← Back to CineMe

Privacy Policy

Effective: 10 May 2026 · Version 1.0

1. About this policy

This privacy policy explains how CineMe Ltd ("CineMe", "we", "us", "our") collects, uses, and protects personal information when you visit cineme.ai, use any feature on it (such as our wallpaper / QR contact-card generator at /cannes), or contact us by email.

We are committed to handling your personal data lawfully, fairly, and transparently. This policy is written in plain English. If anything in it is unclear, ask us — contact details are at the end.

2. Who we are (the data controller)

CineMe Ltd is the "data controller" for the personal data described in this policy. That means we decide what data is collected and what happens to it.

• Company: CineMe Ltd
• Registered in: England and Wales
• Company number: 17109388
• Registered office: 167–169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
• ICO data protection registration: ZC114630
• Email for privacy queries: privacy@cineme.ai

3. What we collect and why

3.1 Contact-card / wallpaper generator (/cannes)

When you use the wallpaper generator at /cannes we ask for:

• Name (required) — to personalise the wallpaper and the vCard.
• Job title, company, mobile, email, and any URLs / social handles you choose to share (optional) — embedded in the QR-code vCard so anyone scanning your wallpaper can save your contact details.
• The event or context you tell us you're at, if you choose to add one — for our internal records. Optional field.
• Whether you ticked the marketing-consent checkbox.

The wallpaper image itself is generated in your browser. The image is not uploaded to us.

3.2 Information collected automatically

When you visit our site, our hosting and storage providers may automatically record:

• Your user-agent string (which browser and operating system you're using).
• The referrer (the page you came from, if any).
• Any UTM parameters in the URL (campaign tracking codes used by us or by third parties who linked to us).
• Standard server logs at our hosting provider (Vercel), which include IP addresses for short retention windows. We do not store your IP address ourselves.

3.3 Homepage “Request access” form

If you fill in the Request access form on our homepage, we collect your name, email, optional role and company, which product you are interested in (Create, Hub, CineBoard, CineViz, or not sure), a short note about your project, an optional referral, and whether you opted in to marketing updates. We store this in our leads database, may sync a contact into our Hub CRM so we can follow up, and may notify the CineMe team by email or Slack. When you provide an email address we also send a short transactional confirmation that we received your request (this is not a marketing email and does not require marketing consent).

3.4 Other contact

If you email us (for example, hello@cineme.ai or ops@cineme.ai), we receive whatever you choose to share. We use this only to respond to you.

4. Lawful basis for processing

UK and EU data-protection law requires us to have a lawful basis for handling your personal data. Ours are:

• Performance of a service you've requested — when you submit the wallpaper form, you're asking us to generate and deliver something to you. Storing your details is necessary to deliver the service and to re-issue it if you ask.
• Legitimate interest — running our business, understanding which events generated which interest, keeping records of who we've met, and protecting against fraud or abuse of the site.
• Legitimate interest under the PECR "soft opt-in" — for occasional marketing emails about CineMe services similar to the one you came to us for (Regulation 22(3) of the Privacy and Electronic Communications Regulations 2003). Marketing is off by default; you can opt in by ticking the marketing-consent box on the form, and a one-click unsubscribe link is included in every marketing email we send. You can withdraw at any time (see section 8 or 9).

5. Who we share your data with (sub-processors)

We do not sell your personal information. We share it only with the service providers that help us deliver our website and our service. Each of them processes your data on our instructions only:

