Privacy Policy

1. Introduction

This Privacy Policy explains how contentmaker.space BV ("contentmaker.space", "we", "us", or "our") collects, uses and protects personal data when you use the contentmaker.space platform (the "Platform").

contentmaker.space BV is a company incorporated under Belgian law, registered with the Belgian Crossroads Bank for Enterprises under number 1019179691, with its registered office at Bampslaan 21 3.01, 3500 Hasselt, Belgium.

contentmaker.space is a SaaS operating system for creative production agencies, supporting the workflow from pitch to final delivery. The Platform is used by production agencies and the team members, clients and freelance collaborators they invite into their workspaces.

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Belgian data protection law.

Two distinct roles. When you create an account and use the Platform as a registered user, contentmaker.space is the controller of your personal data and this Privacy Policy applies. When an organisation that subscribes to the Platform uploads files, project data or other content containing personal data of its own clients, employees or contractors ("Customer Data"), contentmaker.space acts as the organisation's processor, and the Data Processing Agreement applies. The security, transfer and breach-notification commitments in this Privacy Policy also apply to Customer Data.

2. Personal Data We Collect

A. Account data

When you register, we collect:

• Email address (required)
• Password (stored as a salted hash; never accessible in plain text)
• Optional phone number for account recovery and notifications

B. Profile and workspace data

To make the Platform useful in your workflow, you may provide or generate:

• Name, role, organisation name and your relationship to that organisation
• Optional profile photo and bio
• Optional professional links (Instagram, LinkedIn, YouTube, Vimeo, portfolio URL)
• For talent layer participants (e.g. freelance editors and crew members invited into a workspace): skills, categories, availability, day rates, location (city/country) and portfolio items
• For workspace administrators: organisation details, team member invitations, billing contact and VAT number

C. Content uploaded through the Platform

As part of normal use you may upload images, video, audio, project files and documents. Where these contain personal data of identifiable individuals (including faces and voices in footage), that content is treated as Customer Data and is governed primarily by the Data Processing Agreement.

D. Communications

We retain messages exchanged through the Platform's chat and notification features, support tickets and email exchanges with our team.

E. Payment and billing data

For subscription billing and invoicing we collect billing contact details, company details and VAT number. Payment card details are processed directly by our payment processor (Stripe) and are not stored on our systems.

F. Automatically collected data

When you use the Platform we automatically collect:

• IP address (for security, fraud prevention and language preferences)
• Device, browser and operating system information
• Usage analytics: pages and features visited, actions taken, error events
• Aggregated profile view statistics (visible to the profile owner)

3. How We Use Personal Data

We use personal data to:

• Provide the Platform: enable account access, workspace operation, project management, talent management, client briefing and the other features of contentmaker.space
• Facilitate collaboration: enable workspace members, invited clients and invited freelancers to work together within the workspace's intended structure
• Process payments and invoicing: handle subscriptions, additional Seat activations, renewals and refunds
• Communicate: send transactional emails (account, billing, security), respond to support requests, and — where you have opted in — send product updates
• Improve the Platform: analyse usage patterns to identify problems and improve features
• Maintain security: detect and prevent fraud, abuse, unauthorised access and Platform misuse
• Meet legal obligations: respond to lawful requests, comply with tax and accounting rules and retain records where required by law

Legal basis (GDPR Art. 6). We process personal data on the following bases, depending on the purpose:

4. Sub-Processors and Service Providers

We rely on a limited number of trusted third-party service providers to operate the Platform. Each is bound by a written data processing agreement and processes personal data only as instructed by us.

The current sub-processor list is also reflected in Schedule 2 of our Data Processing Agreement.

We may use additional providers for ancillary functions such as transactional email delivery, error monitoring, customer support tooling and product analytics. We update the list above when material sub-processors change; for changes affecting Customer Data, the notice mechanism in Article 4 of the Data Processing Agreement applies.

5. Cookies and Similar Technologies

We use a limited set of cookies and similar technologies:

• Strictly necessary cookies: maintain your authenticated session, remember security preferences and enable core Platform functionality. These do not require consent.
• Functional cookies: remember language and display preferences. Used only with your consent where consent is required.
• Analytics cookies: help us understand how the Platform is used so we can improve it. Used only with your consent.

You can manage your cookie preferences through your browser settings or the in-Platform cookie banner. Disabling strictly necessary cookies will prevent the Platform from functioning.

6. Sharing and Disclosure

We share personal data only in the following situations:

• Within your workspace: profile data, project data and communications are visible to other members of the workspace, in line with the workspace's role and permission model. Workspace administrators control invitations and access.
• Public profile elements: if the workspace has enabled an externally visible profile (for example, a talent profile), the explicitly published fields are visible to viewers of that profile.
• Service providers: the sub-processors listed in Section 4.
• Legal requests: when required by law, court order or lawful government request. We assess each request and limit disclosure to what is legally required.
• Safety: where necessary to protect the rights, safety or property of users, the public or contentmaker.space.
• Business transfers: in connection with a merger, acquisition, restructuring or sale of assets, with reasonable prior notice to affected users.

We do not sell personal data to third parties.

7. International Data Transfers

Our primary infrastructure (Supabase) is hosted in the European Union. Some sub-processors, notably Stripe for payment processing, may transfer personal data to the United States as part of their normal operations.

Where such transfers occur, we rely on the EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where the recipient is certified, and supplementary technical measures including encryption in transit and at rest. A copy of the applicable transfer mechanisms can be requested at privacy@contentmaker.space.

8. Your GDPR Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15): a copy of your personal data
• Right to rectification (Art. 16): correction of inaccurate or incomplete data
• Right to erasure (Art. 17): deletion of your data, subject to retention obligations described in Section 9
• Right to data portability (Art. 20): your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21): to processing based on legitimate interests
• Right to restrict processing (Art. 18): in certain circumstances
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, at any time

To exercise these rights, contact us at privacy@contentmaker.space. We will respond within thirty (30) calendar days of receipt and may extend by up to two months where the request is complex, in which case we will inform you within the first month.

If a request relates to Customer Data (data uploaded by an organisation using the Platform), we will promptly forward the request to the relevant organisation, which acts as the controller of that data.

Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. As contentmaker.space is established in Belgium, our lead supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données). Users in other EU/EEA member states may also contact their local data protection authority.

9. Data Retention

We retain personal data only as long as necessary for the purposes set out in this Privacy Policy:

10. Security

We implement technical and organisational measures to protect personal data appropriate to the risk, in accordance with Article 32 GDPR. These measures are described in Schedule 3 of the Data Processing Agreement and include:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Authenticated access with role-based permissions
• Two-factor authentication for staff and freelance accounts
• Daily backups with documented recovery procedures
• Documented personal data breach response, including notification to affected controllers within forty-eight (48) hours where Customer Data is affected

11. Children's Privacy

The Platform is intended for use by business users. We do not knowingly collect personal data from individuals under sixteen (16) years of age. If you believe we have inadvertently collected personal data from someone under sixteen, please contact us at privacy@contentmaker.space and we will promptly delete that data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page and updating the "Last updated" date;
• For changes that materially affect your rights or our processing, sending an email notification to the address associated with your account.

Your continued use of the Platform after a change takes effect constitutes acceptance of the updated Privacy Policy.

13. Contact

For questions about this Privacy Policy or to exercise your data protection rights:

We are not legally required to appoint a Data Protection Officer under Article 37 GDPR. Your point of contact for all privacy matters is the email address above.