Privacy policy

1. Controller

Titus Bewerunge, studio rhei, Eisenacher Straße 3, 10777 Berlin, email: hello@studiorhei.eu. Further details in the legal notice.

2. What this is about

rhei is software for film production companies. This policy describes which personal data is processed when you visit the website and when you use rhei, for what purposes and on what legal basis. We do not use any analytics or advertising services and do not set any tracking cookies.

3. Hosting and server logs

The website and the application are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When a page is requested, Vercel processes technically necessary data such as IP address, time, requested page and browser identifier in order to deliver the pages and protect them against abuse. These logs are kept only for a short time. The legal basis is our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR). Vercel is certified under the EU-US Data Privacy Framework; in addition, the Standard Contractual Clauses of the EU Commission apply.

4. Account and sign-in

To sign you in, we process your email address and send you an email with a sign-in code and a sign-in link; there is no password. Until you have signed in, a technically necessary cookie remembers for at most one hour which address the code was sent to. Your account, sign-in and all content are stored in a database of Supabase Inc. in its data centre in Ireland (EU). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). We have a data processing agreement with Supabase that includes Standard Contractual Clauses. The data remains stored for as long as your account exists.

5. Content you create in rhei

Production companies keep data about third parties in rhei, for example contacts, cast, crew, fees, shooting schedules and contracts. The respective production company is responsible for this data; we process it on its behalf (Art. 28 GDPR). We provide a data processing agreement on request. Payroll data is additionally stored encrypted; of bank accounts, rhei stores only the last four digits of the IBAN. Only people to whom the company has granted the corresponding rights have access.

6. Cookies and local storage

rhei only sets cookies that are needed for operation: for sign-in, the selected company, the language, the state of the sidebar and dismissed notices. This storage is strictly necessary for the service you have expressly requested (§ 25(2) no. 2 TDDDG); no consent is required for it. Fonts are loaded from our own server, not from Google.

7. Company logos, actor and agency suggestions

• Company logos: when you enter a company's website, our server retrieves the matching logo from Logo.dev (Logo.dev Inc., USA). Only the domain is transmitted, no data about you.
• Actor suggestions: when you enter a name while casting, our server searches TMDB (The Movie Database, TMDB Inc., USA) for actors. Only the name you entered is transmitted. Photos from TMDB are only linked: your browser loads them directly from TMDB, and TMDB receives your IP address in the process. rhei does not store these photos and uses them only as an internal working tool (Art. 6(1)(b) and (f) GDPR). rhei uses the TMDB API but is not endorsed or certified by TMDB.
• Agency details: rhei contains a directory of acting agencies with their business contact details taken from their respective legal notices (Impressum). No data is transmitted to third parties for this. Searching for a person's agency opens, when you click, a Google search in a new tab; what happens there is governed by Google's privacy policy.

8. Beta request and feedback

If you request access to the beta via the form or send feedback in rhei, we store the information (for example name, email, company, message) in order to reply to you and improve rhei (Art. 6(1)(b) and (f) GDPR). We delete requests once they have been dealt with and no further collaboration results.

9. Error log

If a technical error occurs, we store the error message, the affected page, the time and the internal identifier of the signed-in account in order to find and fix the error (Art. 6(1)(f) GDPR). The entries are deleted as soon as they are no longer needed for this purpose.

10. Emails

We send sign-in emails and invitations via the email service of our database provider (see section 4). We do not send marketing emails.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw any consent you have given at any time. To do so, write to us at the address given above.

You can also lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59 to 61, 10555 Berlin.