Privacy Policy
What personal data Draft2Cut processes, why, for how long, who it is shared with, and the rights of the people it belongs to.
Last updated 18 September 2026
1.Who is responsible
The data controller is Alcalambra S.r.l., registered at Via Chopin 37, 20141 Milano, Italia (P. IVA IT-04629320963). For anything concerning personal data, including the rights described below, write to privacy@draft2cut.com.
No data protection officer has been appointed: this processing does not fall within the cases that make one mandatory under Article 37 of the Regulation. Requests go to the address above.
2.Where the data lives
The application and the database run on Fly.io in the Francoforte (Germania) region. Generated files — images, audio, video, documents — are stored on Cloudflare R2, in a bucket bound to the Unione Europea jurisdiction.
Account and project data therefore does not leave the European Economic Area, with one exception — the most important one in this policy: content sent to an AI provider to be processed. That exception has a section of its own.
3.What we process
| Category | What it covers |
|---|---|
| Account | Email address, first and last name, password (stored only as a bcrypt hash, never in clear), preferred language, the role held in each organisation, activation and terms-acceptance dates. |
| Production content | Everything written or generated: treatments, screenplays, characters, environments, shots, images, audio, video, music, and the prompts that produced them. |
| Images and voices of people | Photographs and recordings uploaded as a reference for a character. When used to make a face speak or move they become biometric data: see the dedicated section. |
| Usage and cost | A record of each generation: which activity, which model, how many tokens or minutes, the estimated cost, the time and the IP address of the request. |
| Activity log | Who did what and when, for operations that change an organisation: creations, deletions, configuration changes, invitations, role changes. |
| Billing | Company name, address, VAT number and invoice history, for paid plans. Of payment methods we keep only the last four digits and the card brand. |
| Technical | IP address and browser information in server logs, for diagnostics and security. |
4.Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running the service: accounts, projects, generations, file storage. | Performance of the contract (Art. 6(1)(b)). |
| Invoicing and meeting accounting and tax obligations. | Legal obligation (Art. 6(1)(c)). |
| Keeping the activity and usage logs, preventing abuse, measuring cost. | Legitimate interest (Art. 6(1)(f)): being able to reconstruct who did what inside a shared organisation, and to attribute costs to whoever incurs them. |
| Sending service messages: invitations, activations, notice that a job has finished. | Performance of the contract (Art. 6(1)(b)). |
| Processing real people's faces and voices for animation and lip sync. | Explicit consent of the person depicted (Art. 9(2)(a)), which whoever uploads the material must have obtained. |
We do not profile, we make no automated decisions producing legal effects on individuals, and we sell data to no one.
5.Faces and voices: biometric data
Uploading a real person's photograph or voice to build a character means processing a special category of personal data. Draft2Cut does not use it to identify anyone, but transmits it to providers that derive face and voice models from it.
Whoever uploads that material acts as controller of their own processing and answers for it: they must hold a written release from the person depicted, with a defined scope of use and duration. Facial-animation providers require this expressly in their contracts — they do not grant those rights, they demand them from whoever uploads.
Anyone who would rather not process biometric data has two routes: fully generated characters, which depict nobody, or the engines that run on your own infrastructure, where the material never leaves your perimeter.
6.Who we share it with
To generate something, the text or image needed to produce it is sent to the provider chosen for that craft, and to that one only. The choice is made per project and is visible on every screen that generates anything.
- Language model providers, for screenwriting and text analysis.
- Image generation providers, for characters, environments, props and storyboards.
- Speech synthesis and video generation providers, for dialogue, animation and lip sync.
- Infrastructure providers: hosting, file storage, transactional email.
A named list of the active providers, with each one's country and role, is available on request at the address given above, and is kept current because it changes more often than this document. No provider is permitted to use transmitted content to train its models.
Several providers are established outside the European Economic Area, notably in the United States: transfers rely on the European Commission's standard contractual clauses or on an adequacy decision, depending on the provider.
Anyone who supplies their own API keys sends content under their own contract with that provider: the relationship is direct and governed by that contract. Anyone using the local engines — Ollama, ComfyUI, Piper and the others that run on your own machine — transmits nothing to anyone.
7.How long we keep it
| Data | Retention |
|---|---|
| Account and production content | For as long as the account exists. |
| Deleted projects and files | Removed on deletion; the archive of a project you set aside stays for as long as you keep it. |
| Activity and usage logs | Twenty-four months: what it takes to reconstruct a disputed charge or an unusual access. |
| Invoices and accounting records | Ten years, as Italian law requires. |
| Server technical logs | Ninety days. |
When an organisation is closed, its files are removed from storage in a single operation: they are filed under a path that belongs to that organisation and to no other. Only the records the law requires us to keep remain.
8.How we protect it
- Passwords are stored as bcrypt hashes: not readable even by whoever administers the system.
- API keys entered by customers are encrypted at rest (AES-256-GCM, key derived with PBKDF2).
- Invitation tokens are stored as a fingerprint: reading the database does not let anyone sign in as someone else.
- Every query is scoped to the organisation it belongs to, and each organisation's files live under a separate path.
- Traffic is encrypted in transit; session cookies are httpOnly and not readable from JavaScript.
9.Your rights
Anyone may ask to access their data, correct it, erase it, restrict its processing, receive it in a machine-readable format, and object to processing based on legitimate interest. Where processing rests on consent, consent may be withdrawn at any time without affecting what was done before.
Requests go to privacy@draft2cut.com and are answered within one month. Anyone who believes the processing breaches the Regulation may complain to the Italian supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or to the authority of their country of residence.
If you are part of someone else's crew and want your account deleted, note that the content produced stays with the organisation that commissioned it: what disappears is the person's identity, not work done on another's behalf.
10.Changes
If this policy changes materially, account holders are notified before the changes take effect. The date at the foot of the page always says which version you are reading.