Privacy Policy

1. Who we are

SetSides is a script sides distribution and casting management platform for film and TV productions, operated from Spain.

For the purposes of GDPR, SetSides is the data controller of the personal data described in Section 3, and acts as a data processor for certain other data as explained in Section 3 below. If anything in this policy is unclear, contact us at info@setsides.app.

2. What data we collect

SetSides collects a few distinct categories of data, depending on how you use the platform:

a) Casting director account data

When you create a SetSides account, we collect your name, email address, and a password (which we never see in plain text — it is hashed and managed by Supabase Auth). If you subscribe to a paid plan, billing details (card number, billing address) are collected and processed directly by Stripe; SetSides never stores your card details on our own servers. We also keep basic account and usage data, such as your subscription plan, login activity, and the productions and features you use.

b) Cast member and Talent Pool data

As a casting director, you can add records about actors — either as cast members attached to a specific production, or as entries in your personal Talent Pool. This can include the actor's name, email address, phone number, agency, location, gender, profile photos (automatically compressed on upload), tags, private notes you write about them, and links to external profiles (e.g. IMDb, Instagram, a demo reel). This data is entered by you, about someone else — see Section 3 for what that means for who is responsible for it.

c) Actor-facing data (share links)

When you send an actor a share link to view script sides, the actor does not need to create a SetSides account to open it. When they open the link, we record a timestamp of that open event (so you can see whether and when the link was accessed), and if the actor adds annotations or notes directly on the script through the viewer, those annotations are stored and linked to that share.

d) Production content

This includes the script PDFs you upload, moodboard images, and production metadata you enter (e.g. director, tone, shooting schedule, pipeline phases, and similar production details).

3. Controller vs. processor — an important distinction

SetSides is a business-to-business tool, and much of the personal data that passes through it is data about people other than our direct customers (cast members and actors). GDPR requires us to be explicit about our role for each category of data:

SetSides is the data controller for your casting director account information — your own name, email address, billing details, and usage data. We decide how and why that data is processed, and we are directly responsible to you under GDPR for it.

SetSides is a data processor for the information you enter about cast members, Talent Pool actors, and other people (name, contact details, photos, agency, notes, etc.). You — the casting director — are the data controller for that information. That means you are responsible for having a lawful basis to collect and hold it (for example, the actor's consent, or your legitimate interest in maintaining casting records for productions you run), for its accuracy, and for honouring any rights requests those individuals make to you directly. SetSides simply stores and processes that data on your behalf, under your instructions, to provide the service.

4. Legal basis for processing

Where SetSides is the controller, we rely on the following legal bases:

• Performance of a contract — for account data needed to create your account, operate the service, and process billing.
• Legitimate interest — for basic product usage data that helps us keep the service secure, diagnose problems, and understand which features are used (see Section 8 for details on what we actually track).
• Consent — where applicable, such as if you opt in to marketing communications.
• Legal obligation — for data we must retain for tax, accounting, or other legal requirements.

5. Minors and child actors

Casting for film and TV productions routinely involves minors — child actors are cast members like any other, and casting directors using SetSides may enter and store data about them (name, contact details of a parent/guardian or agent, photos, notes, and so on) just as they would for adult actors.

SetSides does not independently verify the age of any cast member entered into the platform, and does not request or verify parental consent on your behalf. As explained in Section 3, you, the casting director, are the data controller for this information. If you are entering data about a minor, you are responsible for ensuring an appropriate lawful basis exists under applicable law — in the EU, this generally means the consent of a parent or legal guardian under GDPR Article 8, or another applicable basis such as your legitimate interest in running a lawful casting process, obtained and documented in whatever way your production and local law require. If a parent, guardian, or agent contacts SetSides directly about a minor's data, we will refer them to the casting director who added that record, since we do not control the underlying casting relationship.

