Privacy Policy

1. Introduction

Welcome to Quilty. We are committed to protecting your privacy and being transparent about how we collect, use, and protect your personal information. This Privacy Policy explains our practices regarding data collection and use for our screenplay analysis platform.

By using Quilty's services, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, and password when you create an account
• Screenplay Content: Scripts and related materials you upload for analysis
• Payment Information: Billing details for purchases and subscriptions, processed securely by our payment processor (Stripe). We do not store full card numbers; we retain transaction and subscription records (e.g., amounts, dates, plan tier) as needed for billing, support, billing disputes, and legal compliance
• Marketing Consent and Incentive Records: Whether you opted in to marketing emails, when consent was given or withdrawn, consent text/version/source where recorded, and first-payment marketing-incentive eligibility or redemption state (for example, available, reserved, consumed, or released)
• Membership Credit Usage: Records of Discovery membership credit grants, bank balances, borrowed-credit authorizations, locked catalog prices, settlement invoices, and related allocation history used to operate banked Base credits and settle uncovered borrows
• Communications: Messages you send to us, including support requests and feedback

2.2 Information We Collect Automatically

• Usage Data: How you interact with our platform, including features used and time spent
• Device Information: Browser type, operating system, IP address, and device identifiers
• Analytics Data: We use analytics services (PostHog, Google Analytics) to understand how users interact with our service
• Cookies: Essential and analytics cookies (see Section 9)

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our screenplay analysis services
• Process and analyze the screenplays you submit
• Communicate with you about your account, updates, and support
• Understand how users interact with our platform to improve the user experience
• Detect, prevent, and address technical issues and security concerns
• Send transactional and, where you have consented, marketing communications
• Process payments and subscriptions via Stripe, including first-payment marketing incentives and settlement of uncovered borrowed Base membership credits
• Comply with legal obligations and enforce our Terms of Service

4. Lawful Basis for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

4.1 Performance of a Contract (Art. 6(1)(b))

• Account creation and management
• Screenplay analysis and report generation
• Transactional email delivery (account confirmations, analysis-ready notifications)
• Payment processing

4.2 Consent (Art. 6(1)(a))

• Marketing and promotional emails
• Analytics cookies (PostHog, Google Analytics)
• Advertising and conversion tracking pixels (Google Ads, Meta/Facebook Pixel)
• Session replay and behavioral analytics

4.3 Legitimate Interest (Art. 6(1)(f))

• Security monitoring and fraud prevention
• Service performance optimization and improvement
• CDN and DDoS protection (via Cloudflare)
• Aggregated usage analytics for product development

5. Data Storage and Retention

Location: Your data is stored on servers located in the United States (California).

Retention Period: We retain your personal information and uploaded content for as long as your account is active or as needed to provide you services. If you delete your account, your personal data and uploaded content are deleted immediately. Certain records may be retained for up to 30 days for technical processing (e.g., backup rotation, queue clearing). We may also retain limited records as required by applicable law or regulation (e.g., financial transaction records, legal compliance records).

Billing, incentives, and settlement: We retain Stripe payment and subscription records, marketing-consent and first-payment incentive records, membership credit allocations, and borrowed-credit settlement history for as long as needed to operate billing, resolve disputes or chargebacks, collect outstanding settlement amounts, and meet tax and legal obligations. Account deletion does not necessarily erase anonymized billing or settlement records required for those purposes.

Screenplay Content: Uploaded screenplays and analysis results are retained while your account is active to provide you with historical access to your work. Upon account deletion, all screenplay content and analysis results are permanently removed.

7. Third-Party Service Providers

We use the following third-party service providers to operate and improve our platform. Each provider processes data only for the purposes described and in accordance with their respective privacy policies and our data processing agreements:

We do not sell your personal data to any third party. These providers act as data processors on our behalf and are contractually obligated to process your data only as instructed by us.

8. Data Sharing and Disclosure

We do not sell, rent, or share your personal information or screenplay content with third parties for marketing purposes, except in the following limited circumstances:

• AI Processing Providers: As described in Section 6, we share screenplay content with AI providers solely for the purpose of generating your analysis. These providers are contractually prohibited from using your content for model training.
• Service Providers: As described in Section 7, we share data with providers who assist in operating our platform (analytics, email delivery, payments, security).
• Legal Requirements: We may disclose information if required by law, court order, or government regulation.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
• With Your Consent: We may share information with third parties when you explicitly authorize us to do so.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate our platform, analyze usage, and deliver advertising. You can manage your cookie preferences via our cookie consent banner or your browser settings.

