Daito Design Amsterdam B.V. ("we", "us") decides how and why your personal data is used, which makes us the controller under the EU General Data Protection Regulation (GDPR). We are a private limited company (besloten vennootschap) registered in the Netherlands.
Because we are established in the Netherlands, our supervisory authority is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
| What | Why | Lawful basis (GDPR Art. 6) | How long |
|---|---|---|---|
| Your designs: room sizes, gear, scenario names and settings | Saved in your browser so your work is there next time. Not sent to us. | None needed: we don't receive it. The storage itself is explained in section 5. | Until you clear it in your browser |
| Share links | When you share a design, the design is packed into the link after the # sign. Browsers don't send that part to servers, so we never see it. | None needed: we don't receive it | We keep no copy |
| Purchase of branded exports (a one-time purchase): your email address, country, licence key, and Stripe's customer and checkout IDs | To deliver your licence, send your licence key and receipts, help you recover a lost key, and handle refunds | Performing our contract with you (6(1)(b)). Keeping records for tax law is a legal obligation (6(1)(c)). | As long as you use your licence key (it doesn't expire), and at least 7 years for tax records as Dutch law requires. Ask us and we'll delete everything the law doesn't make us keep. |
| Payment details: card number, cardholder name, billing address | To take the payment. You enter them on Stripe's own checkout page; we never see your card number. | Performing our contract with you (6(1)(b)) | Kept by Stripe under its own policy |
| Feedback: your message, your email address if you add it, and a snapshot of the design you were working on with your browser type and screen size | To read and answer your message and to reproduce the problem you found | Our legitimate interest in answering you and improving cinemap (6(1)(f)) | Up to 1 year |
| cinemap player beta sign-up: your email address, and if you give them, your name, the devices you pick and your note | To send you TestFlight invites, setup notes and build notes, and to ask about your setup | Your consent (6(1)(a)). You can withdraw it at any time by writing to privacy@cinemap.ai. | Until the beta ends or you ask us to delete it |
| Emails you send us | To answer you | Our legitimate interest in answering you (6(1)(f)), or our contract with you when it's about your purchase (6(1)(b)) | As long as needed to deal with it, and at most 2 years after our last exchange |
| Security data: your IP address, and a scrambled (hashed) version of it in our audit log | To stop abuse, brute-force attempts and fraud | Our legitimate interest in keeping cinemap and its users safe (6(1)(f)) | IP address: at most 24 hours in our rate limiter. Hashed IP in the audit log: 90 days. |
| Usage statistics: which features are used, the page, your country, the kind of device (desktop, phone, tablet), and a code worked out from your IP address that changes every day | To see which features help people and which don't. The daily code lets us count visits without recognising you on another day. We never store the IP address itself. | Our legitimate interest in improving cinemap (6(1)(f)) | 90 days |
| Server logs: our host, Vercel, logs each request (IP address, time, page, browser) | To run the site and find errors | Our legitimate interest in running a working, secure site (6(1)(f)) | A short period under Vercel's log settings |
You don't have to give us any personal data to use the calculator. To buy a licence or join the beta we need an email address; without one we can't deliver the licence key or the invite.
"Email me this config" in the share window opens your own email app with the link filled in; nothing is sent to us. We don't send a newsletter at the moment. If we start one, we will only add people who ask for it, and we will update this policy first.
When data reaches the end of its period, we delete it within 30 days, and it leaves our backups within 90 days.
We use these companies to run cinemap. They act on our instructions (they are our "processors"), and each has signed a data processing agreement with us as Article 28 GDPR requires.
| Company | What they do for us | What they receive | Where | Safeguard for transfers outside the EU |
|---|---|---|---|---|
| Vercel Inc. | Hosts the site and runs our server code | Everything your browser sends to our servers, including your IP address | USA (our server code runs in Washington, D.C.) | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Supabase Inc. | Our database | Licence records, the audit log, usage statistics | EU (Frankfurt) | Data is stored in the EU; Standard Contractual Clauses cover any access from the USA |
| Upstash Inc. | Rate limiting | IP addresses, for at most 24 hours | EU region | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Stripe Payments Europe Ltd. | Payments | Payment details, email address, billing address | Ireland (EU), with transfers to Stripe, Inc. in the USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Resend Inc. | Sends our emails (licence keys, receipts, feedback and beta notes) | Your email address and the email's content | USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Notion Labs Inc. | Our inbox for feedback and beta sign-ups, when switched on | What you sent us | USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| [email host to be added] | Hosts our @cinemap.ai mailboxes | Emails you send us | [to be added] | [to be added] |
Stripe also uses some payment data for its own purposes, such as preventing fraud and meeting its legal duties. For that, Stripe is responsible itself, under Stripe's privacy policy.
