller of personal data is:

2. Data collected

We collect the following categories of personal data:

2.1. Identity and contact data

• Last name, first name, alias;
• Email address;
• Password (hashed and salted, never stored in clear);
• Profile photo (optional);
• Country of residence and preferred language.

2.2. Professional data

• Role on the platform (Contributor, Artist, Screenwriter, etc.);
• Declared skills (tools mastered, specialties);
• Portfolio and external links (website, social networks);
• Spoken languages.

2.3. Submission data

• Submitted files (images, text, video, audio);
• Notes and comments attached to submissions;
• SHA-256 hash of files (proof of anteriority);
• History of tasks completed and scores obtained.

2.4. Financial data

• Stripe Connect identifier (for payouts);
• Bitcoin Lightning address (optional);
• Transaction history (credit purchases, subscriptions, payouts);
• Billing information.

Note: full bank details (card number, IBAN) are processed directly by our payment providers (Stripe, BTCPay Server) and are never stored on our servers.

2.5. Browsing and technical data

• IP address;
• Browser type and version;
• Operating system;
• Pages visited, time spent;
• Cookie data (see our Cookie Policy).

3. Legal bases for processing

Each processing of data rests on a legal basis that complies with Article 6 of the GDPR:

4. Purposes of processing

Your personal data are processed for the following purposes:

• Create and manage your user account on the Platform;
• Let you apply for, complete and submit tasks;
• Validate submissions via our hybrid AI/human system;
• Process payments and remuneration transfers;
• Run the gamification system (points, levels, ranking);
• Timestamp and certify the integrity of submissions (SHA-256 hash);
• Send you service notifications (available tasks, validations, payments);
• Send you marketing communications (with your consent);
• Improve the Platform through statistical analysis of usage;
• Prevent fraud and keep the service secure;
• Comply with our legal and regulatory obligations.

5. Recipients of the data

Your personal data may be disclosed to the following categories of recipients, strictly limited to what is necessary:

• Authorised staff of CINEGENY Studio Pictures (technical team, moderation, customer support);
• Technical processors: hosting (Vercel/Hetzner), database (managed PostgreSQL), payments (Stripe, BTCPay Server), transactional email (Resend);
• AI providers: Anthropic (Claude API) for automated validation of submissions — only submitted content and validation criteria are transmitted, never your identity data;
• Public authorities, on a legally founded request (tax administration, judicial authorities).

We never sell your personal data to third parties. We share no data for advertising purposes.

6. Retention period

Your data are kept for the period strictly necessary for the purposes pursued:

When these periods expire, your data are deleted or irreversibly anonymised.

7. Your rights (Articles 15 to 22 of the GDPR)

Under the GDPR, you have the following rights over your personal data:

• Right of access (Art. 15) — Obtain confirmation that your data are processed and receive a copy.
• Right to rectification (Art. 16) — Have inaccurate data corrected or incomplete data completed.
• Right to erasure (Art. 17) — Request deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18) — Obtain restriction of processing in the cases provided for by the GDPR.
• Right to portability (Art. 20) — Receive your data in a structured, commonly used, machine-readable format (JSON/CSV), and transmit them to another controller.
• Right to object (Art. 21) — Object to processing of your data based on legitimate interest, including profiling.
• Right to withdraw consent — Withdraw at any time your consent for processing that depends on it, without affecting the lawfulness of prior processing.
• Right to give post-mortem instructions — Define instructions on the fate of your data after your death (French Data Protection Act, Art. 85).

If the reply is unsatisfactory, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.

8. Data Protection Officer (DPO)

CINEGENY Studio has appointed a Data Protection Officer you can contact for any question about the protection of your personal data:

9. Cookies

The Platform uses cookies to ensure it works properly and to improve your experience. For detailed information on the cookies used, their purpose and how to manage your preferences, please see our Cookie Policy.

10. Transfers of data outside the European Union

Some of our processors may be located outside the European Union. In that case, we ensure that the transfer of data is framed by appropriate safeguards in accordance with Chapter V of the GDPR:

• Adequacy decision: when the destination country benefits from an adequacy decision of the European Commission (e.g. EU-US Data Privacy Framework);
• Standard contractual clauses (SCCs): we use the standard contractual clauses approved by the European Commission (Decision 2021/914);
• Additional measures: encryption of data in transit (TLS 1.3) and at rest (AES-256), minimisation of transferred data.

You can obtain a copy of the safeguards in place by contacting our DPO at dpo@cinegen.studio.

11. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction:

• Encryption of data in transit (HTTPS / TLS 1.3) and at rest (AES-256);
• Password hashing with bcrypt (cost 12);
• Access limitation to data under the least-privilege principle;
• Logging of access to sensitive data;
• Daily encrypted backups;
• Regular security tests.

12. Changes to this policy

We reserve the right to change this Privacy Policy at any time. In the event of a substantial change, we will inform you by email and/or by notification on the Platform at least thirty (30) days before the changes take effect.

The date of last update is shown at the top of this document. We invite you to consult this page regularly.