How consent works by region: For visitors in the European Economic Area, the United Kingdom, and Switzerland, analytics and advertising cookies are set only after you opt in by accepting on our consent banner. For visitors in the United States and other regions, these services may run by default in accordance with applicable law (for example, the CCPA/CPRA), and you can opt out at any time using the banner. Regardless of region, we honour Google Consent Mode: until analytics and advertising storage are granted, our advertising tags operate in a cookieless mode that does not store identifiers on your device.

9.1 Essential Cookies

These cookies are necessary for the website to function and cannot be disabled:

• quilty-cookie-consent — Stores your cookie consent preference
• Authentication cookies — JWT tokens stored in localStorage to keep you logged in
• Security cookies — CSRF protection and fraud prevention

9.2 Analytics Cookies

These cookies help us understand how visitors use our platform (set according to your region and consent choice — see above). Before consent, PostHog runs in a cookieless mode that measures aggregate, anonymous usage without storing an identifier on your device:

• __ph_* — PostHog analytics cookies for product usage insights and session replay
• _ga, _gid — Google Analytics cookies for website usage tracking
• Google Tag Manager — Loads our analytics and advertising tags after you consent; does not set its own tracking cookies

9.3 Marketing and Advertising Cookies

These cookies are used for advertising and conversion measurement (set according to your region and consent choice — see above):

• quilty_attribution — Marketing attribution tracking (30-day expiry)
• Google Ads cookies — Conversion tracking and remarketing
• Meta/Facebook Pixel cookies — Advertising conversion tracking

9.4 Third-Party Cookies

• Stripe cookies — Required for secure payment processing and fraud detection
• Cloudflare cookies — Security challenge cookies and bot detection

You can opt out of non-essential cookies via our cookie consent banner. You may also install the Google Analytics Opt-out Browser Add-on to disable Google Analytics specifically. Disabling cookies may affect certain site functionality.

10. Email Communications

10.1 Account-Critical Emails

We send account-critical emails that are required to operate and secure your account, including:

• Account verification and password reset
• Account changes, security alerts, and account-deletion confirmations

These messages are required for service delivery and cannot be opted out of while your account remains active.

10.2 Analysis & Service Emails

When you upload a screenplay, treatment, series, or other work, we send service emails that are part of fulfilling the analysis you requested, including analysis-ready notifications and follow-ups that help you complete your full analysis and writer’s coverage of the work you uploaded. Because these emails relate directly to content you submitted for analysis, they are not promotional marketing.

You can opt out of analysis & service emails at any time using the opt-out link included in every such email, or by updating your email preferences in your account settings. Opting out does not affect account-critical emails.

10.3 Marketing Emails

With your consent, we may send marketing communications including:

• Product updates and new feature announcements
• Industry insights and content (newsletter)
• Promotional offers and invitations

Marketing emails require your affirmative consent (for example, an optional checkbox that is unchecked by default). Providing an email address or using Quilty alone is not marketing consent. Eligible first-time buyers who opt in may receive a one-time 10% discount on their first completed eligible payment; we store incentive eligibility and redemption state for that purpose. Discounts do not stack with other promotional discounts.

You may revoke marketing consent at any time by clicking the unsubscribe link included in every marketing email, or by updating your email preferences in your account settings. Revocation stops future marketing emails and does not affect account-critical or analysis & service emails, and does not retroactively change a completed purchase or restore discount eligibility.

11. Your Rights and Choices

11.1 GDPR Rights (EU Users)

If you are located in the European Union, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Data Portability: Request a copy of your data in a machine-readable format
• Restriction: Request that we limit how we use your data
• Objection: Object to our processing of your data
• Withdraw Consent: Where processing is based on consent, withdraw consent at any time without affecting prior processing

11.2 Supervisory Authority

If you are located in the European Union and believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with your local supervisory authority (data protection authority). A list of EU data protection authorities is available at edpb.europa.eu.

11.3 CCPA Rights (California Users)

If you are a California resident, you have the following rights:

• Right to Know: Request information about the personal data we collect, use, and disclose
• Right to Delete: Request deletion of your personal data
• Right to Opt-Out: We do not sell personal information, so no opt-out is necessary
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

11.4 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@quilty.app. We will respond to your request within 30 days.

12. Security

We implement industry-standard security measures to protect your personal information and screenplay content from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using SSL/TLS
• Secure authentication and password hashing
• Regular security audits and updates
• Access controls limiting who can view your data

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

13. Children's Privacy

Quilty is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@quilty.app, and we will delete such information.

14. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers are located. By using our services, you consent to the transfer of your information to the United States. We take appropriate measures to ensure your data is treated securely and in accordance with this Privacy Policy.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page with a new "Effective Date"
• Sending an email notification to your registered email address
• Displaying a prominent notice on the Service

Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: