Privacy Notice

Effective date: August 26, 2026

Who is responsible for your information

Speeding Studio — this website (speeding.studio) and the Speeding Studio application — is operated by Opencast Media Inc., a company based in Vancouver, British Columbia, Canada. We have designated a Privacy Officer who is accountable for our compliance with privacy law. You can reach them athello@speeding.studio or by mail at the address at the end of this notice.

Scope

This notice covers personal information processed through the website and the application. Electronic signing has its own signer-facing disclosure — see ourE-Signature Consent — which this notice supplements.

Information you provide on this website

When you join the waitlist, you provide your email address. We use it to let you know when early access opens and to send occasional product updates. Waitlist submissions are stored in HubSpot, our contact-management platform, on servers in the United States.

Information collected automatically on this website

The website also automatically processes limited technical and analytics information:

• Cloudflare Web Analytics — cookieless, aggregate page statistics only.
• Google Analytics — sets cookies and collects usage data such as pages visited, approximate location, and device information, but only if you accept cookies in our banner. You can change your choice at any time using the Cookie settings link in the footer.
• Server logs — Cloudflare, which hosts and serves this website, processes technical data needed to serve it securely, such as IP addresses.

We do not use advertising trackers or cross-site cookies.

Information processed in the application

When you use the Speeding Studio application, we process the information needed to run your productions:

The application runs on Google Cloud infrastructure, which processes standard technical data such as IP addresses in server logs. We use this information to provide the service, secure it, bill for it, support you, and meet our legal obligations. We do not sell or rent personal information.

We do not use your information to train AI models.Your information is sent to an AI model only when you choose to use an AI feature, and only to perform that task. Our AI providers process it under terms that do not allow them to train their models on it.

If you connect your own AI assistant to Speeding Studio (for example, through our MCP integration), that is a separate choice: what your assistant reads from your workspace is shared with the AI provider you selected, under your agreement with that provider rather than this notice. Your assistant's access follows your account's permissions, and you can disconnect it at any time.

Information entered about other people

Production work means account holders enter information about others — cast, crew, clients. For that information, the production company that entered it decides why it is collected and how long it is kept; we process it on their behalf to provide the service. Account holders are responsible for having the authority or consent to enter it (see our Application Terms).

Where cast and crew submit profiles to a production company through the platform, our casting media purge policy (described under Retention) limits how long the production company retains submitted media.

If you contact us about information a production company entered about you, we will refer your request to them and support them in resolving it. Information we control directly — your own account, our billing records, our analytics — we handle ourselves under this notice.

Service providers and international processing

We use a small set of service providers to run Speeding Studio: Cloudflare (website hosting and delivery), Google Cloud (application hosting and database), Inngest (background job processing), Stripe (payment processing), Postmark (transactional email), HubSpot (contact list), Google Analytics and Amplitude (analytics). Some of them store data outside Canada, where it may be subject to the laws of other jurisdictions. We may also disclose information where the law requires it, such as a court order.

Electronic signatures and audit records

Signed documents are recorded with an append-only audit trail — who signed, when, in what order, and a cryptographic fingerprint of the signed version. These records exist to prove that a signing happened, so they are retained even if the related account is later closed. The signing experience and your choices are described in our E-Signature Consent.

Product analytics in the application

We collect analytics about how the application is used — which features, how often, with what outcomes — and analyze them withAmplitude. This is designed conservatively:

• Server-side only. Amplitude's code never runs in your browser — no SDK, no cookies, no tracking scripts. Events are constructed and sent by our own servers, so only fields we deliberately include are collected.
• No directly identifying fields. We do not send names, email addresses, or anything you type into the product. Most events use pseudonymous account and workspace identifiers that we can associate with records in our own systems.
• Sensitive dimensions carry no identity. Events involving union affiliation or offered rates are recorded without any person identifier, even a pseudonymous one, and are used for aggregate analysis.
• Coarse location only. Job-call events include the posting's city, region, and country — never a precise address.
• Deletion propagates. When we delete your account information, we instruct Amplitude to delete the analytics data associated with your identifier.

Amplitude processes this data under a data processing agreement and stores it in the United States on Amazon Web Services infrastructure, so it is processed outside Canada and may be subject to the laws of other jurisdictions.

Calendar sync

If you connect your Google Calendar, we access it through Google's API with your permission, and you choose the direction of sync:

• Push — we create and update events in your Google Calendar for your production commitments, such as shoot days and call times, and keep them current as the plan changes.
• Pull — we show your existing Google Calendar events alongside production dates, so schedules can be planned around your availability.
• Both ways — the two combined.

We store the connection credentials (encrypted) and the sync records needed to keep your calendar and the plan consistent. Calendar data is never used for advertising or analytics, never sold, and never used to train AI models; it is sent to an AI model only if you choose to use an AI feature on it, and only for that task. Disconnect calendar sync in your settings at any time: we stop all access and delete the calendar data we hold. You can also revoke our access from your Google account's security settings, and when your account is deleted, synced calendar data is deleted with it.

Speeding Studio's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

We keep personal information only as long as it is needed. In practice:

• Account and production information is retained while your account is active, and deleted or de-identified after account closure once export periods end.
• Billing and tax records are kept for at least six years, as Canadian tax law requires. Our payment processor (Stripe) also retains transaction records independently, under its own privacy policy and legal obligations.
• Agreement and signature audit records are retainedindefinitely, because they exist to prove that a signing happened — parties may need them long after a production wraps or an account closes.
• Casting media — when you submit a casting profile with media (headshots, reels, self-tapes) to a production company through a job call, the submitted copies are purged on a schedule set by the production company, at most 180 days after the job call closes. Your own profile and its media remain under your control.
• Backups are deleted on a rolling schedule, so removed data may persist in backups for a limited period before disappearing.
• Waitlist contacts are kept until you unsubscribe or we retire the list.

Where we cannot state an exact period, we decide based on what the information is for, legal requirements, and whether a dispute or investigation requires holding it.

Security

Personal information is encrypted in transit and at rest. Each workspace's data is isolated through access controls enforced at the database layer, designed to prevent one customer's information from being accessible from another customer's account. Sensitive personal information is held in restricted storage with additional access controls, and access to revealed sensitive data is logged. Our own access to production data is limited to what operating the service requires.

Your rights and how to exercise them

You may ask us what personal information we hold about you, ask for corrections, and ask for deletion. To protect you, we verify identity before acting on a request. We generally respond within 30 days. Some requests may be refused where the law allows or requires it — for example, records we must keep for legal, accounting, or fraud-prevention reasons, or signature audit records — and if we refuse, we will explain why. Deletion removes data from active systems first; backup copies expire on the rolling schedule above.

You may withdraw consent for optional processing — for example, analytics cookies via the Cookie settings link, or marketing email via any message's unsubscribe link — without affecting your use of the site.

If your concern involves information a production company entered about you, we will refer it to them as described above. If you are unsatisfied with our response to any privacy concern, you may complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

Adults only

The website and application are intended for adults. You must be at least the age of majority in your jurisdiction to hold an account (see our Application Terms). We do not knowingly collect personal information directly from minors; if we learn an account is held by a minor, we will close it and delete the associated information.

Privacy incidents

If personal information is lost, exposed, or accessed without authorization, we investigate, contain and remediate the issue, notify affected individuals and regulators where the law requires it, and keep the records the law requires.

Changes to this notice

We will post updated versions here with a new effective date. For material changes — new categories of collection, new purposes, or changes affecting sensitive information — we will give notice by email or in the application before the change takes effect, and seek fresh consent where the law requires it.

Contact