Privacy and cookie policy
1. Data controller
Erwan MARTINEAU, sole trader (EI), KSPNAI (Kosapan AI), ruelle de Kereliza, 56000 Vannes, France, contact@kspnai.com. Processing complies with Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978.
For data you enter about people in your production, you (or your production company) are the data controller; PrepWrap acts as processor (see article 4 of the terms of use).
2. Data processed
- Account
- Email, name, password (stored only as an encrypted hash, never in plain text), two-factor authentication setting. Legal basis: providing the service. Retention: as long as the account exists; deleted on request.
- Projects
- Script, breakdown, schedule, call sheets, records, budgets, expenses, documents, contact details of cast, crew and suppliers. Legal basis: providing the service to the project holder. Retention: as long as the account exists. A deleted project is kept in a recoverable bin until the account is closed or you ask for its deletion.
- Sign-in log
- Date, anonymous device identifier, device type, operating system and browser. Legal basis: legitimate interest (account security, list of your devices). Retention: as long as the account exists.
- Server technical logs
- IP address, date, requested page, browser. Legal basis: legitimate interest and security obligation. Retention: 12 months at most.
- Messages you send us
- Contact details and message content. Legal basis: legitimate interest in replying. Retention: 3 years after the last exchange.
- Backups
- Encrypted copy of all data, every night. Retention: 30 daily and 12 monthly backups, 12 months at most.
3. Recipients and providers
Your data is never sold or transferred and is never used for advertising. Only the publisher and the following providers have access to it, each for its own task only:
- OVH SAS (France): hosting of the website and app, servers in the European Union.
- Infomaniak Network SA (Switzerland), Swiss Backup service: encrypted backups. Switzerland benefits from a European Commission adequacy decision.
- Artificial intelligence provider, only when you use an AI feature: currently DeepSeek (Hangzhou DeepSeek Artificial Intelligence, China). Only the headings and text of the scenes concerned are sent, never your email or contact records. This is a transfer outside the European Union to a country without an adequacy decision. If you do not want this, do not use the AI features: the rest of the app works without them.
- OpenStreetMap (OpenStreetMap Foundation, United Kingdom, a country with an adequacy decision): location map and address search. The service receives the browser's IP address and the address searched.
- MET Norway (Norwegian Meteorological Institute, European Economic Area): weather forecasts from the coordinates of shooting locations, with no personal data.
- Twilio Inc. (United States) and Telegram: only if the project holder connects these services to send text messages or announcements to their team. The numbers and messages concerned then go through these services, under their own terms.
4. Security
Encrypted connection (HTTPS), passwords stored as hashes, two-factor authentication, access rights per section, encrypted and verified backups.
5. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to give instructions about your data after your death. Write to contact@kspnai.com; we reply within one month. People whose details appear in a project can also contact the production concerned.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the authority of your country.
6. Cookies and browser storage
PrepWrap uses no advertising, social media or audience measurement cookies. Fonts are hosted on prepwrap.com: no request is sent to Google.
Only items strictly necessary for the service are used, which do not require your consent:
- Session cookie for the app (12 hours; 2 hours for the demo) and the administration: it keeps you signed in.
- Browser local storage: your display preferences (theme, font, language, menu, tips, regional variant, vocabulary), an anonymous device identifier for the list of your signed-in devices, and a copy of the project for working on location without a connection. You can clear it at any time in your browser settings.
7. Changes
This policy may change, in particular if a provider changes. The update date is shown at the top of the page.