Privacy Policy

Plain-English summary

klieg is a movie + TV tracking and recommendation service. To do its job, it has to store the things you tell it: what you’ve watched, how you rated them, the lists you curate, the friends you connect with. We try to keep what we collect to the minimum needed for the product to work and to never sell or share your data for advertising.

We use a small number of trusted services to run the platform — listed in full below. Most are in the UK or EU; where data leaves the UK/EEA, we use the safeguards required by UK GDPR. You can export, correct, or delete your data at any time from /settings/account or by emailing us.

1. Who we are

klieg is operated by Ajay Patel, a sole trader registered in the United Kingdom, trading as “klieg”. Our correspondence address is Suite RA01, 195-197 Wood Street, London, E17 3NU. We are registered with the UK Information Commissioner’s Office under reference ZC166417.

For any privacy question, request, or complaint, email privacy@klieg.app. We aim to respond within five working days.

2. What we collect, and why

We process the categories of personal data below for the purposes shown.

3. Where your data is stored

Your account, diary, lists, and taste data are stored in the European Union on infrastructure provided by Supabase (PostgreSQL). The application is hosted by Vercel, which serves your requests from edge locations near you (typically the United Kingdom or Ireland for UK/EU users).

Some processing happens on services located in the United States — specifically AI recommendation generation (Anthropic), taste analysis (Voyage AI), payment processing (Stripe), and transactional email (Resend). Where data leaves the UK or EEA, we rely on the European Commission’s Standard Contractual Clauses + UK Addendum as the legal safeguard, and on each provider’s certification under the EU-US Data Privacy Framework where available.

4. Who else processes your data

We use the following subprocessors. Each plays a specific role and only receives the data needed for that role.

We update this list whenever we change providers. Material changes are notified by email or via a banner on the site.

5. How long we keep your data

• Account, diary, lists, taste data: for as long as your account is open. When you delete your account, we delete this data within 30 days, except where we have a specific legal obligation to retain (see below).
• Billing records: retained for six years after the transaction, as required by HMRC for VAT and accounting purposes.
• Error logs: 90 days, then automatically purged.
• Analytics events: 12 months, then automatically purged. You can opt out at any time via the cookie banner.
• Stripe webhook event log: 30 days, used only for replay-protection and reconciliation.

6. Your rights

Under UK GDPR you have the following rights. To exercise any, email privacy@klieg.app. We will respond within one month; we may extend by two further months for complex requests but will tell you if we do.

• Access: ask for a copy of the personal data we hold about you. Many parts are available self-serve from /settings/account.
• Rectification: ask us to correct inaccurate or incomplete data. Most fields are self-editable from /settings/profile.
• Erasure: ask us to delete your data. Self-serve via /settings/account → Delete my account.
• Restriction: ask us to limit processing while a dispute is resolved.
• Portability: receive your data in a structured, machine-readable format. Self-serve via /settings/account → Export my data.
• Objection: object to processing based on legitimate interests (e.g. error logging, security).
• Withdraw consent: for analytics, change your choice via the cookie banner at the bottom of any page. Withdrawal does not affect prior lawful processing.
• Complain to the ICO:if you believe we have mishandled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We’d appreciate the chance to fix it first by emailing us, but you do not have to.

7. How we protect your data

• All connections to klieg use HTTPS / TLS 1.2 or better.
• Passwords are never stored — Supabase Auth uses bcrypt-style password hashing with per-user salts.
• Database access is gated by Row-Level Security so that even in the event of an application-layer vulnerability, users cannot read each other’s data via the public API.
• The Stripe payment integration uses signed webhooks and replay-protected idempotency keys; we never see your full card number.
• Backups are encrypted at rest and retained according to our provider’s policy (currently 7-day point-in-time recovery + daily snapshots).

8. Children

klieg is not intended for children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has signed up, email privacy@klieg.app and we will delete the account.

9. Cookies + tracking technologies

klieg uses a small number of cookies and similar technologies. The breakdown — what each is, how long it lasts, and how to opt out of the non-essential ones — is on the separate Cookie Policy page.

10. Profiling + automated decision-making

We generate recommendations using your watch history and taste. This is a form of profiling, but it does not have a legal or similarly significant effect on you — it influences which films and TV shows appear in your recommendations. You can stop receiving personalised recommendations at any time by deleting your account; you can also correct the underlying signal by changing your ratings or thumbing recommendations down.

11. Changes to this policy

We may update this policy as the service evolves or the law changes. If a change materially affects how we handle your data, we will tell you by email before it takes effect. The “Last updated” date at the top of the page is always current.

12. Contact

Privacy questions: privacy@klieg.app
General support: support@klieg.app
Post: Suite RA01, 195-197 Wood Street, London, E17 3NU