Processor	Purpose	Location
Supabase Inc.	Stores the records you submit through our forms.	Dublin, Ireland (eu-west-1), within the EU.
Vercel Inc.	Hosts cineme.ai and runs our serverless functions.	United States; edge points worldwide.
Resend, Inc.	Sends transactional and (where consented) marketing emails to you. Used only when we send you something.	United States.
Slack Technologies, LLC	Used by our small team to receive a real-time alert when someone submits a form, so we can follow up promptly.	United States.
Google LLC (Google Fonts)	Serves the Inter typeface used across the site. The Inter font files are served from fonts.gstatic.com and do not set cookies.	United States.
Cloudflare, Inc. (Turnstile)	Bot and abuse protection on our lead forms. Receives a short-lived challenge token when you submit a form; we do not send your form fields to Cloudflare.	United States / global edge.
CineMe Hub CRM (Supabase)	When you submit a form with an email address, we sync a contact record into our internal CRM at hub.cineme.ai so the team can follow up. Enquiry details and marketing consent are stored with that contact.	EU (same Supabase region as our CRM project).

Where a processor is in the United States, transfers from the UK / EU are protected by the EU–US and UK–US Data Privacy Frameworks and / or by the Standard Contractual Clauses (UK Addendum), as applicable.

6. International transfers

Some of our processors are in the United States. When personal data leaves the UK or EU, we rely on the protections listed above (Data Privacy Frameworks or Standard Contractual Clauses) so that your data continues to be protected to UK / EU standards.

7. How long we keep your data

• Wallpaper / contact-card submissions: for as long as you remain interested in CineMe, or until you ask us to delete the record (see section 8). If you've not engaged with us for 24 months and have not consented to marketing, we will routinely review and delete inactive records.
• Marketing-consent records: we keep these for as long as the consent is active, plus a short audit period after you unsubscribe, so we can demonstrate that we stopped emailing you when you asked.
• Email correspondence: as long as is reasonable for the matter at hand, then archived in line with our records-retention practice.
• Server logs at Vercel: retention is set by Vercel; typically short (days, not months).

8. Your rights

Under UK and EU data-protection law you have the right to:

• Access the personal data we hold about you.
• Rectify it if anything is wrong.
• Erase it (also called the "right to be forgotten").
• Restrict our processing of it.
• Object to processing (including for direct marketing — you can opt out of marketing at any time).
• Receive a copy of your data in a portable format, or have us send it to another controller.
• Withdraw consent for any processing based on consent. Withdrawing consent does not affect anything we did before you withdrew it.
• Complain to the Information Commissioner's Office (ICO) — the UK's data-protection regulator: ico.org.uk. We would prefer that you raise the issue with us first so we can try to put it right.

To exercise any of these rights, email privacy@cineme.ai. We will respond within 30 days, as required by law.

9. Marketing email

When you submit your details to receive a CineMe service (for example, generating a wallpaper at /cannes), we may also send you occasional updates about other CineMe services similar to the one you came to us for. We rely on the "soft opt-in" permitted under Regulation 22(3) of the UK Privacy and Electronic Communications Regulations 2003 (PECR).

You are always free to opt out:

• At the point of capture — untick the marketing-consent box on the form.
• In every subsequent email — every marketing email contains a one-click unsubscribe link.
• Directly — email privacy@cineme.ai at any time and we will remove you within 30 days, usually the same day.

We do not use your information for automated decision-making or profiling.

10. Cookies and similar technologies

We aim to use as few cookies as possible. Our use of cookies and local-storage is described in our Cookies Policy.

11. Children

Our website and services are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we hold data about a child, please contact us at privacy@cineme.ai and we will delete it.

12. Security

We take reasonable technical and organisational measures to protect your personal data. Our forms post over HTTPS, our records are stored in Supabase with row-level security policies, and the credentials used to read those records are held only by our server-side functions — never by your browser. We routinely review our access permissions.

Despite our best efforts, no system is ever fully secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO without undue delay, as required by law.

13. Changes to this policy

We will update this policy from time to time. The "Effective" date at the top tells you when this version came into force. For material changes, we will let you know — for example, by an email to anyone who has given us their address — and we will update the version number.

14. Contact

Email privacy@cineme.ai for any privacy or data-protection question, or write to us at:

CineMe Ltd
167–169 Great Portland Street
5th Floor
London W1W 5PF
United Kingdom