Privacy Policy

Your information is yours. SlateCore App is the tool that organizes it so your team can work. We do not read your scripts, we do not use your content to train AI, we do not sell your data and we do not share it with advertisers. Any processing the Service does exists solely to display your own information back to you and your team.

The "SlateCore App" service (hereafter "the Service", "we") is operated under that commercial name, with notification address in Morelos, Mexico.

Privacy contact: privacy@slatecore.app

The Service operates with two independent levels:

• Production company (workspace or tenant): the organization that subscribes to the Service. It has its own isolated data space. The person who creates the workspace accepts these terms on behalf of the organization.
• User: each team member invited by the production company. Invited users personally accept the terms upon their first sign-in.

Each production company controls what data it uploads and who can see it. SlateCore acts as the storage and limited-processing tool that makes that data useful for the production company's team — not as an independent controller of the content.

So your team can do its work, the Service stores the information you or your collaborators voluntarily upload:

3.1 Personal account data

• Name, email, password (hashed) or Google OAuth identifier.
• Profile picture, role, preferred language and time zone (optional).

3.2 Production company data

• Company name, workspace slug, website, logo and branding.
• Tax data (RFC, legal name, fiscal address) when required to issue invoices (CFDI in Mexico).

3.3 Content you upload to your workspace

All operational information you or your team upload or generate in the Service: projects, scripts and their versions, documents, breakdowns, budgets, calendars, events, notes, comparables, team and cast data (directory), commercial information (CRM and leads when you use this feature), financial information (expenses, financing, exploitation income when you use this feature), and any other file you choose to upload.

All this information is your or your production company's exclusive property. The Service stores it isolated by workspace and only displays it to the users your production company authorizes.

3.4 Payment data

Payments are processed directly by Stripe Inc., a PCI-DSS certified payment processor. SlateCore never receives or stores card numbers; it only retains the identifiers Stripe returns (customer ID, subscription ID) and invoice history for your records.

3.5 Minimum operational metadata

For the Service to function (authentication, fraud prevention, technical support when you request it), technical data is retained: sign-in dates, device used and activity logs within the workspace. This information exists so you and your production company can audit who did what within the workspace itself, not for SlateCore to profile you.

Infrastructure providers (servers, CDN, anti-fraud) log technical metadata such as IP addresses for their own operational security requirements. SlateCore does not consult or use that information for commercial, marketing or analytics purposes.

By design:

• We do not read your content (scripts, documents, financial or commercial data). The SlateCore team does not browse your files. There is no internal dashboard to "see what projects each production company has".
• We do not train AI models on your content. When you request an AI analysis (see §6), the material is sent to the AI provider under a processing agreement that prohibits training on it.
• We do not sell or share personal data with advertisers, brokers or third parties for commercial purposes.
• We do not perform user profiling or automated decisions affecting your rights.
• We do not display third-party advertising within the Service.
• We do not use third-party advertising tracking cookies (see §16).

The data described in §3 is used exclusively to:

• Create, authenticate and maintain your account and your production company's workspace.
• Store and display the information your team uploads.
• Enable collaboration between authorized users in your workspace.
• Process payments and issue invoices/CFDIs.
• Send operational notifications related to your work (assignments, reminders, booking confirmations, alerts).
• Provide technical support when requested.
• Comply with legal obligations (tax retention, requirements from competent authorities).

Some Service features offer analysis and content generation through AI models (currently Anthropic Claude). These features run only when you or your team explicitly request them.

AI provider contractual commitments applicable to use through SlateCore:

• Anthropic does NOT use your content to train its models. This is guaranteed by their commercial policy in force for API customers (Anthropic Commercial Terms).
• Submitted content is processed transiently to generate the response and is deleted in accordance with the provider's retention policy.
• The provider does not share your content with other Anthropic customers.

AI-generated text is an algorithmic suggestion. You decide whether to incorporate it into your work. SlateCore does not guarantee accuracy or suitability of automated analysis.

To operate, the Service relies on specialized providers. Each one processes data only for the indicated function and under their own privacy policies:

For Mexican customers: most providers operate from the United States, which constitutes an international data transfer. Under LFPDPPP, this transfer is deemed consented by the data subject upon acceptance of this privacy notice and the Terms of Service for the rendering of the requested Service. SlateCore App does not transfer data to parties other than those listed above without your additional consent.

For European Union customers: international transfers are covered by the European Commission's Standard Contractual Clauses (SCCs), as applicable per provider.

Standalone list with details (function, country, link to each provider's policy) at /subprocessors. We will notify any addition or substantial change of subprocessor with at least 15 days' notice to active accounts.

The Service allows two production companies to collaborate on the same project ("Co-producers" feature). When your production company accepts collaboration with another:

• The collaborating production company's users may access the shared project according to the role and modules your production company authorizes (read, limited edit or full edit).
• Your professional contact information associated with the shared project (name, email, role) may be visible to the other company's authorized users.
• Collaboration can be revoked at any time from Settings → Co-producers. When revoked, the other company's users lose access immediately.

Each production company remains responsible for the content it uploads. SlateCore does not mediate disputes over content shared between collaborating production companies.

