1. Data Controller

The data controller responsible for your personal data is Soluciones Técnicas Satenur, S.L. (NIF B22803431), Elisenda Ribatallada 4, 08172 Barcelona, Spain, which operates EndCreditsPro. For any data protection matter, you can contact us at hello@endcredits.pro.

Data inside productions. The credits, names, roles and email addresses that our users enter into their projects belong to those users and their productions, who are the controllers of that data. For it, we act only as their data processor (see section 2, "Content of your projects", and section 8 of our Terms of Service).

2. Data We Collect

Account data

When you register for EndCreditsPro, we collect:

Email address
Name (if provided)
Password (stored in hashed form — we never store your plain-text password)
The date and version of the Terms of Service and Privacy Policy you accepted
How you arrived at sign-up: the page of our website you signed up from, the site that referred you there, campaign parameters in the link (such as utm_source), and your browser's language and time zone. Our team receives this in an internal notification for each new account
Your settings (for example, notification preferences) and your usage counters for the beta's fair-use limits
Your answers to our short welcome survey: your role, the type and stage of your production, how you make credits today and, if you choose to tell us, your company and production title. You can edit them in Settings → Profile
Whether you agreed to receive our newsletter, and when

Content of your projects

Everything you and your team enter into a project: production details, credit lists with the names and roles of cast and crew, layouts, comments, uploaded images and fonts, version history, approvals and rendered videos. This content usually contains personal data about third parties (the people in the credits). We process it only on behalf of the user or production that owns the project, to provide the service.

People invited to a project

When a user invites someone to collaborate on, review or approve credits, we receive that person's email address (and, if provided, their name and preferred language) from the user, and send them an email with a personal link. What they enter through that link (names, comments, approval decisions) becomes part of the project. If you received such an invitation and have questions, contact the production that invited you or write to us.

Waitlist data

If you join our waitlist, we collect your email address so we can tell you when EndCreditsPro becomes available. If you have also accepted analytics cookies, we attach that email address to your analytics profile in PostHog (see section 5), so that we can understand which pages led you to sign up and, if you later create an account, connect your website visits to it. Without analytics consent, your email address is not sent to PostHog.

Usage data

We automatically collect information about how you use the website and the service:

Pages visited, links and buttons clicked, and features used
Browser type, operating system, device type, screen size and language
Approximate location (country/city), derived from your IP address at the moment of collection. PostHog is configured to discard the IP address itself; Google Analytics does not store full IP addresses
Referring URL, time zone and session duration
If you have accepted analytics cookies: recordings of your sessions (see "Session recording" in section 5)

Before any analytics data is sent, we remove sensitive parameters from web addresses (for example access tokens, authorisation codes and email addresses).

Communications

If you contact us by email, we retain a record of that correspondence.

3. How We Use Your Data

We use your data to:

Create and manage your account
Provide the EndCreditsPro service
Send essential service communications (account confirmations, invitations you ask us to send, important updates)
Apply the beta's fair-use limits and prevent abuse of the service
Understand who uses EndCreditsPro and contact you to ask about your experience during the beta (you can tell us at any time that you'd rather not be contacted)
Send you our newsletter and product news, only if you ticked the box to receive them; you can unsubscribe at any time in Settings → Profile or from any newsletter
Analyse how the service is used in order to improve it
Comply with our legal obligations

We do not use your data for advertising, and we do not sell your personal data to third parties.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract performance — processing necessary to provide the service you have signed up for (Art. 6(1)(b) GDPR)
Legitimate interests — aggregate, cookieless visit counting to improve the service, which stores nothing on your device and does not identify you, and asking our beta users about their experience (Art. 6(1)(f) GDPR)
Legal obligation — where required by applicable law (Art. 6(1)(c) GDPR)
Consent — for analytics cookies, similar browser storage and session recording, where you have given consent or, outside the EU, have not opted out, and for our newsletter and commercial emails (Art. 6(1)(a) GDPR)

5. Third-Party Services

Service providers (data processors)

We rely on the following providers to run the service. Each acts as our processor under a data processing agreement:

Amazon Web Services (Amazon Web Services EMEA SARL) — hosting of the application and its database, file storage, video rendering and transactional email (Amazon SES). Data is stored in the EU (Frankfurt region).
Cloudflare Turnstile (Cloudflare, Inc.) — protects the sign-up and password-reset forms from bots. When you open those forms, Cloudflare checks signals from your browser and IP address to tell people from automated traffic; it does not set cookies or track you across sites.
AI model providers — only when you use an import feature, the content you choose to import is sent for classification to OpenRouter, Inc. (United States), which routes it to the configured model provider (for example, OpenAI or Anthropic), and, for video imports, to Anthropic PBC (United States). We do not use your content to train AI models.

PostHog (product analytics)

We use PostHog (PostHog Inc.) to understand how visitors use our website and app, for example which pages lead people to join the waitlist or where they get stuck. PostHog acts as our data processor. We use PostHog's EU Cloud, so analytics data is stored on servers in the European Union. PostHog is configured to discard your IP address after deriving an approximate location from it.

