Privacy Policy

1. Who we are

ProfiScenario is an online screenplay editor with real-time collaboration. For any privacy-related question: [email protected].

For the purposes of this Policy, we ("we", "us", "ProfiScenario") are the controller of your personal data under Ukrainian data protection law and, for users located in the EEA, the GDPR (Regulation 2016/679).

2. What data we process

We collect the minimum we need to run the service and keep it secure:

• Account data: email, name (optional), a hash of your password (we never store passwords in plain text), registration time, last sign-in time.
• Content you create: screenplays, versions, comments, project settings. This is your text — we process it solely to give you and the collaborators you invite access to the service.
• Technical data: IP address, browser/device type, request logs — used for diagnostics and security. Retained for a limited time.
• Payment data: we never see or store card numbers — WayForPay, a Ukrainian PCI DSS-certified payment provider, handles them. All we keep is a WayForPay payment/subscription ID, subscription status, next charge date and amount.
• Cookies / localStorage: a session JWT for sign-in, your chosen interface language, and UI preferences (theme, panel widths, etc.). We do not run advertising or third-party marketing trackers.

3. How we use the data

• To provide the service — create, store, open and edit your screenplays, run real-time collaboration.
• Billing — process subscriptions, trials, cancellations, refunds.
• Security and abuse prevention — detect suspicious sign-ins, anti-fraud, protect accounts.
• Support — respond to your messages and resolve incidents.
• Notifications — transactional emails (email verification, password reset, subscription status). Marketing emails only with your explicit opt-in, with one-click unsubscribe.
• Legal compliance — when required by applicable law.

4. Legal basis (GDPR Art. 6)

• Performance of a contract — the Terms of Use you accept on sign-up.
• Legitimate interest — service security, abuse prevention, basic diagnostics.
• Consent — where we explicitly obtain it (e.g. marketing emails).
• Legal obligation — responses to lawful requests from authorities.

5. Who we share data with

We do not sell your data. We share it only with a limited set of subprocessors that help us run the service, and only to the extent each function requires:

• Railway — application and database hosting.
• Cloudflare — CDN, attack protection, and aggregated, cookie-free web analytics.
• WayForPay — payment and subscription processing (a Ukrainian payment provider).
• An email delivery provider — transactional emails (verification, password reset, subscription notifications).
• Your project collaborators — only those you have explicitly invited, and only within the role you granted them (owner, editor, commenter, or viewer).
• Competent authorities — in response to lawful written requests, where required by law.

6. International transfers

Payments are processed in Ukraine: WayForPay is located in Ukraine, so your payment data is not transferred abroad. Application and database hosting (Railway) may physically reside in the EU, the UK, or the US, and Cloudflare processes requests on its network nodes worldwide; for transfers to the US we rely on Standard Contractual Clauses (SCCs) issued by the European Commission, or on applicable certification frameworks (e.g. the EU-US Data Privacy Framework where available).

7. How long we keep data

• Account data and content — while your account is active. After deletion, we keep it for 30 more days for recovery, then delete or anonymize it.
• Billing records — as required by applicable tax law (typically at least 3 years).
• Technical logs — up to 90 days.
• Backups — up to 30 days on a standard rotation.

8. How we protect data

We apply industry-standard measures: encrypted traffic (HTTPS/TLS), hashed passwords, project isolation through role-based access control (owner/editor/commenter/viewer), regular backups, and restricted production access for our team.

No internet service can guarantee absolute security, and we want to be honest about that — we keep investing in it.

9. Your rights

At any time you have the right to:

• Access your data and receive a copy in a structured format.
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Port your data to another service.
• Withdraw a previously given consent — this does not affect processing that already happened.
• Lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with a data protection authority in your EEA country.

To exercise any of these rights, write to [email protected]. We respond within 30 days. Some actions (e.g. exporting a screenplay to PDF/Fountain/.docx or deleting a project) you can do yourself in the app.

10. Cookies

We only use functional cookies / localStorage: session token, language preference, UI settings. We do not run advertising or third-party analytics cookies (Google Ads, Meta Pixel, etc.), so a separate consent banner is not needed. To count visits we use Cloudflare Web Analytics, which sets no cookies, stores nothing in your browser and builds no user profiles.

11. Minors

The service is not intended for users under 16. If you discover a younger user has registered, please contact us and we will remove the account.

12. Changes to this Policy

We may update this Policy. We will notify you of material changes by email and/or an in-app banner at least 14 days before they take effect. The date at the top always reflects the current version.

13. Contact

Any privacy questions, rights requests, or complaints — [email protected].