Privacy Policy
Last updated: 18 September 2026
This is an English translation provided for convenience. If it differs from the Italian text, the Italian version prevails. Versione italiana
This policy explains what personal data Riprea processes, why, for how long and what rights you have, under Articles 13 and 14 of EU Regulation 2016/679 (“GDPR”). We do not sell data, we do not run advertising and we do not profile the people who use the service.
1. Data controller
Riprea, sole proprietorship, VAT number 02156780898. Email: [email protected].
For any privacy question write to [email protected]. No data protection officer has been appointed.
2. What data we process
| Data | Where it comes from |
|---|---|
| Account: first name, last name, email, date of birth, password (stored only in encrypted form), date and version of the Terms accepted | You enter it when signing up |
| Optional profile: photo, region, city, company | You add it, if you want |
| Project content: scripts, breakdowns, images, shooting schedules, call sheets, calendar events, messages with collaborators, change history with the author of each change | Created by you and the people you invite |
| Subscription: plan, status, due dates, invoices. From Stripe we only receive the payment outcome and a code that identifies the card without allowing it to be used, so the free trial is granted only once | From Stripe, when you subscribe |
| Technical data: IP address, browser type, access times, error logs and logs of emails sent | Generated by using the service and kept by our providers |
| Invited people: email and, where given, the role of people invited to a project | Entered by the person who sends the invitation |
| Newsletter: email, date and proof of subscription confirmation, opens and clicks on the emails received | You enter them when you subscribe on the website, at sign-up or from your profile |
Other people’s data that you enter in projects (casting, crew, contacts) is processed on your behalf: for that data you are the controller, as explained in the Terms, section 12.
3. Why we process it and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating and managing the account, running the service, sending service emails (confirmation, password recovery, reminders you turn on, invitations) | Performance of the contract |
| Checking that people who sign up are at least 18 | Performance of the contract: subscriptions are contracts a minor cannot enter into alone |
| Managing payments, subscriptions and invoices | Performance of the contract and legal tax and accounting obligations |
| Security and abuse prevention: blocking disposable email addresses, granting the Team trial only once, protecting the site from attacks | Legitimate interest in protecting the service and its users |
| Informing people invited to a project | Legitimate interest of the person inviting and of Riprea in making collaboration work |
| During the Beta: writing to you about how the test is going, its end, the new Terms and the discount reserved for testers | Performance of the contract (the Beta Terms) |
| Sending the newsletter with Riprea news, guides and offers to people who subscribe | Consent, which you can withdraw at any time |
| Defending a right in the event of a dispute | Legitimate interest |
We do not use your data or your content to train artificial intelligence systems, and we do not make automated decisions about you.
Account data is required: without it we cannot provide the service. Optional profile data is not.
4. If someone invited you
If you received an invitation, your email was given to us by the person who invited you to one of their projects. We use it only to send you the invitation and, if you sign up, to give you access to the project. If you do not accept, the email stays in the inviter’s project until they remove it or close their account; you can ask us to delete it by writing to [email protected].
5. Who we share data with
Data is processed by us and by the providers who help us deliver the service, appointed as processors or, where stated, acting as independent controllers:
| Provider | Activity | Where |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | Servers in the European Union (Frankfurt, Germany) |
| Stripe Payments Europe, Ltd. | Payments and subscription management | Ireland; for some processing Stripe acts as an independent controller |
| Resend (Plus Five Five, Inc.) | Sending service emails | Sent from the European Union (Ireland); company based in the United States |
| Cloudflare, Inc. | Website hosting, DNS and attack protection | Global network; company based in the United States |
| MailerLite (UAB MailerLite) | Sending the newsletter, only to people who subscribe | Company based in Lithuania (European Union) |
People you invite to a project see the project data according to the permissions you assign, and your name and email as the owner. Data may be disclosed to authorities when the law requires it, and to our accountant for tax obligations.
Some providers are based in the United States. Transfers take place on the basis of the EU-US adequacy decision (Data Privacy Framework) for certified companies, or the European Commission’s standard contractual clauses.
6. How long we keep it
- Account and content: for as long as the account exists. If you ask for it to be closed, we permanently delete it 30 days after the request; backups are overwritten in the following days.
- Invoices and accounting data: 10 years, as required by law (Article 2220 of the Italian Civil Code).
- Technical logs: for the limited time set by our providers for security and troubleshooting.
- Emails of invited people: for as long as the invitation stays in the project.
- Newsletter: for as long as you stay subscribed. When you unsubscribe we keep only the email and the date of unsubscription, so we never write to you again by mistake.
7. Your rights
At any time, free of charge, you can ask:
- to access your data and receive a copy;
- to correct it (you can change much of it directly from your profile);
- to delete it (you can close your account from your profile);
- to restrict its processing;
- to receive it in a machine-readable format (portability);
- to object to processing based on legitimate interest;
- to withdraw your consent to the newsletter, without affecting processing carried out before.
Write to [email protected]: we reply within one month. If you believe the processing breaks the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the EU country where you live.
8. Security and minors
Connections are encrypted, passwords are never stored in plain text and each project is visible only to its owner and the people they invite. No system is 100% secure: if we discover a breach affecting you, we will tell you as required by law.
Riprea is only for people aged 18 or over: we do not knowingly collect data from minors.
9. Cookies
We only use technical tools needed for the site to work, with no profiling or analytics cookies. Details are on the cookies page.
10. Changes
If we change this policy we update the date at the top; if the changes are significant we let you know by email.