Privacy Policy

1. Introduction

Bad Burrito Productions (“we,” “us,” or “our”) operates the website at badburrito.com and the Bad Burrito Studio platform (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our production management platform.

By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (stored as a secure hash — we never store plaintext passwords)
• Profile information such as your name and avatar
• Organization and role information

Google OAuth

If you sign in with Google or connect Google Drive / Gmail, we receive your Google email address, display name, and profile picture. We also receive OAuth tokens that allow us to access your Google Drive files and Gmail messages on your behalf. These tokens are encrypted at rest using AES-256-GCM encryption and can be revoked at any time from your account settings.

Contact Form

When you submit our contact form, we collect your name, email address, company name (optional), project type, and message. This information is used solely to respond to your inquiry.

Production Data

When using the Studio platform, you and your team may store production-related data including scripts, schedules, budgets, cast and crew information, location details, equipment records, contracts, video dailies, review annotations, and other project files. This data belongs to you and your organization.

SMS and Mobile Phone Numbers

For production operations, we may collect mobile phone numbers for cast, crew, vendors, and production contacts who agree to receive text messages related to an active production. These messages may include call sheet links, schedule updates, location details, parking or basecamp information, and receipt confirmations.

Mobile phone numbers collected for SMS notifications are used only to provide production-related communications requested or authorized by the production team. We do not sell, rent, or share mobile phone numbers with third parties for marketing or promotional purposes.

Automatically Collected Information

We use essential authentication cookies (Supabase session tokens) to keep you logged in. We do not use tracking cookies, analytics pixels, or third-party advertising trackers.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process payments and manage subscriptions
• Respond to your contact form submissions and support requests
• Send transactional emails such as call sheets, invitations, and password resets
• Provide AI-powered features such as script analysis and storyboard generation
• Improve and develop new features for the Service

4. Third-Party Services

We use the following third-party services to operate the platform. Each processes data only as necessary to provide their respective service:

• Supabase — Database hosting, authentication, and file storage
• Stripe — Payment processing and subscription billing
• Resend — Transactional email delivery
• Mux — Video encoding, playback, and review tools
• OpenAI — AI-powered script analysis and image generation
• Twilio — SMS delivery and phone verification for production operations
• Google APIs — Google Drive and Gmail integration (optional, user-initiated)
• Dropbox — Cloud file integration (optional, user-initiated)

We do not sell your personal information to any third party. Data shared with these services is limited to what is necessary to provide the functionality you use.

We do not share SMS opt-in records or mobile phone numbers with third parties for their own marketing purposes. SMS service providers process mobile numbers only as needed to deliver messages, verify phone numbers, maintain security, comply with carrier requirements, and provide delivery reporting.

5. SMS Notifications

Bad Burrito Studios production SMS notifications are used for operational production communications. Message frequency varies by production schedule and may increase during prep, shoot days, schedule changes, or wrap. Message and data rates may apply.

You can opt out of SMS notifications at any time by replying STOP. You can request help by replying HELP or contacting us at [email protected]. Additional SMS terms are available at www.badburrito.com/sms-terms.

6. Data Security

We implement industry-standard security measures to protect your data:

• All data is transmitted over HTTPS (TLS encryption in transit)
• Passwords are securely hashed and never stored in plaintext
• OAuth tokens are encrypted at rest using AES-256-GCM
• Row-level security policies restrict database access to authorized users
• Role-based access controls limit functionality by user permissions

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your account and production data for as long as your account is active. Contact form submissions are retained for up to 12 months. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it by law.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data
• Export your data in a portable format
• Withdraw consent for optional integrations (Google, Dropbox) at any time
• Opt out of non-essential communications

To exercise any of these rights, contact us at [email protected].

9. California Privacy Rights (CCPA)

If you are a California resident, you have the right to request disclosure of the categories of personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared. You also have the right to request deletion of your personal information. We do not sell personal information.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The “Last updated” date at the top of this page indicates when the policy was last revised.

12. Contact Us

This policy is reviewed annually and updated as needed. The next scheduled review is March 2027.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out: You may opt out of the “sale” of your personal information. We do not sell personal information as defined by the CCPA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at [email protected] or use the data export and erasure tools in your account settings. We will verify your identity before processing any request.

Cookie Policy

We use cookies and similar technologies to operate our platform. When you first visit, you can choose which categories of cookies to accept via our cookie consent banner.

• Necessary cookies: Required for authentication, security, and core functionality. Cannot be disabled.
• Analytics cookies: Help us understand how the platform is used (Cloudflare Web Analytics, page view tracking). You can opt out.
• Marketing cookies: Third-party advertising and conversion tracking. You can opt out. Currently not in active use.

You can update your cookie preferences at any time by clearing your browser’s local storage and refreshing the page, which will re-display the consent banner.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: [email protected]
• Location: Los Angeles, CA
• Website: www.badburrito.com