PRIVACY POLICY
Version 2026-04-v1 — Effective: April 2026
The French version shall prevail in case of discrepancy.
Article 1 — Data controller
The data controller for personal data collected on the Arkana platform (arkana.film) is:
AD’eBe NETWORKS SIRET: 43266171800044 33 avenue Philippe Auguste, Paris, France Email: privacy@arkana.film
Article 2 — Data collected
The Platform collects the following categories of personal data:
2.1 Identification and contact data:
- Name, surname, company name
- Email address
- EU VAT identification number
- Postal address (if provided)
- Country
2.2 Order and billing data:
- Order history (number, date, amount, scenes ordered)
- Production declarations (project title, format, distribution type, director, broadcaster)
- GLT version accepted and consent timestamp
- Payment data (processed exclusively by Stripe — the Company never has access to credit card numbers)
2.3 Browsing and usage data:
- IP address
- Browser type and operating system
- Pages visited, scenes viewed, searches performed
- Date and time of access
2.4 Slate-related data:
- Scenes added to slates
- Annotations, notes and selections
- Sharing links generated
Article 3 — Legal basis and purposes
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Order processing and license delivery | Performance of contract (Art. 6.1.b) |
| Rights certificate and invoice generation | Performance of contract (Art. 6.1.b) |
| User account management | Performance of contract (Art. 6.1.b) |
| Order-related communications (confirmations, delivery, follow-up) | Performance of contract (Art. 6.1.b) |
| Accounting and tax obligations (invoice retention) | Legal obligation (Art. 6.1.c) |
| EU VAT number verification (VIES) | Legal obligation (Art. 6.1.c) |
| Platform improvement and usage statistics | Legitimate interest (Art. 6.1.f) |
| Fraud prevention and platform security | Legitimate interest (Art. 6.1.f) |
| Commercial communications (if consent given) | Consent (Art. 6.1.a) |
Article 4 — Data recipients
Personal data may be shared with the following categories of recipients:
4.1 Technical sub-processors:
| Sub-processor | Role | Legal entity and registered office | Server location | Safeguards |
|---|---|---|---|---|
| Stripe, Inc. | Payment and invoicing | Stripe, Inc. — 354 Oyster Point Blvd, South San Francisco, CA 94080, USA | United States | SCC + DPF certification |
| Render Services, Inc. | Application hosting (API, frontend, landing) | Render Services, Inc. — 525 Brannan Street, Suite 300, San Francisco, CA 94107, USA | Frankfurt, Germany (EU) | SCC + DPF certification (Jan. 2025) — EU servers, US entity |
| Neon, LLC | PostgreSQL database | Neon, LLC (affiliate of Databricks, Inc.) — United States | Frankfurt, Germany (EU) | SCC + DPF certification + SOC 2 Type 2 + ISO 27001 + ISO 27701 — EU servers, US entity |
| Brevo (Sendinblue) | Transactional emails | Sendinblue SAS — 106 boulevard Haussmann, 75008 Paris, France | France (EU) | EU hosting |
| Backblaze, Inc. | File storage (masters, certificate PDFs) | Backblaze, Inc. — 500 Ben Franklin Ct, San Mateo, CA 94401, USA | United States | SCC |
| BunnyWay d.o.o. | Video streaming (Bunny Stream) and thumbnails (Bunny Storage CDN) | BunnyWay, informacijske storitve d.o.o. — Dunajska cesta 165, 1000 Ljubljana, Slovenia | Slovenia + global CDN network (EU) | EU entity and headquarters — DPA available at bunny.net/gdpr |
| Cloudinary Ltd. | Image storage (legacy, being decommissioned) | Cloudinary Ltd. — 111 W Evelyn Ave, Suite 206, Sunnyvale, CA 94086, USA (EU subsidiary: Ireland) | Ireland (EU) | SCC — data hosted in EU |
4.2 Rights Owners: Licensee data (name, email, company, declared production) may be shared with the Rights Owner whose scenes are part of the order, to the extent strictly necessary for the performance of the license agreement (credit verification, monitoring of authorized uses).
