Privacy Policy

1. Data Controller

CineLog is operated by EZLOG LTD, registered in the United Kingdom.

For any privacy-related enquiries, contact: contact@cinelog.co.uk

2. Data We Collect

The App is designed to function with minimal data collection. Most information you enter is stored on your own device. Shared department times may be processed by CineLog Core if you use optional CineLog Crew Sync, or by Apple CloudKit for older departments created that way. Pay, notes, invoices, and tax data stay on your device. They are not uploaded to CineLog-operated servers unless this policy says otherwise for a specific optional feature.

2.1 Data You Enter in the App (on your device)

• Work logs: dates, times, and crew roles you select
• Job labels you choose for your own records (for example a production, show, or employer name you type in). These labels help you organise work on your device; they are not sent to CineLog-operated servers
• Optional notes you enter
• Optional invoicing details (only if you enable invoicing features)
• Subscription status and entitlement metadata

If you opt in to anonymous rate insights (section 9.3), we process only production type (for example HETV or Feature Film), budget band, department, crew role from the in-app list, and day rate. We do not send your job labels, production titles, or client names for that feature.

2.2 Data Automatically Generated

• A pseudonymous install identifier used only for first-party product usage analytics (section 9.2), when that feature is enabled
• If you create an optional CineLog cloud account, Sign in with Apple or Google identifiers needed to authenticate that account (Apple may supply a private relay email)
• Subscription transaction receipts (handled by Apple or Google)

2.3 Data We Do Not Collect

The website uses aggregate analytics as described in section 9.1. No analytics cookies are set.

Anonymous rate insights (section 9.3) is optional and off by default. If you opt in, only the categorised fields in section 9.3 are sent, never your free-text job labels or production titles.

2.5 CineLog cloud account (optional)

A CineLog cloud account is optional. Local time logging does not require it. You create one only if you want shared Crew (CineLog Crew Sync) with Apple or Google sign-in.

If you sign in, we process:

• An authentication identity from Apple or Google
• A CineLog account identifier used to join, create, or administer shared departments
• Membership in those departments (role, nickname you choose, invite activity)

We do not put your private pay, notes, invoices, HMRC tokens, or accounting tokens through the department service.

You can delete the cloud account in Settings, or request deletion at https://cinelog.co.uk/delete-account/. Deletion removes the cloud identity and account linkage. Your memberships become anonymised and unbound. Shared department records may remain without association to the deleted identity so other members' records are not destroyed. Jobs, times, and pay on your own device are not erased.

A later Apple or Google sign-in creates a new CineLog cloud account. It does not reopen the deleted one.

2.4 Refer crew (optional)

If you use Refer crew in the App, limited data is sent to our referral service. This runs on separate infrastructure from optional anonymous rate insights (section 9.3). Your timesheet, job, invoice, and tax data are not mixed into referral storage.

Data processed for referrals may include:

• A pseudonymous device identifier (HMAC hash, not your name or email)
• Your referral code and whether a new install was attributed to it
• App Store subscription notification metadata needed to confirm a qualifying paid referral (such as appAccountToken and transaction identifiers)

We do not upload jobs, time entries, invoices, bank details, or HMRC or accounting tokens for referrals.

3. On-Device Processing

All earnings calculations, tax estimates, deductions, and invoice generation are performed entirely on your device.

CineLog has no technical capability to access this data.

4. Invoicing & Accounting Integrations

The App offers optional accounting integrations, including APIs to third-party accounting platforms such as QuickBooks, for users who choose to enable them.

• Invoicing information remains encrypted using Apple's encryption mechanisms
• Invoice data is stored on-device only
• Data is transmitted directly from your device to the selected accounting provider
• CineLog does not store, process, or retain invoice contents

Use of third-party accounting services is governed by their respective privacy policies.

5. HMRC Making Tax Digital (MTD)

CineLog includes an optional Making Tax Digital (MTD) feature that allows self-employed users to submit quarterly income and expense updates, and an annual final declaration, directly to HM Revenue & Customs (HMRC) on their behalf.

5.1 What data is processed

• National Insurance Number (NINO) — entered by you and stored encrypted in the iOS Keychain on your device only. Used in HMRC API request paths.
• HMRC OAuth tokens (access token and refresh token) — stored in the iOS Keychain on your device only. Never transmitted to CineLog.
• HMRC Business ID — your HMRC-assigned self-employment business identifier, stored in the iOS Keychain on your device only.
• Quarterly income and expense totals — calculated on-device from your CineLog time entries and submitted to HMRC at your explicit instruction.

