Privacy Policy

The data controller (or equivalent business responsible for your information) is:

FSTiVL LLC

Email: [email protected]

For privacy requests, use the same email with the subject line "Privacy Request."

2.1 Information You Provide

• Account data: name, username, email, password or auth credentials (via our auth provider), profile bio, banner/avatar, account type (Watcher/Maker), and similar profile fields
• Content data: films, previews, posters, metadata (title, description, cast/crew, tags, length, category, language, content rating, festival location), feed posts, replies, reviews, ratings, rankings, favorites, watchlists, and messages you send to us (bug reports, maker requests, support)
• Payment-related data: we do not store full card numbers. Stripe processes payments; we receive identifiers such as customer ID, subscription status, purchase amounts, credit balances, and transaction metadata
• Festival attestations: eligibility statements (e.g., student status), submission preferences, and ranking choices
• Marketing / waitlist: email and related signup information if you join a waitlist or opt into communications

2.2 Information Collected Automatically

• Device and log data: IP address, browser type, OS, device identifiers, referring URLs, pages viewed, timestamps, and approximate location derived from IP
• Streaming and engagement data: titles watched, playback position / resume progress, watch time, views, searches, clicks, follows, votes, and similar interaction events
• Cookies and similar technologies: session and authentication cookies, preference storage (e.g., mute state in localStorage), referral cookies (e.g., fstivl_ref), cache/invalidation cookies, and analytics identifiers
• Advertising data: when ads are enabled, ad request/response events, and identifiers used by ad partners (e.g., Google IMA/VAST) to serve and measure ads

2.3 Information from Third Parties

• Clerk: authentication events, profile basics, avatar URLs, and account lifecycle webhooks
• Stripe: payment success/failure, subscription lifecycle, and customer identifiers
• Referrers / partners: referral codes or campaign parameters when you arrive via a shared link

We use personal information to:

• Provide, operate, secure, and improve the Service (streaming, accounts, social, festivals)
• Process uploads, transcode media, deliver HLS/CDN playback, and store progress
• Process payments, manage subscriptions and credits, and prevent fraud
• Run festivals: eligibility checks, schedules, rankings, curation, and related communications
• Personalize recommendations, search, and discovery
• Show advertising and measure campaign performance when ads are enabled
• Send transactional emails (account, security, receipts) and, with consent or as allowed by law, marketing
• Moderate content, enforce Terms and Community Guidelines, and handle DMCA/rights notices
• Analyze usage (including Vercel Analytics / Speed Insights) and debug performance
• Comply with law, respond to legal process, and protect rights, safety, and property
• Support business transfers (merger, acquisition, financing, or sale of assets)

Legal bases (EEA/UK where applicable): performance of a contract; legitimate interests (security, improvement, marketing to existing users where allowed, fraud prevention); consent (certain cookies, marketing, non-essential ads); and legal obligation.

4.1 Public and Community Visibility

Username, profile information you choose to display, films you publish, reviews, feed posts, replies, votes (where shown), follower counts, and festival-related public rankings may be visible to other users or the public. Do not post sensitive personal data you do not want shared.

4.2 Service Providers (Processors / Subprocessors)

We share data with vendors who help us run the Service, including:

• Clerk — authentication and user management
• Stripe — payments and billing
• Amazon Web Services (AWS) — media and file storage
• Bunny.net or similar CDN — video/image delivery
• Database hosting providers — application data storage
• Resend or similar — transactional and support email
• Vercel — hosting, Analytics, and Speed Insights
• Google (IMA/DoubleClick or similar) — video advertising when enabled
• Svix or similar — webhook verification for auth events

These providers may only use personal information as needed to perform services for us, subject to contractual and legal obligations.

4.3 Legal and Safety

We may disclose information if we believe in good faith it is necessary to comply with law or legal process; protect users, the public, or FSTiVL; investigate fraud or security issues; or enforce our Terms.

4.4 Business Transfers

Information may transfer as part of a merger, acquisition, financing, reorganization, or sale of assets. We will take reasonable steps to notify you of a change in control where required.

4.5 With Your Direction

We share information when you ask us to (e.g., public publishing, integrations you enable).

We and our partners use:

• Essential cookies: login/session (Clerk), security, load balancing, and core preferences
• Functional storage: localStorage for player mute state and similar UX preferences
• Referral cookies: e.g., fstivl_ref (approximately 30 days) to attribute referrals
• Analytics: Vercel Analytics / Speed Insights and similar tools to understand traffic and performance
• Advertising technologies: when ads are enabled, third-party ad tags may set or read cookies/identifiers and collect device and viewing context to serve and measure ads

You can control cookies through browser settings. Blocking essential cookies may break login or playback. Where required by law, we will request consent for non-essential cookies/ads. Browser "Do Not Track" signals may not be universally honored; use the controls described in Section 7.

We retain personal information for as long as your account is active or as needed to provide the Service, then for a commercially reasonable period for backups, dispute resolution, fraud prevention, accounting, and legal compliance. Viewing history and progress may be retained while your account exists. Payment and tax records may be kept for periods required by law. Aggregated or de-identified data may be retained indefinitely. When you delete content or your account, residual copies may remain in backups for a limited time.

7.1 Account Controls

You may update profile information through your account tools (and Clerk). To request account deletion or a copy of your data, email [email protected]. We may need to verify your identity. Deletion may be limited where we must retain data for legal, security, or legitimate business reasons, or where content has been shared publicly or licensed as described in the Terms.

7.2 Marketing

Opt out of promotional emails via the unsubscribe link or by contacting us. You will still receive transactional messages (e.g., receipts, security alerts, festival notices tied to your submissions).

7.3 EEA/UK Rights

If GDPR/UK GDPR applies, you may have rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing is consent-based. You may lodge a complaint with your local supervisory authority. Contact [email protected] to exercise rights.

7.4 California / U.S. State Privacy Rights

If you are a California resident (or resident of a state with similar laws), you may have rights to know/access, delete, correct, and opt out of certain "sales" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information for money. We may "share" identifiers with advertising partners when ads are enabled; you can request opt-out by emailing [email protected] with subject "Privacy Opt-Out." We will not discriminate against you for exercising privacy rights. We do not knowingly sell or share personal information of consumers under 16.

Categories we may collect: identifiers; commercial information (purchases, credits); internet/network activity; audiovisual content you upload; professional information you include in profiles/credits; and inferences for recommendations. Sources and purposes are described above.

7.5 Authorized Agents

California residents may designate an authorized agent to submit requests; we may require proof of authorization and identity verification.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will take appropriate steps to delete it. Users 13–17 should use the Service only with parental/guardian consent as required by the Terms. Content on FSTiVL may include mature themes; content ratings are provided by uploaders and are not a substitute for parental judgment. We do not currently offer verified parental controls or age-gating beyond posted ratings and Terms.

We are based in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the United States and other countries where our providers operate. Those countries may have different data-protection laws. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers from the EEA/UK.

We implement technical and organizational measures designed to protect personal information (access controls, encryption in transit where supported by providers, and vendor due diligence). No method of transmission or storage is 100% secure. You are responsible for protecting your account credentials.

The Service may link to third-party sites or load third-party scripts (ads, auth, analytics). Their privacy practices are governed by their own policies. We are not responsible for third-party practices.

We may update this Privacy Policy by posting a revised version and updating the "Last Updated" date. Material changes may also be notified by email or in-product notice. Continued use after the effective date constitutes acknowledgment of the updated Policy.

Privacy questions or requests:

FSTiVL LLC

[email protected]