Privacy Policy

ScenePaper is an independent project. It is built and operated by Geenesh S, an individual based in India — not by a company. We think you should know that up front.

Being independent does not reduce our obligations to you. Geenesh S is the data controller for the personal data described in this policy, and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023, with every duty those roles carry.

If the operator's legal structure changes — for example if ScenePaper is incorporated as a company — we will update this policy and notify you before your data becomes subject to a different controller, as described in section 6.

If you are in the EEA or UK and wish to raise something with us directly, use [email protected]. We respond to rights requests within the timeframes set out in section 11.

This is a summary for orientation. It is not a substitute for the full policy below.

• We collect what you give us (profile, filmography, messages, uploads), what your device sends us (IP, device and usage data), and what you authorise from third parties (Google sign-in, Google Calendar).
• Your Crew Card or Production House profile is public by default once cleared. Your messages, contracts and account settings are not.
• We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
• Our servers are in Mumbai, India (AWS ap-south-1). Files are stored on Cloudflare R2.
• Analytics and marketing cookies are off until you opt in. Only strictly necessary cookies run by default.
• You can export or delete your data yourself from The Booth, at any time, without contacting us.

Data you provide

Data collected automatically

Data from third parties

• Google — if you sign in with Google, we receive your name, email address and profile picture.
• Google Calendar — if you connect it, we receive calendar availability to sync your commitments. Access tokens are stored encrypted and you can disconnect at any time.

Casting attributes, if you build an Actor Profile

An Actor Profile is optional and separate from your Crew Card. If you choose to build one, you can record physical casting attributes — height, build, hair and eye colour, age range, ethnicity and skin tone, distinguishing features, accents and special skills, and the kinds of work you are comfortable being considered for.

Some of these describe your racial or ethnic origin, which the GDPR treats as special-category data and Californian law treats as sensitive personal information. We collect them for one purpose: casting calls are frequently written around a described character, and without these fields you cannot be found for those roles.

Our legal basis is your explicit consent (GDPR Article 9(2)(a)). You are asked for it directly when you open the Actor Profile, nothing is pre-filled, and every field is optional. Attributes you fill in appear on your public Crew Card and can be used by productions as search filters. You can withdraw at any time by clearing the fields or deleting the Actor Profile, which removes them immediately; withdrawal does not affect anything done beforehand. Declining costs you nothing but visibility in character-based searches — the rest of ScenePaper works exactly the same.

We do not infer any of this. If you do not enter it, we do not hold it.

What we do not collect

Aside from the casting attributes described immediately above, we do not ask for payment card details, biometric data, or special-category data such as health, religion, caste, or political opinions. We do not collect your date of birth — only an age range, if you give one. Please do not put such information into free-text fields, uploads or messages.

One deliberate exception. If you ask us to verify a production company, you may choose to upload identification for the company's authorised signatory, which can be a government-issued document. We ask for it only to confirm that the person making the claim is entitled to speak for the company — this is what stops someone registering a company name they have no connection to and then confirming their own credits with it. It is never published, never shared, and is deleted on the schedule in section 9. You can omit it and send other evidence instead.

Where the GDPR or UK GDPR applies, we rely on the legal bases below. Where India's DPDP Act applies, we rely on your consent or on legitimate uses permitted by that Act.

You can withdraw consent at any time, and withdrawing is as easy as giving it — use the cookie preferences link in the footer, or your email settings in The Booth. Withdrawal does not affect processing carried out before you withdrew.

Three kinds of email, and only one needs your consent. *Transactional* email is sent because you or your account did something — password resets, clearance decisions, submission updates — and is part of providing the service. *Notification* email covers activity you asked to hear about, and each category can be switched off individually. *Marketing* email — our newsletter and product updates — is off until you explicitly turn it on, carries a one-click unsubscribe link in every message, and stops immediately when you use it. Agreeing to marketing cookies is not agreement to marketing email; they are separate choices and we treat them separately.

This is the section most people need. ScenePaper only works if productions can discover crew, so parts of your profile are public on the open internet and may be indexed by search engines.

You control this. You can hide your day rate, set your profile to unlisted, or delete it entirely from The Booth. Note that search engines may retain cached copies of a previously public profile for a period after you unlist it, which is outside our control.

Content you post in public areas — The Lot feed, Green Room questions and answers, portfolio microsites — is public by design.

We do not sell your personal data. We do not share it for cross-context behavioural advertising. We have never done either.

We share data in four situations: with other members as part of how the platform works (section 5), with the service providers below, where you tell us to, and where the law requires it.

Subprocessors

Each provider is engaged under a data processing agreement, processes data only on our instructions, and is not permitted to use it for their own purposes. We review this list when we add or remove a vendor and update this policy accordingly.