Your production company can enable features that allow people without a SlateCore account to interact with material:

• Data rooms: your production company generates links and shares them with investors, distributors or other parties. Visits to your data room are visible only to your own production company (not to SlateCore for commercial purposes).
• Public booking (demo agenda): visitors can schedule calls with your production company. Their contact details are stored in your workspace.
• Submissions (script intake): external writers can submit material to your production company. Their data is stored in your workspace for your team to evaluate.
• AI chat for data room invitees: optional. If you enable it, invitees can ask the AI about visible material. The commitments in §6 apply.

Your production company is responsible for informing these external persons of the processing purpose and obtaining any consent required by the legislation applicable to their jurisdiction (see §13).

The Service lets you (optionally) connect your personal Google Calendar account or subscribe to external calendars via iCal (iCloud, Outlook, others) to have a unified view of your agenda.

• Personal events the Service reads from your calendars are fetched at the moment your view is rendered — they are not stored in the Service's database. They only persist temporarily in server process memory during the request response (seconds) and are not visible to anyone else in your workspace. The only data persisted are the OAuth tokens for your connection (in `user_gcal_connections`) and the identifiers of iCal subscriptions (in `user_ical_subscriptions`) — required to read calendars again on future requests.
• You can disconnect the calendar or cancel the subscription at any time from your profile — Service access to that information ceases immediately.

Your production company can generate API keys and register webhooks to integrate the Service with its website or other tools. When you do:

• API requests can only read data from your own production company (plus projects shared via co-producers).
• Webhooks are sent to URLs you configure. The security of those endpoints is your responsibility.

Retention periods depend on the type of information:

• Account and workspace content: while your account is active, plus 30 days after cancellation (grace period for export).
• Workspace activity logs: 90 days.
• Invoices and CFDIs: 5 years, in accordance with Mexican tax obligations.
• Encrypted backups: daily backups with 30-day retention, plus weekly backups retained for up to 12 weeks. After deleting your account, data persists in backups until the cycle completes.
• Marketing/CRM data (if your production company uses this feature): while your production company retains it or until you exercise your cancellation right.
• Fund applications (EFICINE module): when you delete an application it is removed from your view immediately; we keep an internal copy —including the documents you uploaded and their previous versions— in anonymized or aggregated form to improve this module. You may request its permanent deletion by exercising your cancellation right (section 13).

As a personal data subject, you may at any time exercise:

• Access: learn what personal data of yours the Service stores.
• Rectification: correct inaccurate or incomplete information.
• Cancellation / deletion: request the deletion of your personal data (subject to legal retention obligations).
• Objection: object to processing for specific purposes.
• Portability: receive your data in a structured format (JSON/CSV).
• Limitation of processing: request temporary restriction.

How to exercise them: write to privacy@slatecore.app from the email registered to your account. Clearly indicate which right you are exercising and what information is involved. We respond within 20 business days (Mexico — LFPDPPP) or 30 calendar days (European Union — GDPR).

If the information you request is handled by your production company (not SlateCore directly), we will direct you to exercise the right with the corresponding party.

External persons relative to a production company (script submitters, data room invitees, visitors who scheduled a call): the primary controller of your data is the production company that received your information, not SlateCore App. To exercise data rights over information contained in a production company's workspace, contact that production company directly. SlateCore App acts only as the tool provider. If you have no way to reach the production company or it does not respond, write to us and we will make a reasonable effort to route your request.

If you are not satisfied with the response, you may turn to:

• Mexico: INAI — home.inai.org.mx
• European Union: the national data protection authority of your country of residence.
• California (USA): the Service is not specifically directed at California residents at this time. If you are a California resident and believe your CCPA rights apply, write to privacy@slatecore.app and we will address the request in good faith within the applicable timeframe.
• Other jurisdictions (Brazil LGPD, Colombia Habeas Data, etc.): we respect equivalent rights recognized by your local legislation.

The Data Processing Agreement is publicly available at /dpa and automatically applies when a customer required by their jurisdiction to have a written agreement (typically EU customers under GDPR) uses the Service. If your organization requires a signed DPA on letterhead, write to legal@slatecore.app.

We apply reasonable technical and organizational measures to protect information:

• Encryption in transit (HTTPS/TLS) and at rest (AES-256) at the infrastructure level.
• Optional multi-factor authentication (MFA) for your account.
• Workspace isolation through Row Level Security policies.
• Daily encrypted backups.
• Audit logs within each workspace.

No security measure is absolute. If you discover a vulnerability or incident, write to security@slatecore.app.

For more detailed technical information on our security architecture, see our Security page.

The Service uses only essential cookies for authentication, session maintenance and language preferences. No advertising, third-party tracking or fingerprinting cookies are used.

To measure aggregate site traffic (page views, response times) the Service uses Vercel Analytics, a cookie-less tool by design that does not store cookies in your browser and does not attempt to identify you individually. By its nature it does not require a consent banner under GDPR or the EU ePrivacy Directive.

If any analytics or advertising technology requiring consent is incorporated in the future, advance notice will be given and the corresponding acceptance mechanism will be enabled.

The Service is directed at audiovisual industry professionals. It is not directly offered to minors under 18. The exception is the Education plan: when an academic institution enrolls students, the institution's manager confirms that students are of legal age or that the institution holds the parental consents required by their jurisdiction.

This policy may be updated. Material changes are notified by email at least 15 days in advance to active accounts. The "Last updated" date above always reflects the version in force. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

• Privacy and ARCO rights: privacy@slatecore.app
• Security: security@slatecore.app
• Legal matters: legal@slatecore.app