5.2 How data is transmitted

5.3 Consent and control

• Before connecting to HMRC for the first time, you are shown a clear explanation of what CineLog will do on your behalf
• No submission is ever made without your explicit instruction — there are no automatic or background submissions
• You can disconnect from HMRC at any time from within the app. This immediately clears all stored tokens from your device's Keychain
• Access can also be revoked directly through the HMRC Government Gateway

5.4 Legal basis

Processing HMRC-related data is carried out under:

• Contract — to provide the MTD service you have subscribed to
• Legal obligation — to assist you in meeting your statutory Making Tax Digital for Income Tax obligations

5.5 Third party

By using the MTD feature, your income and expense data is submitted to HMRC on your behalf. HMRC's handling of that data is governed by HMRC's own privacy notice.

6. Cloud Storage & Sync

Where you use older departments created with Apple CloudKit, work logs sync through CloudKit. CloudKit data is encrypted by Apple. CineLog cannot read those encrypted record contents.

Where you use CineLog Crew Sync, shared department information (membership, invites, and shared day records) is processed on CineLog Core, operated by EZLOG LTD on secure EU-based infrastructure. Private pay and notes are not sent there.

Financial, tax, and invoicing data are not synced to either department service.

If you opt in to anonymous rate insights (section 9.3), limited data is processed on secure EU-based infrastructure as described there. That feature is separate from Crew and from product analytics.

7. Team & Production Sharing

When you join or create a department:

• Only work time entries relevant to the production are shared with other members
• Pay rates, earnings, tax data, invoice data, and private notes are never shared with the department service
• Access is governed by the department's membership (owner, admin, or member). Older CloudKit departments use Apple's CloudKit permission model
• You may leave a department at any time, ending future sharing from your account
• Deleting your CineLog cloud account anonymises your seat. It does not delete other members' shared days

8. Subscriptions & Payments

Subscriptions are processed by Apple In-App Purchase, or by Google Play billing on Android. Week Pass is not offered for sale. An already-purchased Week Pass still unlocks Pro for its remaining period.

CineLog:

• Does not receive payment card details
• Does not store billing information
• Only receives subscription entitlement status

Apple's privacy policy governs payment data handling.

8.1 Refer crew rewards

Subscribers may share a personal invite link with crew. New users who install through that link receive the same Pro purchase options as other users (monthly or annual subscription). Existing Week Pass purchases still unlock Pro if you already bought one. Week Pass is not offered for sale. Referrer credit applies on paid monthly or annual subscription only.

Rewards are applied by Apple to the referrer's subscription through Apple In-App Purchase promotional offers, not by unlocking Pro locally in the App.

9. Analytics & Tracking

Analytics on the website and in the App are handled separately. The App does not include third-party analytics or advertising libraries. The website uses privacy-friendly aggregate analytics that do not set cookies.

9.1 Website analytics (cinelog.co.uk)

We use Cloudflare Web Analytics to understand how visitors use the site in aggregate, for example which pages are viewed, where traffic comes from, and how quickly pages load.

What it collects: page URLs, referrer, browser and device type, and approximate location (country or city level). It does not collect your name, email, or anything you enter on the site. There are no account forms on the marketing site.

Who receives it: Cloudflare, Inc., as our analytics provider.

Cookies: Cloudflare Web Analytics does not use cookies, local storage, or other persistent identifiers on your device for this purpose.

Legal basis: Our legitimate interest in understanding aggregate site usage to maintain and improve cinelog.co.uk.

Retention: Aggregated analytics data is retained according to Cloudflare's Web Analytics retention settings.

9.2 App analytics

The App does not use third-party analytics SDKs, advertising libraries, or cross-app tracking. It does not use PostHog.

Apple or Google may provide CineLog with limited, aggregated diagnostic data (for example crash reports and performance metrics) to help us maintain stability. This data is not linked to your work logs or earnings.

Separately, the App may send first-party pseudonymous product usage analytics so we can understand aggregate feature use. This may include the type of feature used, platform, app version, coarse non-personal categories where needed (for example agreement type), timestamps, and a pseudonymous install identifier. It does not include your name, email, job titles, rates, hours, invoice contents, or HMRC or accounting tokens. Crew grouping uses a hashed identifier that cannot be reversed to a production name.

If you are signed in to a CineLog cloud account, we may store a separate hashed account-level analytics identifier so signed-in use can be counted without keeping your login identity. Deleting the cloud account removes that account-level mapping. Install-grained event rows have no login identity on them and may remain as pseudonymous telemetry.