Other disclosures

• At your direction — for example when you send a contract to a collaborator, or accept a booking.
• Legal and safety — where we are required to comply with a valid legal process, or where disclosure is necessary to investigate fraud, abuse, or a threat to someone's safety.
• Corporate transactions — if we are involved in a merger, acquisition or asset sale, data may transfer to the successor. We will notify you before your data becomes subject to a different privacy policy.

Our primary infrastructure is in India. Several of our subprocessors operate globally.

If you are in the EEA or the UK, your data is transferred to India and other countries that have not received an adequacy decision from the European Commission or the UK government. For those transfers we rely on Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical measures including encryption in transit and access controls.

You can request a copy of the relevant transfer safeguards by writing to [email protected].

We use three categories. Only strictly necessary cookies run before you choose — analytics and marketing default to off, and stay off unless you opt in.

You can change your choices at any time via the cookie preferences link in the footer. Your choice is recorded with a timestamp so we can evidence it, as required by GDPR and the DPDP Rules.

We do not respond to browser Do Not Track signals, because there is no common standard for them. We do honour Global Privacy Control signals as an opt-out of sale and sharing where applicable law requires it — though as stated, we do not sell or share personal data in the first place.

We keep personal data only as long as we need it for the purpose it was collected, and then delete or anonymise it.

Where we must keep something to comply with a legal obligation or to establish or defend a legal claim, we keep only what is necessary for that purpose.

We apply technical and organisational measures appropriate to the risk, including:

• TLS encryption for all data in transit, with HTTP Strict Transport Security enforced
• Encryption at rest for databases, backups and stored files
• Encrypted storage of third-party access tokens, such as Google Calendar credentials
• Passwords stored hashed, never in plain text
• Role-based access control, so staff and team members see only what their role requires
• Rate limiting, a web application firewall, and automated abuse detection
• A content security policy and standard browser hardening headers
• Regular backups, with restoration tested

No system is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, you — without undue delay and consistent with GDPR Art. 33–34 and the breach notification requirements under the DPDP Rules.

Your rights depend on where you are. Most of them you can exercise yourself, immediately, from The Booth — including full data export and account deletion.

If you are in the EEA or UK (GDPR / UK GDPR)

Access; rectification; erasure; restriction of processing; data portability; objection to processing based on legitimate interests; objection to direct marketing at any time; and withdrawal of consent. You also have the right to lodge a complaint with your local supervisory authority.

If you are in India (DPDP Act, 2023)

Access to a summary of your personal data and the processing carried out; correction, completion, updating and erasure; grievance redressal; and the right to nominate another person to exercise your rights in the event of death or incapacity. You may raise a grievance with our Grievance Officer at [email protected], and if unresolved, escalate to the Data Protection Board of India.

If you are in California (CCPA / CPRA)

Right to know what we collect and why; right to delete; right to correct; right to opt out of sale or sharing — we do not sell or share personal data; right to limit use of sensitive personal information — the only sensitive personal information we hold is the optional casting attributes described in section 3, which you can clear at any time; and the right not to be discriminated against for exercising these rights.

If you are in Nigeria (NDPA 2023)

Access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with the Nigeria Data Protection Commission.

How to exercise them

Use The Booth for export and deletion, or write to [email protected]. We respond within 30 days, and will tell you if we need longer. We may ask you to verify your identity before acting on a request, and we will not charge you unless a request is manifestly unfounded or excessive.

We use automated systems in a limited way, and none of them produce legal effects or similarly significant effects on you without human involvement.

• Image safety screening — uploaded images are checked automatically for explicit content before publication. Flagged uploads are reviewed by a person before any account action is taken.
• Profanity and abuse filtering — text posted publicly is screened automatically.
• Search and ranking — Scout results and Spotlight placement are ordered algorithmically using profile completeness, verification status, relevance and activity.
• Job matching alerts — Crew Call alerts are matched to your stated role, department and location.

You have the right to request human review of any automated decision that materially affects you. Write to [email protected].

We do not use your personal data, your uploads, or your messages to train generative AI models, and we do not license them to third parties for that purpose.

ScenePaper is for professional use and is not intended for anyone under 18. You must be at least 18 to create an account, as set out in our Terms of Service.

We do not knowingly collect personal data from children. Consistent with India's DPDP Act, we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us with personal data, contact [email protected] and we will delete it.

We review this policy at least annually and whenever our processing changes materially.

If we make a material change we will update the "last updated" date at the top and notify you by email or in-app notification before the change takes effect. Continuing to use ScenePaper after a change takes effect means you accept the updated policy. If you do not accept it, you can delete your account at any time.

If you are not satisfied with our response, you may complain to your data protection authority: the Data Protection Board of India, your EEA supervisory authority, the UK Information Commissioner's Office, or the Nigeria Data Protection Commission, as applicable.