SetApka
Privacy policy
Effective from 10 October 2026 · Polski · Deutsch
We describe what personal data we process in the SetApka app, in the production panel (panel.setapka.pl) and on setapka.pl, who is responsible for it, why and for how long we keep it, and what rights you have.
1. Who is responsible for your data
Provider: Jacek Piotr Strzelecki, running a business as JPS FILM Jacek Strzelecki, ul. Chodkiewicza 33/1, 94-028 Łódź, Poland, tax ID (NIP) 727 265 72 84; e-mail for data matters: office@setapka.pl.
Roles depend on the type of data:
- Project content – call sheets, crew contacts, files, announcements and chat: the controller is the production that created the project and decides what it uploads and who sees it. The Provider is the processor under a data processing agreement (Annex 1 to the terms). For this data you can contact the production or us – we will forward your request.
- Chat groups – besides the general chat (the whole project crew) there are groups: official ones, visible to their members and to people with the PRO role, and private ones, visible only to their members – people with the PRO role cannot see them in the app. A report about a message in a private group goes only to the Provider.
- Accounts, security, billing, Base, Knowledge, support and e-mails from SetApka: the controller is the Provider.
2. What data, for what purpose and on what basis
| Activity | Data | Legal basis (GDPR) |
|---|---|---|
| Account and sign-in | name, account identifier; with an e-mail account – e-mail address and credentials handled by Firebase Authentication | Art. 6(1)(b) – the agreement to use SetApka |
| E-mail confirmation, welcome message, password reset | e-mail, name | Art. 6(1)(b) |
| Project content (on the production's instructions) | call sheet data, crew contacts, files, announcements, chat messages and photos | the basis is determined by the production as controller; we process on its instructions (Art. 28) |
| Automatic call sheet reading by AI | contents of the uploaded PDF (may include names, positions, phones, e-mails) | on the production's instructions (Art. 28) – see section 3 |
| Push notifications | notification token, language, project membership | Art. 6(1)(b) |
| Technical support | system and app version, notification status, time of last use (linked to project membership), call sheet reading history | Art. 6(1)(f) – legitimate interest: helping with support requests and running the service |
| Security, reports and moderation | the report, the reported content, account identifiers, server logs | Art. 6(1)(f) – security of the service and protection of users; Art. 6(1)(c) – to the extent an obligation follows from the law |
| Payments and invoices | company name, address, tax ID / VAT, e-mail and optionally phone of the payer, transaction data (no card data – handled by Stripe) | Art. 6(1)(b) – contract; Art. 6(1)(c) – tax law |
| Crew base profile, job posts, locations, messages after an inquiry | name, profile photo (optional), department, positions, cities, description, links (e.g. filmography, crew united), “I'm available” status, list of projects in SetApka (type, year, position; project name only with the production's consent), job post content, location descriptions and photos, messages | Art. 6(1)(b) – the Base service, which you use voluntarily |
| Company submission to the Companies directory in the Base | company details given in the submission (name, categories, cities, description, phone, e-mail, website) and the account e-mail of the person submitting | lit. b – listing in the directory at your request |
| Base invitation (at the production's request) | name, position and e-mail from the project's contact list, project name (only with the production's consent) | on the instructions of the production, which is the controller of this data (Art. 28) – we do not use it for any other purpose; the information required by Art. 14 is provided in the invitation itself; after you confirm, we run your profile on the Base terms (Art. 6(1)(b)) |
| News and offers by e-mail | Art. 6(1)(a) – consent (separate, unticked box before payment; not a condition of purchase) |
SetApka does not require special categories of data (e.g. health data). If the production includes them in a call sheet (e.g. dietary information), it is responsible for this as controller; they are visible only to project members. The app contains no analytics, advertising or tracking tools (e.g. Google Analytics, Crashlytics) and we do not sell data. In the company directory we count views and clicks of entries anonymously. On setapka.pl we count visits with Cloudflare Web Analytics – without cookies and without identifying or tracking people; we only see aggregate data (pages visited, referrer, country, device and browser type). Basis: Art. 6(1)(f) – legitimate interest in understanding interest in the website.
3. Artificial intelligence
- Reading call sheets: when a person with the PRO role uploads a call sheet, the whole PDF is sent from our server directly to the Claude API of Anthropic, PBC (USA); the original file stays in the project (Warsaw) and is deleted with it. The model returns structured data (scenes, times, contacts), which the production checks before publishing. Data sent through the API is not used to train models; Anthropic stores it under its commercial terms (by default up to 30 days; longer only if a breach of its usage policies is detected or where required by law) and processes it only to perform the request. Reading happens only on the production's instructions.
- Knowledge: to assess whether an article is industry-related we send only the titles and teasers of public articles to the Claude API – no user data.
- AI does not make decisions about you that produce legal effects.