4.3 Authorities: Data may be disclosed to competent authorities upon judicial request or where required by law.
Article 5 — Transfers outside the European Union
Certain sub-processors (Stripe, Backblaze, Cloudinary) are established in the United States. Render and Neon are also US entities, but the servers used by Arkana are located in Frankfurt, Germany (EU). These transfers are governed by:
- Standard Contractual Clauses adopted by the European Commission (Decision 2021/914);
- certification under the EU-U.S. Data Privacy Framework (Render certified since January 2025, Neon certified under the DPF).
BunnyWay d.o.o. (Bunny Stream, Bunny Storage CDN) is a Slovenian entity — no transfers outside the EU.
Users may obtain a copy of the appropriate safeguards by writing to privacy@arkana.film.
Article 6 — Data retention periods
| Data category | Retention period |
|---|---|
| Account data (name, email, company) | Duration of commercial relationship + 3 years from last activity |
| Order data and rights certificates | 10 years (accounting and tax obligations — Art. L.123-22 French Commercial Code) |
| Billing data | 10 years |
| GLT accepted (version + timestamp) | Duration of the license granted (perpetual if applicable) + 5 years |
| Browsing data (logs, IP) | 13 months (CNIL recommendation) |
| Slate data (slates, annotations) | Duration of commercial relationship + 3 years |
| Deleted account (GDPR request) | Immediate deletion of personal data, anonymization of accounting data |
Article 7 — Data subject rights
In accordance with the GDPR, you have the following rights:
7.1 Right of access (Art. 15) — obtain confirmation that your data is being processed and receive a copy.
7.2 Right to rectification (Art. 16) — correct inaccurate or incomplete data.
7.3 Right to erasure (Art. 17) — request deletion of your data, subject to legal retention obligations. The Platform provides a self-service account deletion feature.
7.4 Right to restriction of processing (Art. 18) — request restriction of processing in the cases provided by the GDPR.
7.5 Right to data portability (Art. 20) — receive your data in a structured, commonly used and machine-readable format.
7.6 Right to object (Art. 21) — object to processing based on legitimate interest, including profiling.
7.7 Right to withdraw consent — withdraw your consent at any time for processing based on consent, without affecting the lawfulness of prior processing.
7.8 Post-mortem instructions — under French law, you may define instructions regarding the retention, erasure and communication of your data after your death.
To exercise these rights, send your request to: privacy@arkana.film
We will respond within one month. This period may be extended by two months for complex requests, in which case you will be informed.
Article 8 — Complaint to the supervisory authority
If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the French data protection authority (CNIL):
CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 www.cnil.fr
For residents outside France, you may also contact your local supervisory authority.
Article 9 — Cookies and trackers
9.1 The Platform uses strictly necessary cookies for the operation of the service (authentication, language preferences, session). These cookies do not require consent.
9.2 The Platform does not use advertising cookies or profiling trackers.
9.3 The Platform does not use any third-party analytics solution (no Google Analytics or equivalent). Usage statistics are computed from the Platform’s internal data without third-party trackers.
Article 10 — Data security
The Company implements appropriate technical and organizational measures to ensure the security and confidentiality of personal data, including:
- encrypted communications (HTTPS/TLS);
- encryption of data at rest (database);
- JWT authentication with time-limited tokens;
- password hashing (bcrypt);
- role-based access control (admin, operator, researcher, producer);
- access logging;
- automated database backups.
Article 11 — Policy changes
The Company reserves the right to amend this privacy policy. Any material change will be notified to users by email or by a visible notice on the Platform. The current version is available at all times at arkana.film/privacy.
Article 12 — Contact
For any questions about this policy or your personal data:
Email: privacy@arkana.film Mail: AD’eBe NETWORKS — 33 avenue Philippe Auguste, Paris, France
AD’eBe NETWORKS — arkana.film