Privacy Policy

1. Introduction

This Privacy Policy explains how contentmaker.space BV ("contentmaker.space", "we", "us", or "our") collects, uses and protects personal data when you use the contentmaker.space platform (the "Platform"), whether through the web application or our mobile applications.

contentmaker.space BV is a company incorporated under Belgian law, registered with the Belgian Crossroads Bank for Enterprises under number 1019179691, with its registered office at Bampslaan 21 3.01, 3500 Hasselt, Belgium.

contentmaker.space is a SaaS operating system for creative production agencies, supporting the workflow from pitch to final delivery. The Platform is used by production agencies and the team members, clients and freelance collaborators they invite into their workspaces.

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Belgian data protection law.

Two distinct roles. When you create an account and use the Platform as a registered user, contentmaker.space is the controller of your personal data and this Privacy Policy applies. When an organisation that subscribes to the Platform uploads files, project data or other content containing personal data of its own clients, employees or contractors ("Customer Data"), contentmaker.space acts as the organisation's processor, and the Data Processing Agreement applies. The security, transfer and breach-notification commitments in this Privacy Policy also apply to Customer Data.

2. Personal Data We Collect

A. Account data

When you register, we collect:

• Email address (required)
• Password (stored as a salted hash; never accessible in plain text)
• Optional phone number for account recovery and notifications

B. Profile and workspace data

To make the Platform useful in your workflow, you may provide or generate:

• Name, role, organisation name and your relationship to that organisation
• Optional profile photo and bio
• Optional professional links (Instagram, LinkedIn, YouTube, Vimeo, portfolio URL)
• For talent layer participants (e.g. freelance editors and crew members invited into a workspace): skills, categories, availability, day rates, location (city/country) and portfolio items
• For workspace administrators: organisation details, team member invitations, billing contact and VAT number

C. Content uploaded through the Platform

As part of normal use you may upload images, video, audio, project files and documents. Where these contain personal data of identifiable individuals (including faces and voices in footage), that content is treated as Customer Data and is governed primarily by the Data Processing Agreement.

D. Voice and meeting recordings

If you use voice input or the transcription features, we process the audio you record and the resulting transcripts. Meeting recordings and transcripts stored in a workspace are treated as Customer Data.

E. Communications

We retain messages exchanged through the Platform's chat and notification features, support tickets and email exchanges with our team.

F. Payment and billing data

For subscription billing and invoicing we collect billing contact details, company details and VAT number. Payment card details are processed directly by our payment processor (Stripe) and are not stored on our systems.

G. Mobile app and notification data

If you use our mobile applications or enable notifications, we process device push-notification tokens and your notification preferences in order to deliver the notifications you have enabled.

H. Automatically collected data

When you use the Platform we automatically collect:

• IP address (for security, fraud prevention and language preferences)
• Device, browser and operating system information
• Usage analytics: pages and features visited, actions taken, error events
• Error and diagnostic reports when something goes wrong, which may include your account identifier and the actions leading up to the error
• Aggregated profile view statistics (visible to the profile owner)

3. How We Use Personal Data

We use personal data to:

• Provide the Platform: enable account access, workspace operation, project management, talent management, client briefing and the other features of contentmaker.space
• Provide AI features: process the content you submit to the AI assistant, generation, transcription and search features in order to return the requested output (see Section 4)
• Facilitate collaboration: enable workspace members, invited clients and invited freelancers to work together within the workspace's intended structure
• Process payments and invoicing: handle subscriptions, additional Seat activations, renewals and refunds
• Communicate: send transactional emails (account, billing, security), respond to support requests, and — where you have opted in — send product updates
• Improve the Platform: analyse usage patterns to identify problems and improve features
• Maintain security: detect and prevent fraud, abuse, unauthorised access and Platform misuse, including automated bot-protection at signup
• Meet legal obligations: respond to lawful requests, comply with tax and accounting rules and retain records where required by law

Legal basis (GDPR Art. 6). We process personal data on the following bases, depending on the purpose:

4. AI Features

The Platform includes features powered by artificial intelligence: an in-app assistant, content generation (such as scripts and shot lists), transcription of voice input and recordings, and AI-assisted search and matching (including matching freelancer profiles to search queries).

When you use these features, the content you submit and relevant workspace context are transmitted to the AI infrastructure providers listed in Section 5 in order to produce the requested output. These providers act as our sub-processors under written data processing agreements. We do not permit them to use your content to train their generally available models, and we use their business API offerings, which are not used for model training by default.

AI features on the Platform assist human work and human decisions. We do not use them to make decisions about you that produce legal or similarly significant effects without human involvement (GDPR Art. 22). AI-assisted matching and ranking of talent profiles is a search aid; the decision to contact or engage anyone is always made by a person.

5. Sub-Processors and Service Providers

We rely on a limited number of trusted third-party service providers to operate the Platform. Each is bound by a written data processing agreement and processes personal data only as instructed by us.

Where the table below names a category rather than a company, we have identified the category of recipient as permitted by Article 13(1)(e) GDPR. A complete list naming every sub-processor individually, together with its role and location, forms Schedule 2 of our Data Processing Agreement and is available to customers and prospective customers on request. Changes to sub-processors that affect Customer Data are notified under Article 4 of that agreement.

