Privacy Policy
Last updated
This policy explains what personal data we process, why, and what rights you have over it. It covers the Filmatic website at filmatic.io and the Filmatic app on the web, iOS and Android, and on TVs (Apple TV, Android TV and Fire TV). It does not cover Filmatic’s accounts on social media platforms such as Instagram, where the platform’s own privacy policy applies to what you do there.
For any matter concerning your personal data, including the requests described in section 8, contact privacy@filmatic.io. That address is monitored separately from general support because data requests carry statutory deadlines.
1. What we collect
- Account data. Your email address, an authentication identifier, and a display name if you set one. Where you sign in with a third-party provider we receive an identifier and, depending on your choice, your email address. We never receive your password.
- Activity data. Your ratings and swipe history with timestamps, your lists and notes, and your settings including your country and the streaming services you have selected.
- Technical data. Device and application information, your IP address, and the country we derive from it.
- Location. If you ask for cinemas near you, your approximate location, used to answer that request and not stored. If you sign in on a TV, the city and country of that TV, so you can recognise it in your list of devices.
- Analytics data. We use your activity data for product analytics, to understand how the service is used and to improve it.
- Diagnostics. Error and crash reports.
- Correspondence. What you send us and our reply.
We do not collect payment details, we do not ask for or receive credentials for any streaming service, and we do not collect special category data.
2. Why we process it, and on what basis
Under Article 6 of the GDPR each purpose requires a lawful basis. They are not interchangeable, so each is set out below.
| Purpose | Legal basis |
|---|---|
| Creating and operating your account, and authenticating you | Contract, Art. 6(1)(b) |
| Generating recommendations and showing streaming availability in your country | Contract, Art. 6(1)(b) |
| Service messages about security, your account and changes to these documents | Contract, Art. 6(1)(b) |
| Optional product news and digests | Consent, Art. 6(1)(a) |
| Product analytics | Legitimate interests, Art. 6(1)(f) |
| Keeping the service secure and preventing abuse, fraud and automated extraction | Legitimate interests, Art. 6(1)(f) |
| Diagnosing faults and improving the service in aggregate | Legitimate interests, Art. 6(1)(f) |
| Responding to your enquiries | Legitimate interests, Art. 6(1)(f), or contract where the query concerns your account |
| Complying with legal obligations | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests we have carried out a balancing assessment, concluded the processing is proportionate, and keep that assessment on file. You may object at any time and we will stop unless we have overriding grounds.
3. Automated processing and profiling
Recommendations are generated automatically from a model of your taste, which is updated by your ratings and applied without human review. This is profiling within the meaning of the GDPR.
It produces no legal or similarly significant effect on you for the purposes of Article 22, because the only decision it makes is which movies and shows to suggest. You can retake the taste test or change your ratings at any time in the app.
4. Who else processes your data
We use service providers to operate the service, in the following categories: cloud hosting and database, content delivery and security, transactional email, push notifications, product analytics, error monitoring, and authentication and application distribution.
We also obtain movie and show metadata, artwork and streaming availability from third-party data providers, and cinema locations from OpenStreetMap. Those requests concern movies, shows and places, not you, and they carry no identifier. To find cinemas we send a location rounded to the surrounding area, never your exact position.
Partner links. Some links in the app are affiliate links, for example to NordVPN or Amazon, and each one is labelled as such where it appears. If you buy through one, we may earn a commission. The link tells the partner only that it came from Filmatic and where in the app it was placed. It carries nothing that identifies you, and we do not record who follows it. Once you are on the partner’s site, its own privacy policy applies.
We may disclose data to professional advisers, or to authorities where legally required. If the business is sold or reorganised, your data may transfer to the acquirer, who would be bound by this policy or would notify you of a replacement.
We do not sell personal data and we do not share it with advertisers or data brokers.
5. Transfers outside the EEA
Some providers are located outside the European Economic Area, principally in the United States. For those transfers we rely on the European Commission’s Standard Contractual Clauses.
6. How long we keep it
| Data | Retention |
|---|---|
| Account, activity, lists and notes | Until you delete them or close your account, then removed within 30 days |
| Analytics events | 14 months from collection |
| Error and crash diagnostics | 90 days |
| Server and security logs, including IP addresses | 30 days, unless retained longer for a specific security investigation |
| Correspondence | 24 months from the last message in the thread |
| Records required by law | As long as the relevant law requires |
| Aggregated, anonymised data | Indefinitely, as it is no longer personal data |
Backups are overwritten on a rolling cycle and deleted data disappears from them within 35 days.
7. Aggregated and derived data
We generate aggregated statistics and models from activity across the service as a whole. Once aggregated, that data cannot be traced back to any individual, is no longer personal data, and belongs to us. It is not deleted when you close your account. Your own ratings, lists and individual taste profile are deleted, as described in our account deletion page.
8. Your rights
You have the right to access your data, to have it corrected or erased, to receive it in a portable format, to restrict or object to processing, and to withdraw consent.
How to exercise them. Most of this you can do yourself in the app: export your data, delete your account and retake the taste test. Otherwise email privacy@filmatic.io. We respond within one month, extendable for genuinely complex requests. We do not charge. We may ask you to confirm your identity so that we do not disclose your data to someone else.
If you are unhappy with how we have handled your data, please tell us first.
9. Children
Filmatic is not intended for children. You must be at least 16 to create an account and we state this on the sign-in screen. We do not knowingly collect data from anyone below that age. If you believe a child has created an account, email privacy@filmatic.io and we will delete it and the associated data.
10. Security
We protect your data with encryption in transit and at rest, access controls that prevent one account from reading another’s data, restricted and logged administrative access, and least-privilege credentials for every service.
11. Changes to this policy
If we change this policy we will update the date at the top.
12. Contact
Data and privacy: privacy@filmatic.io · Everything else: hello@filmatic.io