Privacy Policy

1. Who We Are

CinemaCircle ("we", "us", "our") is a Discord bot service operated in the United Kingdom. Our service allows Discord server administrators to install CinemaCircle and members to log films, share ratings, and coordinate movie nights within their Discord server.

For the purposes of UK GDPR and the Data Protection Act 2018, CinemaCircle is the data controller for information we collect through our service.

Contact: [email protected]

2. What Data We Collect

2.1 Discord Server (Guild) Data

• Discord server ID and server name
• Server owner's Discord user ID
• Configuration preferences (channel IDs, timezone, feature flags), including those set via /setup
• Subscription plan and billing status (not payment details)

2.2 Discord User Data

• Discord user ID
• Discord username and display name (at time of interaction)
• Avatar URL (for embed display)

We do not collect email addresses, real names, phone numbers, or any other personal identifiers beyond what Discord provides.

2.3 Content You Create

• Film logs: title, date watched, star rating, text review, name drop text
• Watchlist entries and votes
• TV season logs and ratings
• Movie night poll responses

This content is created voluntarily by you when using bot commands.

2.4 Usage & Technical Data

• Command usage counts (for plan quota enforcement)
• Error logs (for debugging — anonymised where possible)
• Webhook event logs from Stripe (billing events only)

We do not use cookies, tracking pixels, or analytics on this website beyond what your browser reports in standard HTTP logs.

3. How We Use Your Data

We use the data we collect to:

• Operate the bot and deliver its features within your Discord server
• Store and display film logs, ratings, and watchlists to your server members
• Enforce plan quotas and feature gates
• Process billing events via our payment provider (Whop)
• Debug errors and maintain service reliability
• Respond to data export or deletion requests

We do not use your data for advertising, profiling, or sale to third parties.

4. Legal Basis for Processing (UK GDPR)

• Contract performance — processing necessary to deliver the bot service you or your server admin has requested
• Legitimate interests — maintaining service security, preventing abuse, debugging errors
• Legal obligation — retaining billing records as required by UK law

5. Data Sharing

We share data with the following third parties only where necessary to operate the service:

• Discord — our platform; your data is also subject to Discord's Privacy Policy
• Whop — payment processing; they receive only what is necessary to process your subscription. Subject to Whop's Privacy Policy
• TMDB (The Movie Database) — we query their API to fetch film metadata. We send only film search queries; no personal data is transmitted
• Hetzner / Coolify — our hosting infrastructure, based in the EU/EEA
• Sentry — error tracking; error reports may include Discord user IDs and command context

We do not sell, rent, or trade your personal data to any third party.

6. Data Retention

• Active servers: all data retained while the bot remains in your server
• After bot removal: server data is retained for 30 days then automatically deleted
• After manual deletion request: all server data deleted within 7 days, subject to a confirmation step
• Billing records: retained for 7 years as required by UK HMRC regulations
• Error logs: retained for 90 days then purged

7. Your Rights (UK GDPR)

You have the following rights regarding your personal data:

• Access — request a copy of data we hold about you or your server
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request we limit how we process your data
• Portability — request your data in a machine-readable format (CSV/JSON export via the dashboard or /export command)
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Server administrators can also trigger a data export or deletion directly from the CinemaCircle dashboard.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.

8. Data Security

We take reasonable technical and organisational measures to protect your data, including:

• Encrypted connections (TLS) for all data in transit
• Database encryption at rest on Hetzner infrastructure
• Access controls limiting who can view production data
• Regular database backups with off-region copies
• Signed JWT sessions with secret rotation for dashboard access

No system is perfectly secure. If we become aware of a data breach that affects your rights, we will notify affected users and the ICO in accordance with our legal obligations.

9. Children's Privacy

CinemaCircle is not directed at children under the age of 13. Discord's own Terms of Service require users to be at least 13 years old. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. International Transfers

Our infrastructure is based in the EU/EEA (Hetzner, Germany). Some third-party providers (such as Sentry) may process data outside the UK/EEA. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses as approved by the UK ICO.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify server administrators of material changes via a bot message or by posting a notice on this page with an updated "Last updated" date. Continued use of CinemaCircle after changes constitutes acceptance of the revised policy.

12. Contact

For privacy-related questions or to exercise your rights:

• Email: [email protected]
• Website: cinemacircle.app