Can I Shoot This? Privacy Notice

Version: 2026-09-01-v2. Last updated: 1 September 2026.

Service provider: BH Film Festival C.I.C., trading through Bournemouth International Film Festival and the Can I Shoot This? production planner.

Company number: 16356219.

Registered office: 7 Acland Road, Bournemouth, BH9 1JQ.

Support: support@bournemouthfilmfest.co.uk.

This notice explains how BH Film Festival C.I.C. handles personal data when you use Can I Shoot This?. For privacy enquiries contact privacy@bournemouthfilmfest.co.uk.

1. The information we collect

Account details such as name, email address, account status and password-security data.
Purchase and entitlement records, including Stripe customer, subscription, checkout and payment-reference data. CIST does not store full card details.
Screenplays, project information, production assumptions, questionnaire answers and corrections you provide.
Generated screenplay breakdowns, schedules, budgets, feasibility information and production-pack outputs.
Operational records such as consent versions, queue status, security/rate-limit events, transactional-email status and support or cancellation requests.

2. Why we use it and our lawful bases

Contract: to create and secure your account, take payment, analyse your screenplay, build your project and provide ongoing access to purchased projects.
Legal obligation: to retain records where accounting, tax, consumer or other law requires us to do so.
Legitimate interests: to secure the service, prevent misuse, diagnose failures, maintain audit trails, improve operational reliability and handle complaints, where those interests are not overridden by your rights.

Transactional emails such as account verification, password reset, payment/contract confirmation, queue status and analysis-ready messages are service communications rather than marketing.

3. Screenplay processing and OpenAI

CIST sends screenplay content and necessary structured instructions to the OpenAI API to produce the initial screenplay interpretation. OpenAI is a service provider used for this processing. OpenAI currently states that API inputs and outputs are not used to train its models by default unless the API organisation owner explicitly opts in to data sharing. CIST's intended production configuration is not to opt screenplay traffic into model training.

OpenAI also states that, except for eligible zero-data-retention configurations and certain features, API inputs and outputs may be retained for up to 30 days for service provision and abuse monitoring, unless longer retention is legally required. OpenAI's policies and technical controls may change, so this notice will be reviewed when the service configuration changes.

4. Other service providers

We use service providers including our website/hosting infrastructure, Stripe for payment processing, OpenAI for screenplay interpretation and email infrastructure for transactional messages. They process data only for their respective functions and under their applicable contractual and privacy terms.

Some providers may process information outside the UK. Where UK personal data is transferred internationally, we rely on applicable legal and contractual safeguards provided for those transfers.

5. How long we keep information

Source screenplay PDF: the normal CIST configuration deletes the source PDF from CIST private storage after successful analysis. If analysis has not completed, the file may remain while processing or support work is required.
Project and generated planning data: retained while needed to provide the purchased project access. Existing project access is designed to survive the end of Membership. You may ask us to delete personal data, subject to legal retention requirements and the consequences for project access.
Transactional email diagnostics: operational mail logs are pruned after approximately 90 days and do not store email bodies or full recipient addresses.
Financial, contract and audit records: retained for up to six years from the end of the relevant company financial year, or longer where law, tax enquiries or legal claims require it.
OpenAI API data: subject to OpenAI's applicable API retention settings and policies, currently up to 30 days for standard API processing unless a different eligible retention control applies.

6. Automated processing

CIST uses automated systems to interpret a screenplay and generate production-planning material. It does not use that automation to make a solely automated decision about you that has legal or similarly significant effects. You review and confirm screenplay interpretations, and production decisions remain yours.

7. Security

CIST uses server-side access controls, project ownership checks, private screenplay storage, CSRF protection, rate limiting, API-key isolation, signed Stripe webhooks and other technical controls. No internet service can guarantee absolute security, but we take proportionate steps to protect customer accounts and projects.

8. Your data-protection rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict, object to or obtain a copy of personal data. Some rights are subject to exemptions and legal retention duties. Contact privacy@bournemouthfilmfest.co.uk to make a request.

You can also complain to the UK Information Commissioner's Office if you are unhappy with how personal data has been handled.

9. Screenplay confidentiality and rights

Your screenplay remains your material. We process it to provide CIST. We do not claim ownership of your screenplay and do not use it for marketing or publication without separate permission.

10. Changes to this notice

We will update this notice when our processing, providers or legal obligations materially change. CIST stores the privacy-policy version accepted by a customer for each recorded consent snapshot.