Privacy Policy

1. Who we are

This site (theprelist.io) and the connected app (app.theprelist.io) are operated by THE PRELIST LTD, a company registered in England and Wales (company number 16946050) with registered address at 124 City Road, London, United Kingdom, EC1V 2NX.

We are the data controller for personal data processed in connection with our services. We are registered with the Information Commissioner's Office (ICO) under registration reference ZC139146.

For any privacy enquiry, contact us at enquiries@teamprelist.com.

2. Data we collect

We collect the following categories of data:

Account data

Name, email address, hashed password, and profile preferences. Provided by you when you create an account.

Payment data

Billing name, billing address, subscription tier, and payment-card details processed by Stripe. We do not store full card numbers on our systems; Stripe holds the card data and shares only a token and metadata with us. We keep an opaque card identifier to prevent repeated free trials across accounts. It cannot be used to charge your card or recover its number.

Content data

Screenplays you upload, drafts, notes, comments, and analysis outputs generated by our system on your behalf.

Usage data

Pages visited, features used, approximate location (from IP address), device and browser metadata. Collected via cookies and analytics tools.

Communications

Email and in-app chat messages you send to us.

3. Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Contract: account creation, subscription, billing, and core service delivery.
• Legitimate interests: service security, fraud prevention, product improvement, customer support, and direct marketing to existing customers (you can opt out at any time).
• Consent: non-essential cookies, analytics tracking where required, and marketing emails to non-customers.
• Legal obligation: tax records, accounting, and responses to lawful requests from authorities.

4. How we use your data

• To provide the analysis, feedback, and workspace features you signed up for.
• To bill you and process refunds, where applicable.
• To respond to your enquiries and provide support.
• To send service notifications (account changes, billing alerts, important policy updates).
• To improve the product through aggregate, anonymised usage analysis.
• To detect and prevent fraud, abuse, or violations of our Terms.
• To comply with legal obligations.

5. Sharing your data

We do not sell your personal data. We share data only with sub-processors who help us deliver the service:

• Vercel — hosting and content delivery (US/EU).
• Supabase — database, authentication, file storage (EU region).
• Stripe — payment processing (EU/US, PCI-DSS compliant).
• OpenAI — AI analysis processing (US). We do not enable training on customer data.
• PostHog — product analytics (EU region).
• Email service provider — transactional and account emails.

Each sub-processor is bound by a data processing agreement. We may also disclose data where required by law, court order, or to protect our rights or those of others.

6. International transfers

Some sub-processors are located in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the EU-US Data Privacy Framework where the recipient is certified.

7. How long we keep your data

Account and content data is retained for as long as you have an active account. After account deletion, we retain your data for 30 days in a soft-delete state to allow recovery, then permanently delete it from our active systems. Backups containing your data are rotated and overwritten within 90 days.

Billing and tax records are kept for at least 6 years to comply with UK accounting law. Logs and security records are retained for up to 12 months. We retain the opaque record that a card has used a free trial while we offer the one-trial-per-card programme, including after account deletion, to prevent repeated trials. Your deleted account ID is removed from this record.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted (subject to limited exceptions).
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent where we rely on it.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email enquiries@teamprelist.com. We will respond within one calendar month.

9. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary: session, authentication, and security cookies.
• Analytics: PostHog (EU region) for understanding how the product is used. Uses first-party cookies and respects Do Not Track signals. Inside the app, you can decline analytics via the cookie consent banner and we will not load it.
• Where you came from: on your first visit we store one first-party cookie recording which site referred you and any campaign tag on the link, so we can tell which of our own efforts bring writers to The PreList. It holds no personal details, it is not shared with anyone, and it expires after 90 days. If you go on to create an account, that one record is attached to it and the cookie is deleted.
• Session replay: inside the app only, we may record anonymised replays of how the interface is used to fix usability problems. Everything you type is masked, and the contents of your scripts, analyses, and AI reviews are never recorded.
• Error tracking: when something breaks, we collect the technical error details (error message, stack trace, browser information) so we can fix it. Error reports never include your script content.

When we measure AI feature usage and cost, we record technical metadata only (model name, token counts, response time), never the content of your scripts or the AI's responses.

You can control cookies through your browser settings. Blocking strictly necessary cookies will break parts of the service.

10. AI and your scripts

Your scripts are not used to train AI models. Screenplays you upload are processed by our analysis system and by OpenAI's API for AI persona feedback. We have configured our OpenAI integration to disable training on customer data.

Each script remains your intellectual property. We retain only the licence necessary to provide the service to you, as set out in our Terms of Service.

11. Google Drive and Google Docs

If you choose to connect Google Drive, this section explains exactly what we can reach and what we do with it. Connecting is entirely optional, and nothing in this section applies unless you do.

We request a single Google permission, and it is the narrowest one Google offers. The drive.file scope grants per-file access: we can only open files you have explicitly picked through Google's own file picker, plus files The PreList itself creates in your Drive. We cannot browse your Drive, list your folders, search your files, or open anything you have not handed to us. We do not request, and will not request, the broader drive, drive.readonly or drive.metadata permissions.

What we access. For a file you pick, we read its contents and basic metadata (name, type, and the time it was last modified) so we can import your screenplay and, if you ask us to keep it linked, notice when you have written a new draft. Where you ask us to send work back to Drive, we create documents in a folder we make for that purpose.

What we store. The screenplay text and file you import are stored as an ordinary script in your Script Bank, exactly as if you had uploaded it. We also store your Google account email address, so we can show you which account is connected, and an encrypted access credential so the connection keeps working. That credential is encrypted at rest and is never exposed to your browser.

What we never do. We do not use Google Workspace data to train, and do not permit any third party to train, any artificial intelligence or machine learning model. We do not sell, rent or transfer Google Workspace data, and we do not use it for advertising. Google Workspace data is not read by humans except with your explicit consent for support, where required by law, or where necessary to investigate abuse or a security incident.

Sub-processors. Screenplay content imported from Drive is processed the same way as any other script, which means it may be sent to our AI analysis providers to generate the feedback you requested. This is covered by section 10 above, including that your scripts are not used to train AI models.

Disconnecting. You can disconnect Google Drive at any time from your profile. Doing so revokes our access with Google and deletes the stored credential. Scripts you already imported stay in your Script Bank, because they are yours; you can delete them separately at any time. Deleting your PreList account also revokes the Google connection.

The PreList's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Security

We use industry-standard encryption in transit (TLS) and at rest. Passwords are hashed using a modern algorithm. Access to production systems is limited to authorised personnel and is audited.

No system is perfectly secure. If we become aware of a personal data breach affecting your rights and freedoms, we will notify you and the ICO as required by law.

13. Children

The PreList is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

15. Contact us

For questions about this policy, your rights, or our data handling, email enquiries@teamprelist.com or write to: