Privacy

Last updated 26 July 2026

Frameboard is a tool for planning film and video productions. This page explains what it stores, why, and who else ever sees it. It is written to be read, not to be survived.

Who runs it

Frameboard is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], Chamber of Commerce number [KVK NUMBER]. For anything on this page, write to info@useframeboard.com.

What is stored

• Your account. Name, email address, and your password stored only as a bcrypt hash. The plain password is never written down anywhere, which is also why it cannot be recovered, only replaced.
• Your work. The productions you create: reference images, notes, sketches, documents, shot lists, lighting plans and any clips you upload.
• Collaborators. The email addresses you invite to a production, so access can be granted when they sign in.
• Technical records. Our host keeps ordinary server logs, including IP addresses, to keep the service running and to detect abuse.

Cookies

One cookie, used to keep you signed in. It contains a random session token and nothing else, and it is marked HttpOnly so scripts on the page cannot read it. There are no analytics cookies, no advertising cookies and no third-party trackers on this site, which is why you are not being asked to accept anything.

Who else sees anything

• Vercel. Hosting. Serves the application and keeps request logs.
• Supabase. The database your account and productions are stored in.
• hCaptcha (Intuition Machines). Shown on the sign-in and sign-up forms to block automated abuse. It receives your IP address and interaction signals for that check.
• Resend. Sends the few emails the service needs, such as a password reset link or a notification that someone shared a production with you. It sees your email address and the message.
• Sentry. Error reporting, so crashes get found and fixed. It receives the technical details of a failure. We have deliberately turned off the options that would send cookies, headers or IP addresses, and we do not record screen sessions.

That is the whole list of outside companies. Your work is never sold, never used for advertising, and never sent to an AI model. There is no AI feature in Frameboard and nothing you make here is used to train one.

When we look at your work ourselves

We can open a production from a support tool. We use it for three things: helping with a request you have sent us, recovering work after something has gone wrong, and investigating abuse or a legal demand. We do not open productions out of curiosity, to look for examples, or for anything to do with marketing.

Access is limited to a short list of named company accounts, currently the founders, and that list is set in the deployment configuration rather than being something an account can be granted from inside the app. The tool is read only: it cannot edit your production. Every time it is used to open a production, that is recorded with who did it, which production, and when.

If you would like to know whether your account has ever been opened this way, ask us at info@useframeboard.com and we will tell you.

Sharing is your choice

A share link makes a production readable by anyone who has the link, without signing in. That is the point of it, so treat the link as the key: anyone you send it to can pass it on. You can revoke or regenerate it at any time, which takes effect immediately.

How long it is kept

Your productions stay until you delete them. Deleting your account removes the account and everything attached to it: productions, uploaded media and sessions. That deletion is immediate and cannot be undone. Backups held by our hosting providers age out on their own schedules.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, have it erased, or object to how it is handled. Two of these you can do yourself without asking: every production has a JSON export (that is your portability right), and your account page deletes the account outright. For anything else, email us and we will respond within one month. You can also complain to your national data protection authority, which in the Netherlands is the Autoriteit Persoonsgegevens.

How it is protected

Passwords are hashed with bcrypt. Traffic runs over HTTPS. Session cookies are HttpOnly and hold only a hash of the token, so a stolen database row cannot be replayed as a login. Every project request is checked against your account, so a project URL on its own grants nothing. Row Level Security is enabled on every database table. No system is perfect, and we will tell affected users promptly if something goes wrong.

Changes

If this page changes in a way that matters, the date at the top changes and we will say so by email before it takes effect.