4. Recipients and transfers outside the EEA
| Recipient | Role | Location and basis |
|---|---|---|
| Google Ireland Ltd. / Google LLC (Cloud Firestore, Cloud Storage, Cloud Functions) | database, files, server functions, backups | Warsaw (region europe-central2, EU) |
| Google LLC (Firebase Authentication, Cloud Messaging, Cloud Logging, Firebase Hosting) | sign-in, push notifications, technical server logs, serving website and panel files (no personal data) | Google's global infrastructure, including the USA – EU-US Data Privacy Framework |
| Anthropic, PBC (Claude API) | reading call sheets, assessing headlines in Knowledge | USA – standard contractual clauses in Anthropic's data processing agreement |
| Stripe Payments Europe Ltd. / Stripe, Inc. | payments (card, BLIK, Przelewy24) | Ireland (EU); USA – EU-US Data Privacy Framework |
| Cloudflare, Inc. | anonymous visit statistics for setapka.pl (no cookies) | USA – EU-US Data Privacy Framework |
| home.pl S.A. | e-mail office@setapka.pl (reports, messages from SetApka) | Poland (EU) |
| Apple Inc. / Google LLC | delivering notifications to phones | under their own terms; USA – EU-US Data Privacy Framework |
Project data is visible only to people who joined the project with its code; files in the Production folder – only to the project creator and people they authorise. Visible profiles, job posts, locations and the company directory in the Base can be viewed by all SetApka users; we do not expose them to search engines. Location photos and profile photos can be opened by anyone who has the link to the photo – the link contains a random key that cannot be guessed and is not published anywhere outside SetApka. At the request of competent authorities we may disclose data to the extent required by law.
5. SetApka support access
Only the Provider has access (personally; we currently employ no other people with access), through an owner panel protected by sign-in. Scope: list of projects, members and their roles, account e-mail addresses, payment status, call sheet reading history, device data, a view of the shooting day's times and scenes, and reported content. The panel does not show crew contacts, files or chat. We access such content only at the explicit request of the production (to the extent needed to handle it) or when handling a report of a breach. Every change made by support is recorded in a log (who, what, when) kept for 24 months.
6. How long we keep data
| Data | Period |
|---|---|
| Project (call sheets and their PDFs, AI reading results, files, contacts, announcements, chat, corrections, settings) | until the production deletes the project; a project with no activity at all for 24 months is deleted automatically – we notify the owner by e-mail 30 days before (opening the project is enough to keep it). Deletion covers all this data at once; afterwards only billing data, moderation reports and the support log remain (for the periods below), plus the backup – up to 7 days. |
| Account, membership, device data | until the account is deleted or you leave the project; device data – together with the membership |
| Your chat messages after account deletion | stay in the project (the production's data) but without your name – as “Deleted account” |
| Base profile (with photo), job posts, locations, conversations | until you delete them or your account; job posts expire after 30 days; you can remove the photo any time in “My profile” |
| Unconfirmed Base invitation | 60 days; “No, thanks” deletes the address immediately |
| Company submission | 12 months after submission; the directory entry – until the company asks us to remove it |
| Reports and moderation decisions | 12 months after handling |
| Technical server logs (account identifiers, errors, operation times – no call sheet content) | 30 days |
| Database backups | 7 days (the backup is overwritten continuously – deleted data disappears from it after 7 days at the latest) |
| Offline file copies on the phone | until sign-out, account deletion or leaving the project (deleted automatically) or uninstalling the app |
| Billing data and invoices | 5 years from the end of the tax year (tax law) |
| Marketing consent | until withdrawn |
| Copies held by the AI provider | as in section 3 (by default up to 30 days) |
We keep data longer only where necessary to establish, exercise or defend legal claims, and only to that extent.
7. Your rights and how to exercise them
- You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 6(1)(f)).
- You can withdraw consent (e.g. to marketing e-mails) at any time – via the “Unsubscribe” link in the message or by e-mail; this does not affect the lawfulness of earlier processing.
- Many rights you can exercise yourself in the app: editing and deleting your profile (Base → My profile), deleting your account (Menu → Delete account), leaving a project.
- Send other requests to office@setapka.pl – easiest from your account e-mail, but this is not a condition; if we have reasonable doubts about your identity, we will ask for additional information. We reply within one month (in complex cases this may be extended by two months – we will tell you if so). Requests about project content are forwarded to the production as controller.
- You have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in your EU country.
8. Security
Data in transit is encrypted (HTTPS/TLS). Only members have access to a project – enforced by database security rules checked on the server. We store the database and files in Warsaw, with backups allowing restoration of any state from the last 7 days.
In the event of a personal data breach concerning a project, we inform the production as controller without undue delay, no later than 48 hours after becoming aware of it, and provide the information needed to assess the breach and meet GDPR obligations. The production as controller assesses whether to notify the supervisory authority and the data subjects. For data we control ourselves, we meet the GDPR obligations on our own (including notifying the supervisory authority within 72 hours where required).
9. Changes to this policy
We announce material changes in the app or by e-mail before they take effect. This policy is available in Polish, English and German; in case of discrepancy the Polish version prevails.