Privacy policy.

1. Controller

Pol Jiménez Ayguadé, Tax ID (NIF) 47423469E, Barcelona, España ("SceneLab", "we"). For any privacy question: hello@scenelab.actor.

2. What data we process

• Waitlist: your email, the language of the page, the referral code you came with (if any), the date and your consent to receive emails about your spot and the launch.
• Account: email, name or stage name, language and password (handled encrypted by our authentication provider; we never see it).
• Professional profile: what you tell us in onboarding and your profile (type of performer, training, markets, languages, experience, goals; for models, also look and measurements if you provide them).
• Profile photos and reel, if you choose to upload them.
• Working material: the scripts, scenes and briefs you paste or upload, and the self-tapes you analyse.
• History: the feedback and analyses we generate for you.
• Usage: a counter of how many analyses you've done this month, to apply your plan limits.
• Payment: handled by Stripe. We only store your plan and your customer and subscription IDs, never your card details.

3. Your scripts, briefs and self-tapes

Confidential mode, always on: your script or brief is sent to our AI provider to generate the analysis and we don't store it. We only store the feedback, which may include short quotes when needed to explain a note.

If you upload a PDF brief, it's stored temporarily so the AI can read it and deleted as soon as the prep finishes; in any case, an automatic process deletes any left after 24 hours.

To analyse a self-tape we extract a few frames on your own device and only those frames are sent to the AI; the video isn't uploaded or stored. If you use the video editor, the video is processed by our video provider and deleted automatically within 24 hours.

We never use your material to train AI models, and neither do our providers.

4. Why, and on what legal basis

• Providing the service (analysis, feedback, history, account): performance of the contract (art. 6.1.b GDPR).
• Personalising feedback with your profile and history: performance of the contract.
• Charging the subscription and meeting accounting and tax obligations: contract and legal obligation (art. 6.1.b and 6.1.c).
• Security and abuse prevention (for example, usage limits): legitimate interest (art. 6.1.f).
• Waitlist emails (your Founder spot, the launch) and other marketing emails: your consent (art. 6.1.a), which you can withdraw at any time with the unsubscribe link in every email.
• We don't make automated decisions with legal effects on you: the AI feedback is guidance only.

5. Who we share it with

Only with providers that process data on our behalf under a data processing agreement (DPA), and only what they need:

• Anthropic (Claude AI model): analyses text and frames. Its commercial API doesn't use the data for training and only keeps it for a limited safety period.
• Supabase: authentication, database (including the waitlist) and profile photo storage.
• Vercel: hosting of the website and server functions.
• Stripe: subscription payments and invoices.
• Resend: sending our emails (waitlist, account and service emails).
• Cloudinary: video processing for the editor (deleted within 24 hours).
• Meta and TikTok (advertising pixels): only if you accept advertising cookies, they receive that a visitor from one of our ads joined, registered or subscribed (see the Cookies policy).
• We don't sell your data.

6. International transfers

Some of these providers may process data outside the European Economic Area (mainly in the US). In those cases the transfer relies on the EU-US Data Privacy Framework when the provider is certified, or on the Standard Contractual Clauses approved by the European Commission (with the UK addendum for UK users).

7. How long we keep it

• Scripts and briefs: not kept (see point 3).
• Editor videos and temporary PDFs: 24 hours at most.
• Waitlist: until the public launch plus 12 months, or until you unsubscribe or ask us to delete it.
• Account, profile, photos and feedback history: while you have the account. You can delete single analyses at any time; when you delete your account they're removed within 30 days.
• Usage counter: 12 months.
• Billing data: as long as the law requires (up to 6 years, art. 30 of the Spanish Commercial Code).

8. Security

Encryption in transit (HTTPS) and at rest at our providers, access to each user's data limited to their own account, AI routes that require a signed-in session, and data minimisation. No system is infallible; if a breach affected you, we would tell you and report it to the Spanish Data Protection Agency (AEPD) as the law requires.

9. Your rights

You can request access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to hello@scenelab.actor. We'll reply within one month.

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of your country (in the UK, the ICO).

10. Minors

SceneLab is for people aged 18 and over. Under-18s can only use it with the permission and supervision of their parents or guardians, who will be the ones subscribing.

11. Cookies and local storage

We use strictly necessary storage (your sign-in session and your language) and, only if you accept them, Meta and TikTok advertising cookies. See the Cookies policy.

12. External and affiliate links

Some references (Pinterest, YouTube, clothing shops) link to third-party sites with their own privacy policies. Some shop links may be affiliate links: if you buy, we may receive a small commission at no extra cost to you.

13. Changes

If we change anything important in this policy we'll tell you by email or in the app before it applies.