Privacy notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
BLRRD by Berkan Ustalar
Neumünster, Germany

For privacy enquiries, contact us at berkan@blrrd.ai. A data protection officer is appointed only where the legal conditions require one.

2. Data we process

Depending on use, we may process in particular:

• email address and account authentication and session data;
• profile, organisation, project and permission data;
• video and other media files provided by users for a review;
• comments, annotations, approvals, invitations and access logs;
• technical data required for security, error analysis and provision.

For password-based sign-in, the entered password is transmitted to Supabase Auth over an encrypted HTTPS connection. CineStream stores the password neither in user profiles nor in persistent browser storage. To keep you signed in, the app stores access tokens, refresh tokens and related session data in local browser storage.

Supabase Auth stores password-verification hashes using bcrypt. An additional random value is used for each password. The password itself is not stored in plaintext. No password is required for sign-in by email code.

3. Purposes and legal bases

• Account, sign-in, sessions and review functions: performance of a contract under Art. 6(1)(b) GDPR;
• Operation, security, abuse prevention and error correction: legitimate interests under Art. 6(1)(f) GDPR where necessary;
• Support and communication concerning a requested matter: performance of a contract or legitimate interests under Art. 6(1)(b) or (f) GDPR;
• Compliance with legal obligations: Art. 6(1)(c) GDPR.

Required information is identified in the relevant process. If data is not provided, the relevant function or account may be unavailable.

4. Review content and responsibilities

Anyone managing a team, project or review invitation generally decides which content and personal data are entered into CineStream or shared with others. That organisation or person is generally responsible for that processing. Where BLRRD processes such content only on instructions for technical provision, storage, processing and display, it acts as a processor. The respective responsibilities depend on the concrete usage scenario and any agreement required under Art. 28 GDPR.

Users may only upload or share content for which they have the required rights and authority. Data subjects may first contact the organisation when they have questions about processing initiated by that organisation.

5. Service providers used

We use technical services from Supabase, Cloudflare, Hetzner and GCore to operate and provide CineStream. We use Resend to send sign-in and account emails. Where payment or subscription functions are used, RevenueCat and Stripe are used. When signing in with a Google or GitHub account, the respective provider is involved in the sign-in process. The respective providers may process data for the relevant function. Further providers are used only when they are activated for the relevant function and added to this notice.

Specific locations, subprocessors and transfer mechanisms will be completed before public launch on the basis of the active provider configuration and agreements. Transfers to third countries take place only in accordance with Art. 44 et seq. GDPR.

6. Local storage and cookies

For sign-in and maintaining a session, the web client uses technically necessary local storage. Session storage may be used for shared guest sessions. Necessary settings may also be stored locally. These stores do not serve advertising or cross-site tracking purposes. Where access to terminal equipment is required, it takes place on the basis of Section 25(2) no. 2 TDDDG; optional services would obtain consent as required by law.

7. Retention and deletion

We store data for as long as necessary for the relevant purpose. Account data generally remain until account deletion or the purpose no longer applies. Statutory retention duties may require longer storage of individual data.

Account deletion can be initiated in the account area. For an organisation with further active members, ownership must be transferred before deletion. Deletion of media files at an external media provider may occur after the technical deletion run; no fixed period is currently promised.

8. Your rights

Subject to statutory conditions, you have in particular the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent may be withdrawn at any time with effect for the future.

To exercise your rights, contact berkan@blrrd.ai.

9. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

10. Changes

We update this notice when processing or legal requirements change. The current version is available on this page.