Privacy policy

This privacy policy explains how we process personal data when you visit untitled.movie, create an account and use our web application and the Studio app (together the “service”). We process personal data only to the extent necessary to provide a working service, in accordance with the EU General Data Protection Regulation (GDPR) and German data protection law.

1. Controller

MEYBORG UG (haftungsbeschränkt), Bleickenallee 4, 22763 Hamburg, Germany
Managing director: Simon Meyborg
Email: moin@meyborg.co

We are not required to appoint a data protection officer. For all data protection questions, please write to the email address above.

2. Overview

• We do not use analytics, tracking, advertising or social media plugins, and we do not set cookies that require consent.
• We do not load fonts, scripts or other resources from third-party servers.
• All our servers, file storage, backups and email are operated by service providers in Germany. We do not transfer your data to countries outside the EU/EEA.
• We never sell your data and never use your projects to train AI models.

3. Hosting and server log files

The service runs on servers and object storage of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Falkenstein (Germany). Hetzner processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Whenever you access the service, our servers automatically record technical data: IP address, date and time, the requested address, HTTP status, transferred data volume and your browser’s user agent. We use this data only to deliver the service, to keep it secure and to analyse errors. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working service). Log files are kept in rotating files of limited size and are overwritten automatically; we do not combine them with other data.

4. Your account

When you register, we process your name, email address and password (stored only as a salted hash, never in plain text), your time zone, the date of your registration, your confirmation of the terms of service and whether you have verified your email address. We need this data to provide your account and the contract with you (Art. 6(1)(b) GDPR). We keep it for as long as your account exists.

To verify your email address, reset your password or inform you about invitations, we send you transactional emails. We do not send newsletters or advertising.

5. Cookies and sign-in sessions

We use a single, technically necessary cookie to keep you signed in. It contains a signed session identifier and is protected against access by scripts. For each session we store the IP address and user agent of the device you signed in from, so that unusual sign-ins can be investigated. Sessions end when you sign out and are deleted at the latest after 90 days. Storing and reading this cookie is strictly necessary to provide the service you requested (§ 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act, TDDDG); the processing of the session data is based on Art. 6(1)(b) and (f) GDPR. We do not use any other cookies, so we do not need a cookie banner.

6. Projects, storyboards and other content

We store the content you create or upload — for example projects, storyboards, shots, drawings, images and texts — together with their version history and an activity log showing which member made which change and when. We process this content only to provide the service: storing it, generating previews and exports, and showing it to the members of the respective project according to their roles. Legal basis: Art. 6(1)(b) GDPR.

Content can contain personal data of other people (for example names in a script). If you use the service for an organisation and process personal data of third parties, we act as your processor; please contact us for a data processing agreement pursuant to Art. 28 GDPR.

7. Invitations and collaboration

If a project manager invites someone, we process the invitee’s email address and the role they are invited to in order to send the invitation on the inviter’s behalf. Legal basis: Art. 6(1)(f) GDPR (the legitimate interest of the inviter and of us in enabling collaboration). Invitations that are not accepted expire after 14 days and are deleted 30 days later. Members of a project can see each other’s names and email addresses.

8. Email delivery

We send emails through the mail servers of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which processes the email addresses and contents on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

9. Studio app

The Studio app connects to our servers to load and save your storyboards. You sign in through your device’s browser; the app then stores access tokens securely on your device (in the keychain or keystore). The app does not contain analytics or tracking. The data processed is the data described in sections 3 to 6.

10. Connections you set up yourself

If you connect a third-party service to your account (for example an AI assistant through an integration we offer), data you access or create through that service is transferred to its provider. This happens on your instruction and under your own agreement with that provider, whose privacy policy applies to its processing.

11. Backups

To protect your data against loss, we create a backup of our database every day and store it in our object storage at Hetzner in Germany. Backups are deleted automatically after 30 days.

12. Retention and deletion

We delete personal data as soon as it is no longer needed for the purposes described above, unless statutory retention obligations apply. When you delete your account, we remove your personal data from our live systems; it disappears from backups when they expire after 30 days. Content you created in projects of other workspaces remains available to those projects.

13. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR). To exercise your rights, write to moin@meyborg.co.

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 7. OG, 20459 Hamburg, Germany.

14. Security

All connections are encrypted with TLS. Passwords are stored as salted hashes, access tokens and secrets are encrypted, and access to production systems is restricted to a minimum.

15. Children

The service is not directed at children under 16, and we do not knowingly process their data.

16. No automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

17. Changes

We update this privacy policy when our service or the law changes. The current version is always available at untitled.movie/privacy.

This English version is provided for convenience. In case of discrepancies, the German version (Datenschutzerklärung) prevails.