Privacy Policy

Name, email address, profile photo, organisation name, role within organisation, job title (optional), account creation date, and last-active timestamp.

Audio and picture files uploaded to the Service; project metadata including cue names, timecodes, reel/episode structure, delivery notes, and version history; chat messages, @mentions, and cue thread comments; review feedback; and delivery and approval history. This content may itself contain personal data of third parties, for which you are the controller (see Section 1). We do not use customer content to train artificial-intelligence or machine-learning models.

Billing name and address, country, subscription plan, payment-method type (last 4 digits only), transaction history, and invoice records. Full card details are processed exclusively by Stripe — we never receive or store raw card numbers or CVVs.

Device type, operating-system and app version, features accessed, session duration, and error or diagnostic reports. Our hosting, security, and (where you consent) analytics providers process your IP address transiently to deliver, secure, and monitor the Service. We do not store your IP address in our own application database; limited abuse-prevention records may contain a non-reversible (hashed) representation of an IP address or similar identifier, which cannot be read back to the original value. If the Conduct desktop app crashes, it sends a native crash report to Sentry. A crash report can contain parts of the app's memory at the moment of the crash, which may include whatever the app was handling then. We use crash reports only to find and fix crashes. To keep automated abuse away from our sign-in, sign-up and password-reset forms, those forms run Cloudflare Turnstile, an invisible bot check that processes technical signals from your browser or the desktop app (such as IP address and browser characteristics) under Cloudflare's Turnstile Privacy Addendum (cloudflare.com/turnstile-privacy-policy); it does not use advertising cookies.

Support tickets and responses, and any feedback or survey submissions you choose to send us.

When you select a local workspace, external drive, or Dropbox File Provider folder in the desktop app, master files normally remain in the location you selected and are accessed through macOS file permissions. In Dropbox mode, Conduct is not acting as a Dropbox OAuth client: Dropbox sync is provided by the local Dropbox File Provider. Conduct may upload a compressed preview and project metadata to its cloud so authorised collaborators and reviewers can use web features. The selected provider remains responsible for its own local and cloud synchronization.

Right of access (Art. 15) — request a copy of all personal data we hold about you. Right to rectification (Art. 16) — correct inaccurate or incomplete data. Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten"). Right to data portability (Art. 20) — receive your data in a structured, machine-readable format. Right to restriction (Art. 18) — pause processing while a dispute is resolved. Right to object (Art. 21) — object to processing based on legitimate interests, including direct marketing. Right to withdraw consent (Art. 7.3) — where processing is based on consent, withdraw it at any time without affecting prior processing.

If you are a California resident, you have the right to know what personal information we collect and how it is used; to access and delete it; to correct inaccurate information; to opt out of the sale or sharing of personal information; and to limit the use of sensitive personal information. We do not sell or share your personal information and we do not use it for cross-context behavioural advertising. We honour the Global Privacy Control (GPC) browser signal as a valid opt-out. You will not be discriminated against for exercising these rights.

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another U.S. state with a comprehensive privacy law, you generally have the right to confirm whether we process your personal data and to access it; to correct it; to delete it; to obtain a portable copy; and to opt out of the sale of personal data, targeted advertising, and certain profiling (we do not engage in these activities). Where required, we recognise universal opt-out mechanisms such as the Global Privacy Control. If we decline a request, you may appeal by replying to our decision or emailing us; we will respond to appeals within the period your state's law requires.

If you are in a supported Canadian province, you may request access to and correction of your personal information and may withdraw consent subject to lawful and contractual limits. Conduct is not offered to residents of Québec at this launch. Québec availability requires French legal documents and the applicable privacy assessments; checkout blocks Québec addresses.

Open Settings → Privacy in the Conduct app for self-serve consent toggles, processing-restriction toggle, rectification form, objection to legitimate-interests processing, and request submission. Self-serve actions are recorded immediately to an immutable audit trail and placed in the staff queue. You may also email privacy@conductstudio.com; both routes use the same rights-request workflow.

We aim to acknowledge requests within 72 hours and respond within the period required by applicable law, including one month under the GDPR and the applicable period under U.S. state law. We may need to verify your identity before processing your request, particularly when the change affects identity-bearing fields (email, billing identity). We will not discriminate against you for exercising your rights.

When you exercise the right to data portability, your archive ships as JSON Lines (one record per line) accompanied by JSON Schema draft-2020-12 definitions for each category — the GDPR Article 20 "structured, commonly used, machine-readable" format. A SHA-256 of each file is included for tamper-evidence.

EU residents may lodge a complaint with the AEPD — Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid (www.aepd.es) — or their local supervisory authority. UK residents may contact the ICO (ico.org.uk).