If you join the cinemap player beta on Apple TV, iPhone, iPad or Vision Pro, we enter your email address in Apple's App Store Connect so that TestFlight can send you the invite. Apple then handles it under its own privacy policy.
cinemap player and cinemap server. The player apps and the server run on your own devices and your own network. Your films and your library stay there: there's no cinemap account and no cloud library of ours, and the apps don't send us your films, your library or what you watch. To show posters and details, the apps send a film's title and year straight from your network to The Movie Database (TMDB, using the API key you enter) or Wikidata, never through us; those services handle the request under their own privacy policies. During the beta, Apple's TestFlight may pass us crash reports and any feedback you send through it, with your email address, under Apple's terms. Once cinemap player is in the App Store, you buy it from Apple, and Apple handles that purchase under its own privacy policy; we don't receive your payment details.
Two services we use receive no personal data: ntfy.sh, which sends a short note to the founder's phone when someone joins the beta (only "new sign-up" and the devices ticked, never who), and the AI services of Anthropic and OpenAI, which read public manufacturer web pages to pull out gear specs.
We will announce any change to this list on this page before it takes effect.
The law only lets a website store or read information on your device without asking first when that is strictly needed for the service you asked for. That's all cinemap does, so there is no cookie banner:
cinemap_data and cinemap_data_backup (browser storage): your designs and settings, and your licence key if you have entered one. They stay until you clear them.cinemap_gear_cache_v1 (browser storage): a copy of the gear catalogue so the app loads quickly. No personal data.__Host-cm_co_nonce (cookie): set only when you start a checkout. It ties the payment to your browser so nobody else can claim your licence key. It lasts 30 minutes.Our usage statistics use no cookies and store nothing on your device.
Content from other companies. When you open a page, your browser fetches our fonts from Google Fonts (Google, USA), and the app fetches its 3D and PDF code libraries from cdnjs (Cloudflare, USA). Those companies see your IP address when your browser asks them for the files.
Some of these companies are based in the USA. For transfers to them we rely on the EU–US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) where the company is certified, and on the European Commission's Standard Contractual Clauses of 2021, which are part of each company's data processing agreement. Our server code currently runs in Vercel's US region, so data you send to our servers passes through the USA even where it is stored in the EU. We send as little as we can.
Under the GDPR you have the right to:
Email privacy@cinemap.ai, ideally from the address you used with us. If it's about a licence, we may ask for your licence key to check the data is yours. We answer within one month. If a request is complex we may take up to two more months, and we'll tell you why within the first month.
If you think we handle your data wrongly, please tell us first so we can put it right. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the data protection authority in the EU country where you live or work (GDPR Art. 77).
cinemap is not meant for children under 16, and we don't knowingly collect their data. If you think we have, email us and we'll delete it.
We protect your data with encryption in transit (TLS), encrypted storage at Supabase, signed short-lived checkout cookies, database writes that only our server can make, content security policy headers, and rate limits on every server endpoint. Card details never reach our servers: Stripe handles them and is certified to PCI DSS Level 1.
If a personal data breach happens, we report it to the Autoriteit Persoonsgegevens within 72 hours where the law requires, and we tell the people affected without undue delay when the risk to them is high (GDPR Art. 33 and 34).
We will tell you about important changes by email if you have a licence, and with a notice on the site for 30 days. Small changes, such as typo fixes, apply straight away and are listed in the version history.
Privacy questions and requests: privacy@cinemap.ai
Everything else: hello@cinemap.ai
By post: Daito Design Amsterdam B.V., Keizersgracht 391 A, 1016 EJ Amsterdam, the Netherlands
← Back to the planner