Privacy Policy

1. Who we are

Water Palaver Ltd (“HardOut.io”, “we”, “us”) is the data controller for personal data processed through the HardOut.io service (the “Service”). We are registered in England and Wales, company no. 17267842, registered office Station House Station Approach, East Horsley, Surrey, United Kingdom, KT24 6QX.

For data you upload about third parties (e.g. talent, crew, vendors) we act as a data processor on behalf of your account, which acts as the controller of that data.

2. Scope

This policy describes how we handle personal data when you use the Service, visit our marketing website, or otherwise interact with us. It applies in addition to our Terms of Service.

3. What we collect

3.1 Account data

Name, email, phone, dietary requirements, company/production name, password (hashed by Supabase Auth).

3.2 Subscription & billing data

Plan, seat count, invoice history. Card details are collected and stored by Stripe; we never see or store full card numbers. We receive a token and the last four digits.

3.3 Project data

Anything you create inside the Service: project names, schedules, locations, casting submissions, wardrobe images, shot lists, call sheets, quotes, invoices, equipment lists, receipts, photographer quotes, purchase orders, internal notes. This may include personal data about third parties (talent, crew, vendors, clients) that you choose to enter.

3.4 Usage data

Pages visited, features used, IP address, browser, device type, log timestamps. Used for security, debugging and product improvement.

3.5 Communications

Emails, support messages, feedback. Stored to maintain history and improve the Service.

4. How we use it

• To provide and operate the Service (host your data, render your pages, send call sheets).
• To process payments via Stripe and issue receipts and invoices.
• To send transactional emails (invites, password resets, billing notifications) via Resend.
• To respond to support requests.
• To investigate abuse, fraud and breaches of our Terms.
• To improve the Service - analysing aggregate, de-identified usage patterns.
• To comply with legal obligations.

We do not sell your personal data. We do not use Your Content to train machine learning models.

5. Lawful basis

• Contract - to deliver the Service you signed up for (UK GDPR Art. 6(1)(b)).
• Legitimate interests - to secure the Service, prevent fraud, debug, and develop new features (Art. 6(1)(f)).
• Legal obligation - for tax, accounting and regulatory record-keeping (Art. 6(1)(c)).
• Consent - for any optional marketing communications, which you can withdraw at any time (Art. 6(1)(a)).

6. Sharing & subprocessors

We share personal data only with the providers we rely on to operate the Service:

• Supabase - database, auth, file storage. Data hosted in the EU.
• Stripe - payment processing.
• Resend - transactional email delivery.
• Vercel - application hosting and CDN.
• Professional advisers (lawyers, accountants) where necessary.
• Authorities where we are legally required to disclose.

Each subprocessor is contractually bound to protect your data and use it only for the purposes we specify. We review the list periodically; updates will be reflected here.

7. International transfers

Some of our subprocessors (e.g. Stripe, Vercel, Resend) operate outside the UK and EEA. Where data is transferred, we rely on the UK's International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an equivalent legally-recognised safeguard.

8. Retention

• Account data - for as long as your account is active, plus 30 days after closure to allow recovery / export, then deleted.
• Project data - same as account data; you may delete projects at any time, which removes them from our active systems immediately. Backups containing deleted data are overwritten within 30 days.
• Billing records - retained for 7 years as required by UK accounting and tax law.
• Support correspondence - retained for 2 years for service quality.
• Usage logs - retained for up to 90 days, then deleted or anonymised.

9. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• erase your data (subject to legal retention obligations);
• restrict or object to processing;
• data portability - receive your data in a structured, machine-readable format;
• withdraw consent at any time (where consent was the basis);
• complain to the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email the support form. We will respond within one month.

For data about third parties that you have entered into the Service, you should approach your account owner directly - they control that data.

10. Cookies

We use a small set of cookies:

• Essential - to keep you logged in (Supabase auth session). No consent required.
• Preferences - to remember your UI theme and similar settings.

We do not use third-party advertising or cross-site tracking cookies.

11. Security

We protect your data with row-level access controls in the database, encrypted transport (TLS), encrypted storage at rest, hashed passwords, rate-limited API endpoints and least-privilege admin access. No system is perfectly secure; if a breach occurs that puts your rights and freedoms at risk we will notify you and the ICO within 72 hours as required by law.

12. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, email the support form and we will delete it promptly.

13. Changes

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. For material changes we will notify you in-product or by email at least 30 days before they take effect.

14. Contact

Questions about this policy or how we handle your data? Email the support form (privacy queries) or the support form (general support, or use the support form).