Privacy
A draft, written from the Engine as it runs, for New Path Pictures to approve and a lawyer to read. Items in brackets are still to be supplied. It becomes the notice when counsel delivers it. Draft 0.1.
Privacy notice
New Path Pictures Inc., [address], Calgary, Alberta ("we", "New Path Pictures") operates the Engine, a private workspace where filmmakers and producers develop film projects toward financing. This notice says what information the Engine collects, why, who processes it, how long we keep it, and how to reach us.
1. What we collect
Account information: your name, email address and password (stored only as a hash by our authentication provider), your role on the platform, and, for crew members, the profile you choose to complete (key role, awards, links, a short bio, the projects you want to work on).
Project information: the files you upload (pitch decks, budgets, posters and supporting images), the answers you give at intake, the text the Engine extracts from your files, the assessments, scores, research and drafts the Engine produces for your project, and the record of what happened on the project (uploads, runs, who was asked, who looked, who answered).
Information about people you name: when you enter crew members, vendors, buyers or partners, we store the name, email and organization you give, and the answers those people give when they open a link we send them. You are responsible for having the right to share that information.
Technical information: sign-in events, the pages you open, and the errors the system records, kept for security and support. We do not use advertising pixels or third-party analytics.
2. Why we use it
To run the Engine for you: reading your materials, producing assessments, research and drafts, and showing you where your project stands. To share what you choose to share: a doorway link, a buyer room, or an expert question shows only the material you or New Path Pictures selected. To keep the service secure and to answer support requests. To meet legal obligations. We do not sell personal information and we do not use your project materials to advertise to you.
3. Who processes it
We use established service providers, each under its own contract and security program: [Supabase] for authentication, database and file storage; [Vercel] to serve the application; [Railway] to run the Engine's background worker; [Anthropic] and [OpenAI] to run the language models that read your materials and draft text; [Google] for web fonts. The data and vendor inventory lists each provider, what it receives, where it processes, and how long it keeps it. Some providers process information outside Canada, including in the United States; Alberta's Personal Information Protection Act asks us to tell you that and to name a contact who can answer questions about it: [privacy contact]. Model providers receive only the material needed for the task you asked for; our contracts with them [do / do not] permit training on your content, and we will keep this sentence true.
4. Sharing
Your project is private to you and to New Path Pictures reviewers. It is shown to another person only when you or New Path Pictures deliberately share it: a doorway link to someone you named, a buyer room after New Path Pictures has approved the project's readiness, an expert question that carries no project identity. Each share is recorded on the project's history. A shared file is served through a link that expires (five minutes for a doorway or a room, one hour for you); withdrawing a share stops any further access but cannot recall a copy someone has already downloaded.
5. How long we keep it
[Proposed defaults, for New Path Pictures to confirm.] Account and project information: for as long as your account is active, and for [twelve months] after you close it, so a project you return to is still there. Uploaded files: the same. Records the law requires us to keep (acceptances of terms, financial ledgers, breach records): [seven years]. Backups: [thirty days] after deletion from the live system, after which the deleted data is gone from backups too. Sign-in and error logs: [ninety days].
6. Your choices
You can read, correct and update your account and project information in the Engine. You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and its projects; write to [privacy contact] and we will verify your identity and answer within [thirty days] or the time the law allows. You can withdraw a share at any time. You can decline optional questions. Deleting an account removes it from the live system at once and from backups on the schedule in section 5.
7. Security
We protect the Engine with verified sessions, database rules that confine every person to their own projects, private file storage, short-lived download links, encrypted connections, and reviews of the code that guard these paths. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the authorities the law names.
8. Contact and complaints
Privacy lead: [name], [privacy contact email], [postal address]. You may also complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.
Effective date: [to be set by counsel]. Version: [to be set by counsel].