FestForge privacy policy
How FestForge handles personal information
This policy explains how FestForge collects, uses, stores and shares personal information when you visit the website, create an account, add film projects, invite collaborators, generate festival strategy reports, use admin or support workflows, or otherwise interact with the service.
Who We Are
FestForge is an online film festival strategy service for independent filmmakers. In this policy, "FestForge", "we", "us" and "our" mean the operator of the FestForge website and service atwww.festforge.art.
We act as controller for the personal information we use to run FestForge accounts, film projects, strategy reports, service communications, security operations and website administration. Some vendors process information for us as processors or service providers.
Contact us atprivacy@festforge.artfor privacy requests, questions or complaints.
What We Collect
The information we collect depends on how you use FestForge. We do not ask for government ID numbers, payment card numbers, health records or precise GPS location in the current product.
| Category | Examples | Source |
|---|---|---|
| Account and profile information | Email address, user ID, display name, avatar URL, authentication events, password reset and email confirmation records, plan level and account status. | You, your authentication provider and Supabase Auth. |
| Film project information | Film title, production year, category, runtime, country, language, filmmaker location, completion date, festival run timing, premiere status, student or first-time filmmaker status, genre, representation and tone tags, logline, synopsis, screener links, screener passwords, trailer links, poster or still links, prior festival history, goals and budget preferences. | You or collaborators you invite. |
| Collaborator information | Collaborator email address, display name, role, invite status, inviting user ID and whether the collaborator should appear on the film profile. | You, collaborators or invited users. |
| Strategy and usage information | Generated strategy reports, ranked festival recommendations, budget allocations, eligibility warnings, manual status notes, generation timestamps, rate-limit counters and download activity needed to operate paid or limited features. | Your use of FestForge and the system output created for you. |
| Communications | Authentication emails, film-share invitations, support requests, administrative messages and related delivery metadata. | You, invited users and our email service provider. |
| Technical and security information | IP address, browser and device information, session cookies, request logs, error logs, security rate-limit keys, approximate location submitted in town searches and information needed to keep the service available and secure. | Your browser, device, hosting provider and security systems. |
| Optional analytics information | Page views, page paths, product events, subscription events, anonymous or internal user IDs, device and browser metadata, referrers and session-level product usage where you accept analytics. | Your browser and product activity after analytics consent. |
| Public festival and industry data | Publicly available festival names, websites, deadlines, fees, rules, locations, categories, contacts, accreditation signals, profile text and source metadata used to build the festival database. | Public festival websites, submission platforms and other public sources. |
Some film details may reveal information about identity, location, creative themes, representation, protected characteristics or personal circumstances. Only provide information that you are comfortable using for festival strategy and collaboration.
How We Use Data
We use personal information only for disclosed service, security, communication, compliance and improvement purposes. We do not sell personal information.
Provide the service
Create accounts, authenticate users, save film projects, generate festival strategies, provide reports, manage collaborator access and operate downloads.
Typical legal basis: Contract or steps taken before a contract.
Improve recommendations
Assess eligibility, deadlines, budget fit, festival quality, location preferences and data confidence so reports are useful and explainable.
Typical legal basis: Contract and legitimate interests in improving the service.
AI-assisted quality review
Send strategy output and relevant film and festival context to an AI provider to check for contradictions, missing warnings or likely strategy issues before a report is shown.
Typical legal basis: Contract and legitimate interests in quality control.
Security and fraud prevention
Authenticate sessions, enforce rate limits, detect misuse, prevent unauthorized access, debug incidents and protect users, FestForge and public festival data sources.
Typical legal basis: Legitimate interests and legal obligations.
Analytics and product improvement
Understand page traffic, conversion, feature usage, checkout flow performance and where the service can be improved.
Typical legal basis: Consent where required.
Communications
Send account emails, password resets, confirmations, collaborator invitations, service notices and support replies.
Typical legal basis: Contract, legitimate interests and consent where required.
Administration and legal compliance
Maintain business records, enforce terms, handle complaints, exercise legal rights, respond to lawful requests and comply with tax, accounting, consumer and data protection obligations.
Typical legal basis: Legal obligations and legitimate interests.
AI Processing
FestForge uses automated matching and AI-assisted review to help generate, check and explain festival strategy reports. AI review is intended to identify possible contradictions, eligibility risks, missing warnings and data quality issues. It does not make legally binding, employment, credit, housing, medical or similarly significant decisions about users.