This data is sent to EZLOG LTD on secure EU-based infrastructure used for other limited App services. It is not mixed with your timesheet or financial records, and it is separate from optional anonymous rate insights (section 9.3) and from Refer crew (section 2.4).

Legal basis: our legitimate interests in operating and improving the App (UK GDPR Article 6(1)(f)). You can stop sending this data at any time in Settings (Backup & Data / Privacy). Turning it off stops new uploads and clears local analytics credentials. Historical aggregates may remain.

The optional feature in section 9.3 is separate and requires its own opt-in.

9.3 Optional anonymous rate insights (BECTU Camera Branch)

The App offers optional anonymous rate insights for eligible camera-branch departments. If you opt in, you share pay-context data that is designed to be anonymous to help BECTU Camera Branch with rate-card research.

This is optional. It is off by default. You are prompted during job setup (and can change your choice at any time under Privacy & Sharing in the app).

What may be shared (only if you opt in):

• Production type (e.g. HETV or Feature Film)
• Production budget band (where applicable)
• Your department and crew role (from the in-app role list — not free-text labels)
• Your day rate as entered in the app (or a day rate derived from your pay settings in the app)

What is not shared:

• Your name or contact details
• Production or job titles
• Client, employer, or agency details
• Invoice or tax data
• Team-shared hours or other users' data
• Your Apple ID or advertising identifiers
• Free-text role descriptions (including if you choose "Other" in the role list)

Who receives it:

Data is sent from your device to EZLOG LTD and held on secure EU-based infrastructure operated by a third-party processor we use.

We do not include your name, contact details, or production titles in this data.

Anonymous submissions are shared with BECTU Camera Branch for rate-card research. Because day rates can be specific, we cannot guarantee that every combination of role, band, and rate is unique in the industry, but the feature is not intended to identify you personally.

Legal basis:

Your consent (you can withdraw it at any time).

How to opt out:

Turn off sharing in the app (Privacy & Sharing). This stops new uploads and deletes the data we still hold for this feature. Data already shared with BECTU may be retained by them under their policies and our data-sharing agreement.

Processing on our systems:

We may process limited technical information needed to run this feature and prevent misuse. We do not publish the details of those checks.

10. Data Retention

• On-device data remains until you delete it or uninstall the App
• Cloud-synced work logs remain until you delete them
• No invoice contents are retained by CineLog
• Subscription records are retained only as required by law
• CineLog cloud account: deleted when you delete the account in the App or via https://cinelog.co.uk/delete-account/. An opaque record may remain solely so shared department history is not destroyed. It has no Apple or Google login attached and cannot be turned back into an account
• Product usage analytics: account-level analytics identifiers are removed when the cloud account is deleted. Pseudonymous install events are retained only as long as needed for aggregate product metrics, then deleted or aggregated. Disabling the feature in Settings stops new collection
• On-device data remains until you delete it or uninstall the App. Deleting the cloud account does not erase local jobs
• Anonymous rate insights (if opted in): Data is kept on our EU infrastructure while you remain opted in. When you opt out, we delete the data we still hold for this feature.
• Data shared with BECTU: Anonymous data already received by BECTU Camera Branch may be retained by BECTU under their policies.

11. Your Rights (UK & EU Users)

Under UK GDPR and GDPR, you have the right to:

• Access your data
• Delete your data
• Restrict processing
• Data portability (where applicable)

Because most timesheet and pay data resides on your device, you can delete it by removing jobs or uninstalling the App.

To delete the optional CineLog cloud account: Settings, then CineLog Account, then Delete CineLog account, or https://cinelog.co.uk/delete-account/. If you own a shared department, transfer ownership first (the App opens that department for you). If you no longer have the App, request the transfer and deletion from that web page or contact@cinelog.co.uk.

If you have opted in to anonymous rate insights, you can withdraw consent at any time in the app (Privacy & Sharing). You may also contact us at contact@cinelog.co.uk about data we hold for this feature. Because most other data is on your device, you can delete it immediately by removing jobs, entries, or uninstalling the App.

12. Children's Privacy

CineLog is not intended for users under 16.

No data is knowingly collected from children.

13. Security

Security is enforced through:

• Apple-managed encryption
• Local-only storage of sensitive financial and invoicing data
• No CineLog-hosted storage of your financial, tax, or invoice databases; optional anonymous rate insights are handled separately on secure EU-based infrastructure (section 9.3)

The system is intentionally designed to minimise exposure rather than rely on downstream controls.

14. Changes to This Policy

This policy may be updated as features evolve.

Material changes will be communicated via the App or App Store listing.