Privacy Policy

This policy explains how FilmJourney processes personal data when you use this website, in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act.

1. Controller

Come Alive Film & Audio Solutions e.U., Neustiftgasse 10/20, 1070 Vienna, Austria. Email: office@comealive.vision.

2. Data we process

• Account data: name, email address, account type (viewer, filmmaker or admin). Your password is stored only in encrypted (hashed) form by our authentication provider.
• Watchlist: the films you save to your watchlist.
• Filmmaker submissions: film information, poster, private screener link and password, confirmation of distribution rights, and review notes.
• Technical data: IP address, browser type and request data, which are processed in server logs when you visit the website.
• Messages you send to us by email.

3. Purposes and legal bases

• Providing your account and the features of the platform (Art. 6(1)(b) GDPR, performance of a contract).
• Reviewing and publishing film submissions (Art. 6(1)(b) GDPR and our legitimate interest in curating the catalogue, Art. 6(1)(f)).
• Security, abuse prevention and technical operation of the website (Art. 6(1)(f) GDPR).
• Compliance with legal obligations, for example accounting and tax rules (Art. 6(1)(c) GDPR).
• Anything else only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

When paid features are introduced, payments will be handled by an external payment provider. We receive the status of the payment, not your full card details.

4. Cookies and similar technologies

We use only strictly necessary cookies, which keep you logged in and secure your session. We currently do not use analytics or advertising cookies. Trailers on film pages may be embedded from YouTube or Vimeo. When such a trailer is displayed or played, the provider may receive data such as your IP address and may set its own cookies. We use the privacy-enhanced embed options where available.

5. Service providers and recipients

We use the following providers to run the platform. They process data on our behalf under data processing agreements:

• Supabase, for the database, authentication and file storage (database region: EU (Ireland)).
• Vercel, for hosting the website.
• An email service provider for account emails such as password reset (to be named once configured).
• A payment provider, once paid features are available.
• Vimeo and YouTube, for embedded videos.

Where data is transferred outside the European Economic Area, this happens on the basis of an adequacy decision (for example the EU-US Data Privacy Framework) or standard contractual clauses.

6. Retention

We keep your account data for as long as your account exists. Submission data is kept while the film is listed or under review, and afterwards for as long as needed for the purpose or required by law. Accounting records are kept for the period required by Austrian law (generally seven years). You can ask us to delete your account at any time.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. To exercise these rights, write to office@comealive.vision. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, www.dsb.gv.at) or with the authority of your place of residence.

8. Security

Data is transmitted over encrypted connections, and access to personal data is restricted by access rules in the database. No system is completely secure, so please choose a strong, unique password.

9. Changes

We may update this policy when the platform changes, for example when paid features are introduced. The current version is always available on this page.