Privacy Policy

The controller for everything described below is:

Trader

Shift Videoproductions, sole proprietorship of Lars Grote

Address

Hoogweg 127, 9690 Kluisbergen, Belgium

Email

lars@shiftvideoproductions.com

Enterprise no.

0727.457.933

VAT

BE 0727.457.933

Shift Videoproductions operates the Filmmaker CRM product site at filmcrm.vercel.app and the live demo at filmcrm-demo.vercel.app. This policy covers both. It does not cover the copy of the CRM you run yourself after buying it, which is covered in section 7.

We are not required to appoint a data protection officer, and have not appointed one. Write to lars@shiftvideoproductions.com for anything in this policy.

• Google Analytics 4, to see which pages get read and where visitors arrive from. Before you consent it runs cookieless: it sends a ping with no identifier stored on your device, from which Google models aggregate traffic. Your IP address is used in transit to work out an approximate region and is not stored by us. After you accept, it uses the cookies in the table above for fuller measurement. Legal basis: legitimate interest in knowing whether the site works (art. 6(1)(f) GDPR) before consent, your consent (art. 6(1)(a)) after it. See Google's Privacy Policy.
• Meta Pixel (Facebook and Instagram), to measure whether our ads reach anyone. It loads only after you accept. If you decline, the script is never fetched and Meta learns nothing about your visit. It reports page views and clicks on purchase buttons, and Meta may match those to your Facebook or Instagram account. Legal basis: your consent (art. 6(1)(a)). See Meta's Privacy Policy.

Neither tool is given your name or your email address. What they collect is: pages visited, time on the page, the site or ad you came from, your device and browser type, an approximate region, and clicks on the buy and demo buttons.

Opening the demo at filmcrm-demo.vercel.app asks for an email address and, optionally, a first name. Here is everything that happens with them.

• We build you a private workspace and sign you into it with the two-hour session cookie in the table above. The films, clients and funding applications in it are invented. Nobody else can see what you type, and the whole workspace is deleted when you sign out, and in any case within roughly 12 hours of your last click. Legal basis: taking steps at your request (art. 6(1)(b)).
• We keep a visit record: your email address, first name if you gave one, how many times you have opened the demo and when you last did, plus your IP address and browser user-agent string. The address and user agent are there to catch someone scripting the sign-up form and to evidence a consent record. Legal basis: legitimate interest in knowing who is trying the product and in keeping the demo usable (art. 6(1)(f)).
• Marketing email, only if you tick the box. It is unticked by default, the demo opens either way, and nothing about access depends on it. If you do tick it, your address and first name go to Kit (formerly ConvertKit), our mailing-list provider, along with the exact wording you agreed to and the time you agreed to it. Legal basis: your consent (art. 6(1)(a)). Every email carries a one-click unsubscribe.

Nothing you type inside the demo is read by us or used for anything. It is deleted with the workspace.

Purchases are processed entirely by Gumroad (gumroad.com), which acts as the merchant of record. Your payment details are handled by Gumroad under its own policy and we never see or store them. We receive your name and email address from Gumroad in order to deliver the product and to send you release notices. Legal basis: performance of the contract (art. 6(1)(b)). See Gumroad's Privacy Policy.

The site and its database run on Vercel (hosting) and Neon(PostgreSQL, EU region). Google, Meta, Gumroad and Kit are United States companies, so the data described in sections 3 to 5 reaches the US. Those transfers rest on the EU-US Data Privacy Framework where the provider is certified under it, and on the European Commission's standard contractual clauses otherwise.

Filmmaker CRM is self-hosted software. Once you deploy it on your own infrastructure, everything in it (client details, projects, financials, footage, and the rest) sits in your own database on servers you control. We have no access to that data whatsoever. There is no phone-home, no telemetry, and no account with us.

You are the controller for everything stored in your own deployment, which means the security of it and compliance with data-protection law are yours. The same goes for the optional integrations: Google Calendar and Gmail, AssemblyAI transcription, contact enrichment, AI providers. You bring your own keys, the tokens are stored in your own database, and we never see them or anything they carry.

• Demo workspace contents: deleted on sign-out, and otherwise swept within about 12 hours of your last click.
• Demo visit record: kept for as long as we run the demo, so that a returning visitor is recognised rather than counted twice. Ask us and it is deleted.
• Mailing-list entry: kept until you unsubscribe, after which Kit retains the suppression record that stops us mailing you again.
• Purchase records: held by Gumroad under its own retention rules. Belgian tax law requires us to keep the accounting records of a sale for seven years.
• Analytics: Google Analytics is configured to expire event data after 14 months.

Under the GDPR you can ask us to do any of the following, free of charge, and we will answer within 30 days.

• Access: get a copy of what we hold about you.
• Rectification: correct something that is wrong.
• Erasure: delete it. For the demo visit record this is immediate and unconditional.
• Restriction and objection: stop us processing something, including anything we do on the basis of legitimate interest.
• Portability: receive it in a machine-readable format.
• Withdraw consent: at any time, without affecting what was done before you withdrew. Use “Manage cookies” in the footer for cookies, and the unsubscribe link for email.

You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be.

When this policy changes, the new version appears here with a new “last updated” date. If a change affects something you consented to, you will be asked again rather than told after the fact.