Privacy Policy

Draft — pending legal review. A strict first draft for the Moving Pictures platform. It is written to be GDPR / DSGVO-aware but has not been reviewed by counsel and is not yet binding. Named processors and retention periods will be confirmed before launch.

Controller: LF Digital Solutions LLC (a Wyoming, USA LLC operating the Moving Pictures platform — the "Platform"). See the Imprint for entity and contact details. Questions or rights requests: hello@movingpicturesagency.com.

1. What we collect

Account data: name, email, password (hashed), role (Creator or Editor), and profile details you provide.
Project data: briefs, uploaded footage and assets, deliveries, messages, revisions and approvals in the workspace.
Payment data: the amounts and metadata needed to authorize, capture and pay out. Card details are handled by our payment processor — we do not store full card numbers. Editors provide payout details for cross-border payment.
Technical data: IP address, device/browser info and essential cookies needed to run the service securely; non-essential analytics only with consent (see §6).

2. Why we use it & legal bases

We process data to operate the marketplace — matching Creators and Editors, running project workspaces, processing escrow-style payments and payouts, providing support and dispute resolution, and keeping the service secure. Legal bases (GDPR Art. 6): performance of a contract (running your projects and payments), legitimate interests (security, fraud prevention, improving the service), consent (non-essential analytics/cookies), and legal obligation (tax, accounting, anti-fraud record-keeping).

We share only what is necessary with:

Payment & payout providers — e.g. Stripe (collection/escrow) and Wise (cross-border editor payouts). They act under their own terms and licences and receive only the data needed to move money.
Hosting & storage — our EU host (Hetzner, Falkenstein, Germany) for the application and database, and Cloudflare R2 for large media (footage and deliverables) and content delivery.
Email — Resend sends transactional email (e.g. verification, notifications) on our behalf.
Communication & infrastructure providers strictly to operate the service.

We self-host our website fonts (no third-party font CDN), so simply loading the site does not send your data to an outside font provider.

Within a project, a Creator and their matched Editor see the project data needed to do the work. We do not sell your personal data.

4. International transfers

We host in the EU by default. Some processors (and editor payouts) involve transfers outside the EU/EEA — including the US (Platform operator) and Indonesia (editor payouts). Such transfers are made under appropriate safeguards (e.g. Standard Contractual Clauses or an adequacy basis) where required.

5. Retention

We keep account and project data while your account is active and as needed to deliver the service, resolve disputes, and meet legal/tax obligations; we then delete or anonymize it. Creators on a media-vault/retention plan keep their project media for the plan's retention period. Source footage is deleted on request and on editor off-boarding, subject to legal holds.

6. Cookies & analytics

The site and app use strictly necessary cookies and local storage to function (e.g. session, security, and remembering your cookie choice). We run no advertising or analytics tracking. Optional embedded media — for example a showreel video hosted on YouTube — loads only when you choose to play it (and via YouTube's privacy-enhanced, no-cookie mode). A cookie banner records your choice; you can change or withdraw it any time via "Cookie settings" in the footer.

7. Your rights

Subject to law, you may access, correct, export (portability), delete, restrict or object to the processing of your personal data, and withdraw consent. EU/EEA users may lodge a complaint with their supervisory authority. To exercise any right, contact hello@movingpicturesagency.com; we respond within the legally required timeframe.

8. Security

We use encryption in transit, hashed credentials, access controls and secure object storage. No system is perfectly secure, but we take reasonable measures to protect your data and will notify you and any regulator of a qualifying breach as required.

9. Changes

We may update this policy; material changes will be communicated before they take effect.