When AI review is enabled, relevant film project details, generated strategy output and festival context may be sent to OpenAI or another configured AI provider. We instruct AI systems to use only supplied information for the review task and not to invent live festival verification. Do not include highly sensitive information in film notes or links unless it is necessary for your strategy.
Generated recommendations can be wrong or incomplete. You should verify festival rules, fees, deadlines, premiere requirements and submission platform terms before paying a festival or submitting a film.
Retention
We keep personal information for as long as needed for the purposes described in this policy, including account operation, report access, collaboration, security, legal compliance, dispute handling and backups.
- Account records are generally kept while your account remains active and for a reasonable period after closure.
- Film projects, collaborator records and strategy reports are kept until you delete them, close your account or ask us to delete them, subject to legal, security and backup limits.
- Security logs, rate-limit counters and diagnostic records are kept only as long as reasonably needed for security, debugging and abuse prevention.
- Public festival database records may be retained and updated independently because they are used as business reference data and are not generally user account data.
Deleted information may persist temporarily in encrypted backups, logs or archives before routine deletion cycles complete.
Your Rights
Depending on where you live, you may have the following rights. We will not discriminate against you for exercising privacy rights.
- Access the personal information we hold about you.
- Correct inaccurate or incomplete information.
- Delete information, subject to legal, security, backup and legitimate operational limits.
- Restrict or object to certain processing, including direct marketing if introduced.
- Receive a portable copy of information you provided where the right applies.
- Withdraw consent where processing is based on consent.
- Appeal or complain if you think we have not handled a request properly.
To make a request, emailprivacy@festforge.artfrom the email address linked to your FestForge account. We may ask for information needed to verify your identity, protect your account and confirm authority if an authorized agent acts for you.
UK users may complain to the Information Commissioner's Office. Users in the EU or EEA may complain to their local supervisory authority. California users may contact the California Privacy Protection Agency or the California Attorney General where applicable.
US State Notices
This section provides additional notice for users in California and other US states with comprehensive privacy laws. The categories below describe our practices during the preceding 12 months.
Identifiers
Email address, user ID, display name, authentication identifiers, IP address and collaborator email addresses. Used for accounts, security, support, collaboration and communications.
Commercial and account information
Plan level, feature limits, strategy generation activity, report records and service usage history. Used to provide and administer FestForge.
Internet or network activity
Session data, request logs, device/browser information, authentication events and security signals. Used for security, debugging and service reliability.
Geolocation-related information
Approximate locations you submit for filmmaker location or town searches. We do not intentionally collect precise GPS location in the current product.
User-generated content
Film project details, creative materials, screener links, collaborator notes and strategy status notes. Used to create and manage festival strategy reports.
Inferences
Festival fit, budget pressure, eligibility risks, quality flags and recommendation logic derived from film and festival data. Used to provide strategy outputs.
We do not sell personal information. We do not knowingly share personal information for cross-context behavioral advertising. We do not knowingly collect personal information from children under 13, and FestForge is not intended for users under 16. We do not use sensitive personal information to infer characteristics beyond what is needed to provide the film festival strategy service.
California residents may request access, correction, deletion, portability, information about categories collected, sources, purposes, recipients and opt-out rights if applicable. Because we do not currently sell or share personal information for cross-context behavioral advertising, we do not provide a separate "Do Not Sell or Share My Personal Information" link.
International Transfers
FestForge may process and store information in the United Kingdom, United States, European Economic Area and other countries where our service providers operate. These countries may have data protection laws that differ from those where you live.
Where required, we use appropriate safeguards such as contracts, data processing terms, standard contractual clauses, transfer risk assessments or equivalent mechanisms to protect transferred personal information.
Security
We use administrative, technical and organizational safeguards designed to protect personal information, including authentication controls, access restrictions, database controls, rate limiting, secure transport, provider security features and logging. No online service can guarantee absolute security.
You are responsible for keeping login credentials private, limiting collaborator access to people you trust, and avoiding unnecessary sensitive information in film notes, screeners, passwords or links.
Changes
We may update this policy when the service, vendors, laws or privacy practices change. If changes are material, we will provide notice through the website, account email or another appropriate method. The date at the top shows when this policy was last updated.
Contact
For privacy requests, questions, complaints or accessibility needs related to this policy, contact:
FestForge Privacy
Email:privacy@festforge.art
Include the account email address, the right you want to exercise and enough detail for us to understand the request. Do not send screener passwords, payment details or highly sensitive material by email unless we specifically ask for it.