Workspace-activated integrations. Workspace administrators can additionally connect third-party services to their workspace, such as Frame.io (Adobe Inc.) for video review and Dropbox for file exchange. Data is shared with these services only when a workspace connects them, and their own terms and privacy policies apply to their processing. Connected integrations that process Customer Data are covered by the notice mechanism in Article 4 of the Data Processing Agreement.

We may use additional providers for ancillary functions. We update the list above when material sub-processors change; for changes affecting Customer Data, the notice mechanism in Article 4 of the Data Processing Agreement applies.

6. Cookies and Similar Technologies

We use a limited set of cookies and similar technologies (including local storage):

• Strictly necessary: maintain your authenticated session, remember security preferences and enable core Platform functionality. These do not require consent.
• Functional: remember language and display preferences.
• Analytics: we use Google Analytics and Mixpanel in the Platform to understand how it is used so we can improve it. These run only with your consent.
• Aggregate measurement: on our marketing website we use Vercel Web Analytics for page-view and page-speed statistics. It sets no cookie and stores no identifier on your device, and we use it on the basis of our legitimate interest (Art. 6(1)(f)) in understanding which pages are worth improving. You can object to this processing at any time under Section 9.
• Marketing: on our marketing website we use the Meta Pixel and the Meta Conversions API to measure which advertising campaigns bring visitors to us. Where you submit a form, this includes sending a hashed (irreversibly encoded) version of your email address and phone number, together with your IP address and browser user agent, to Meta so the conversion can be matched to an ad. This runs only with your consent, and never before you give it.

When you first visit our marketing website you are asked to make a choice; no marketing cookie or tracking pixel is loaded until you do. You can change or withdraw that choice at any time via the “Cookie preferences” link in the website footer, and inside the Platform under Settings → Profile. Withdrawing consent stops any further processing but does not affect processing that already took place.

You can also manage cookies through your browser settings. Disabling strictly necessary cookies will prevent the Platform from functioning.

7. Sharing and Disclosure

We share personal data only in the following situations:

• Within your workspace: profile data, project data and communications are visible to other members of the workspace, in line with the workspace's role and permission model. Workspace administrators control invitations and access.
• Public profile elements: if the workspace has enabled an externally visible profile (for example, a talent profile), the explicitly published fields are visible to viewers of that profile.
• Shared links: if a workspace shares a project page, form or article through a public link, the content of that page is visible to anyone with the link.
• Service providers: the sub-processors and integrations listed in Section 5.
• Legal requests: when required by law, court order or lawful government request. We assess each request and limit disclosure to what is legally required.
• Safety: where necessary to protect the rights, safety or property of users, the public or contentmaker.space.
• Business transfers: in connection with a merger, acquisition, restructuring or sale of assets, with reasonable prior notice to affected users.

We do not sell personal data to third parties.

8. International Data Transfers

Our primary infrastructure (Supabase) is hosted in the European Union. Several sub-processors listed in Section 5 — including our payment processor, AI infrastructure providers, analytics and error-monitoring providers — process personal data in the United States as part of their normal operations.

Where such transfers occur, we rely on the EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where the recipient is certified, and supplementary technical measures including encryption in transit and at rest. A copy of the applicable transfer mechanisms can be requested at privacy@contentmaker.space.

9. Your GDPR Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15): a copy of your personal data
• Right to rectification (Art. 16): correction of inaccurate or incomplete data
• Right to erasure (Art. 17): deletion of your data, subject to retention obligations described in Section 10
• Right to data portability (Art. 20): your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21): to processing based on legitimate interests
• Right to restrict processing (Art. 18): in certain circumstances
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, at any time

To exercise these rights, contact us at privacy@contentmaker.space. We will respond within thirty (30) calendar days of receipt and may extend by up to two months where the request is complex, in which case we will inform you within the first month.

If a request relates to Customer Data (data uploaded by an organisation using the Platform), we will promptly forward the request to the relevant organisation, which acts as the controller of that data.

Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. As contentmaker.space is established in Belgium, our lead supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données). Users in other EU/EEA member states may also contact their local data protection authority.

10. Data Retention

We retain personal data only as long as necessary for the purposes set out in this Privacy Policy:

11. Security

We implement technical and organisational measures to protect personal data appropriate to the risk, in accordance with Article 32 GDPR. These measures are described in Schedule 3 of the Data Processing Agreement and include:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Authenticated access with role-based permissions, enforced at the database level through row-level security on every table
• Least-privilege administrative access restricted to named platform administrators
• Daily backups with documented recovery procedures
• Documented personal data breach response, including notification to affected controllers within forty-eight (48) hours where Customer Data is affected

12. Children's Privacy

The Platform is intended for use by business users. We do not knowingly collect personal data from individuals under sixteen (16) years of age. If you believe we have inadvertently collected personal data from someone under sixteen, please contact us at privacy@contentmaker.space and we will promptly delete that data.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page and updating the "Last updated" date;
• For changes that materially affect your rights or our processing, sending an email notification to the address associated with your account.

Your continued use of the Platform after a change takes effect constitutes acceptance of the updated Privacy Policy.

14. Contact

For questions about this Privacy Policy or to exercise your data protection rights:

We are not legally required to appoint a Data Protection Officer under Article 37 GDPR. Your point of contact for all privacy matters is the email address above.