Privacy Policy

1. Who we are

This site (theprelist.io) and the connected app (app.theprelist.io) are operated by THE PRELIST LTD, a company registered in England and Wales (company number 16946050) with registered address at 124 City Road, London, United Kingdom, EC1V 2NX.

We are the data controller for personal data processed in connection with our services. Our ICO registration is in progress; this notice will be updated with the registration number once it has been issued.

For any privacy enquiry, contact us at enquiries@teamprelist.com.

2. Data we collect

We collect the following categories of data:

Account data

Name, email address, hashed password, and profile preferences. Provided by you when you create an account.

Payment data

Billing name, billing address, subscription tier, and payment-card details processed by Stripe. We do not store full card numbers on our systems; Stripe holds the card data and shares only a token and metadata with us.

Content data

Screenplays you upload, drafts, notes, comments, and analysis outputs generated by our system on your behalf.

Usage data

Pages visited, features used, approximate location (from IP address), device and browser metadata. Collected via cookies and analytics tools.

Communications

Email and in-app chat messages you send to us.

3. Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Contract: account creation, subscription, billing, and core service delivery.
• Legitimate interests: service security, fraud prevention, product improvement, customer support, and direct marketing to existing customers (you can opt out at any time).
• Consent: non-essential cookies, analytics tracking where required, and marketing emails to non-customers.
• Legal obligation: tax records, accounting, and responses to lawful requests from authorities.

4. How we use your data

• To provide the analysis, feedback, and workspace features you signed up for.
• To bill you and process refunds, where applicable.
• To respond to your enquiries and provide support.
• To send service notifications (account changes, billing alerts, important policy updates).
• To improve the product through aggregate, anonymised usage analysis.
• To detect and prevent fraud, abuse, or violations of our Terms.
• To comply with legal obligations.

5. Sharing your data

We do not sell your personal data. We share data only with sub-processors who help us deliver the service:

• Vercel — hosting and content delivery (US/EU).
• Supabase — database, authentication, file storage (EU region).
• Stripe — payment processing (EU/US, PCI-DSS compliant).
• OpenAI — AI analysis processing (US). We do not enable training on customer data.
• PostHog — product analytics (EU region).
• Email service provider — transactional and account emails.

Each sub-processor is bound by a data processing agreement. We may also disclose data where required by law, court order, or to protect our rights or those of others.

6. International transfers

Some sub-processors are located in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the EU-US Data Privacy Framework where the recipient is certified.

7. How long we keep your data

Account and content data is retained for as long as you have an active account. After account deletion, we retain your data for 30 days in a soft-delete state to allow recovery, then permanently delete it from our active systems. Backups containing your data are rotated and overwritten within 90 days.

Billing and tax records are kept for at least 6 years to comply with UK accounting law. Logs and security records are retained for up to 12 months.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted (subject to limited exceptions).
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent where we rely on it.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email enquiries@teamprelist.com. We will respond within one calendar month.

9. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary: session, authentication, and security cookies.
• Analytics: PostHog (EU region) for understanding how the product is used. Uses first-party cookies and respects Do Not Track signals.

You can control cookies through your browser settings. Blocking strictly necessary cookies will break parts of the service.

10. AI and your scripts

Your scripts are not used to train AI models. Screenplays you upload are processed by our analysis system and by OpenAI's API for AI persona feedback. We have configured our OpenAI integration to disable training on customer data.

Each script remains your intellectual property. We retain only the licence necessary to provide the service to you, as set out in our Terms of Service.

11. Security

We use industry-standard encryption in transit (TLS) and at rest. Passwords are hashed using a modern algorithm. Access to production systems is limited to authorised personnel and is audited.

No system is perfectly secure. If we become aware of a personal data breach affecting your rights and freedoms, we will notify you and the ICO as required by law.

12. Children

The PreList is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact us

For questions about this policy, your rights, or our data handling, email enquiries@teamprelist.com or write to: