Subprocessors

1. How to read this

Each of these is contractually bound to process data only on our instructions, to keep it secure, and not to use it for their own purposes. We review this list as it changes and will post updates here.

2. Google (Firebase and Google Cloud)

Authentication, database, private file storage and application hosting. Receives your account identifier, your uploaded files and their metadata. Processed in Canada, the United States and the European Union.

3. Google Analytics

Visit statistics, only for visitors who allow it in the cookie banner. Receives the pages visited, the referring page, device and browser details, approximate location and a random identifier; advertising features and Google signals are off. Processed in the United States and the European Union.

4. Stripe

Payments, subscriptions, invoicing and tax calculation. Receives your name, email address, billing country and payment details. We do not receive or store your full card number. Processed in the United States and the European Union.

5. Resend

Transactional email — receipts, account notices, guest-upload notices, and acknowledgements of the messages you send us. Receives the relevant email address and the content of those messages. Processed in the United States and the European Union.

6. Analysis providers

Media you upload to the cloud is processed to produce the representations and suggested tags that make search work. This is done under agreements that prohibit the provider from using your content for any purpose other than returning the result to us. We will name the current providers on request to contact@cine.gallery.

7. Changes

If we add a subprocessor that materially affects how your data is processed, we will update this page. Members who need advance notice for their own compliance can ask us for it in writing and we will give it.

8. Talking to us first

If anything in this document, or anything about how we have treated you, concerns you, write to contact@cine.gallery before taking a formal step. We reply within five business days and tell you what we can and cannot do.

Nothing here removes any right you have under Canadian law or the law where you live, including your right to complain to a regulator or, in Ontario, to bring a claim. We only ask for the chance to put it right first.