What PostHog collects depends on your choice:

With your consent — PostHog sets first-party cookies (named ph_*) on the endcredits.pro domain and uses your browser's local storage to recognise you across visits, and to link your website visits with your use of the app at app.endcredits.pro if you sign up. It records page views, clicks and the events described above, and may record your session (see below).
Before you decide, or if you reject — PostHog runs in cookieless mode: nothing is stored on your device, no session is recorded and no profile is created. Page views and events are counted using an anonymous identifier that PostHog's servers compute from a hash of your IP address, browser and our site, combined with a secret value that changes every day. This lets us count unique visitors per day without being able to recognise you on later days.

Session recording

If you accept analytics cookies, PostHog may record how you interact with our pages (mouse movement, clicks, scrolling and page changes) so that we can find and fix usability problems. Recordings reconstruct the page rather than capturing video of your screen. Recordings can include the text shown on the page and what you type into form fields, including the content of your credits (for example, the names in a production's credits) and your email address. Passwords are always masked and never captured. Only our team can view recordings, solely to improve the service, and they are deleted automatically (see section 7). Sessions are never recorded without your consent.

Google Analytics

We use Google Analytics (Google LLC) to understand how visitors use our website. Google Analytics runs in Consent Mode: it sets cookies on your device only if you have consented (see section 6). Without consent it sets no cookies and only sends cookieless, aggregated signals. Usage data is sent to Google servers, which may be located in the United States. We have enabled IP anonymisation so your full IP address is never stored by Google. Google is certified under the EU–US Data Privacy Framework. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

For more information on how Google uses data, see Google's Privacy Policy.

6. Your Privacy Choices

Visitors in the European Union and nearby regions — we show a banner asking you to accept or reject analytics cookies. Until you choose, we treat you as if you had rejected them. Rejecting is as easy as accepting, and you can use the website either way. We work out whether to show the banner from your browser's time zone. If we cannot tell, we show it.
Visitors elsewhere — analytics cookies are enabled by default, and you can turn them off at any time.
Global Privacy Control — if your browser sends a Global Privacy Control (GPC) signal, we treat it as a rejection of analytics cookies, wherever you are.
Changing your mind — use the Privacy choices link in the footer of every page (or ). If you withdraw consent, we delete the PostHog cookies and storage on your device and switch back to cookieless counting.

Your choice is stored in a cookie named ecp_consent on the endcredits.pro domain for 180 days, so it applies to both the website and the app. See our Cookie Policy for the full list of cookies.

7. Data Retention

We retain your account data for as long as your account is active. If you sign up but never confirm your email address, the account is deleted automatically after 7 days. Project content is kept until the project's owner deletes it or deletes their account.

You can delete your account at any time in the app (Settings → Profile → Delete account). Your account, the organizations you own and all their projects are deleted immediately; copies in our backups, if any, are overwritten within 30 days. In organizations owned by others, what you contributed stays in their projects.

After deletion we keep a minimal record that the account existed — email address, name, sign-up and deletion dates, and the version of the terms accepted. This record is blocked (Article 32 LOPDGDD): it is not used for any purpose and is kept only to handle possible legal claims, for up to five years, after which it is erased.

If you join the waitlist, we keep your email address until the service launches and you have been invited, or until you ask us to remove it.

PostHog analytics events and session recordings are kept for the retention period of our PostHog plan (currently up to one year for events and up to 30 days for session recordings) and are then deleted. Anonymised, aggregated analytics data (which cannot identify you) may be retained indefinitely for service improvement purposes.

8. International Transfers

PostHog analytics data is stored in the European Union (PostHog EU Cloud). PostHog Inc. is a US company, so limited access from outside the EEA (for example, by its support staff) may occur under the Standard Contractual Clauses in PostHog's data processing agreement.

Google Analytics data may be transferred to and processed in the United States. Such transfers are subject to appropriate safeguards under GDPR, including Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable.

Content you choose to import with an AI feature is processed in the United States by the providers listed in section 5, under Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. The rest of your account and project data stays in the EU.

9. Your Rights

Under GDPR and Spanish data protection law (LOPDGDD), you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — request correction of inaccurate or incomplete data
Erasure — request deletion of your personal data ("right to be forgotten")
Restriction — request that we restrict processing of your data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent, withdraw it at any time

You can delete your account yourself from the app's settings. To exercise any other right (including a copy of your data), contact us at hello@endcredits.pro. If you appear in a production's credits or were invited to one, you can also address the production directly; we will pass on any request we receive about its data. We will respond within 30 days. If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish data protection authority:

Agencia Española de Protección de Datos (AEPD)
www.aepd.es

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Passwords are stored using industry-standard hashing algorithms. Access to personal data is restricted to personnel who need it to provide the service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page. Continued use of the service after any changes constitutes acceptance of the updated policy.

12. Contact

For any questions about this Privacy Policy or how we handle your data, contact us at hello@endcredits.pro.