6. How long we keep data

Production data (scripts, cast member records, share links, annotations, moodboards, and related metadata) is retained for as long as the production exists in your account. If you delete a production, all data associated with it — cast member records, scripts, shares, and annotations tied to that production — is deleted through cascading deletion in our database and is not recoverable.

Your account data (name, email, billing history) is retained for as long as your account is active, plus a reasonable period afterward where required for legal, tax, or accounting purposes. If you delete your account entirely, we delete your associated data on the same basis, subject to any records we are legally required to keep.

7. Who we share data with

We do not sell your data, or the data you enter about cast members. We use a small set of specialist service providers ("subprocessors") to operate SetSides, each handling only what they need to perform their function:

• Supabase — our database, authentication, and file storage provider. Nearly all data described in Section 2 passes through Supabase.
• Vercel — hosts the SetSides application and handles web traffic.
• Stripe — processes payments for paid plans. SetSides never receives or stores your full card details; Stripe handles that directly.
• Resend — sends transactional emails (e.g. share link notifications, account emails). Recipient email addresses and message content pass through Resend to deliver these emails.
• Upstash — provides rate limiting to protect public share and invite links from abuse. Upstash only stores transient, IP-based request counters that automatically expire within seconds; it does not receive names, emails, or any other personal data.

Some of these providers are based in, or process data in, the United States. Where personal data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or an equivalent recognised safeguard as the legal mechanism for that transfer.

We may also disclose data if required by law, or to protect the rights, safety, or property of SetSides, our users, or others.

8. Cookies and tracking

SetSides does not currently use any third-party analytics, advertising, or tracking cookies. We use one strictly necessary cookie, set by Supabase Auth, to keep you signed in and maintain your session securely. This cookie is essential to the service working at all (you cannot use a logged-in feature of SetSides without it), so under GDPR/ePrivacy rules it does not require a cookie consent banner, and we do not currently show one.

If we introduce any analytics, marketing, or tracking tool in the future that sets non-essential cookies, we will update this section and, where legally required, add a cookie consent mechanism before doing so.

9. Security

We take a number of concrete steps to protect the data on SetSides:

• All traffic to and from SetSides is encrypted in transit via HTTPS.
• Our database uses Row Level Security (RLS), so a database query can only ever return data belonging to the productions and account the requesting user has access to.
• Uploaded files (scripts, photos) are stored in private storage buckets, not publicly accessible URLs — access is mediated through the application and scoped policies.
• Passwords are never stored in plain text; authentication is handled by Supabase Auth using industry-standard hashing.
• Share links to script sides are token-based, can expire, and can be revoked at any time by the casting director who created them.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and, where required, the relevant supervisory authority, in line with our legal obligations.

10. Your rights

If SetSides is the controller of your data (see Section 3 — this applies to your own casting director account information), you have the following rights under GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your account and associated data.
• Data portability — request your data in a structured, commonly used, machine-readable format.
• Restriction of processing — ask us to limit how we use your data in certain circumstances.
• Objection — object to processing based on legitimate interest.

To exercise any of these rights, email info@setsides.app with your request. We will respond within one month, as required by GDPR.

If you are a cast member, Talent Pool entry, or actor whose data was entered by a casting director using SetSides, please direct rights requests to that casting director first, since they are the data controller for that information (Section 3). If you are unable to reach them, contact us and we will assist where we reasonably can, including by putting you in touch with the relevant account holder.

11. Right to complain to a supervisory authority

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a data protection supervisory authority. As SetSides operates from Spain, you can contact the Agencia Española de Protección de Datos (AEPD), whose website is www.aepd.es. You may also contact the supervisory authority in your own EU member state.

12. Changes to this policy

We may update this Privacy Policy from time to time as SetSides evolves — for example, if we add a new feature, change subprocessors, or introduce analytics. We will update the "Last updated" date at the top of this page when we do, and for material changes we will make a reasonable effort to notify active account holders (for example, by email).

13. Contact

Questions about this policy, or about how we handle personal data? info@setsides.app