BoardFlow Project Data Agreement

Version project-data-v1 · Schedule 1 v1 · 4 October 2026. This agreement takes effect for the identified project when acceptance of this version is recorded. Schedule 1 is part of the agreement.

Who this agreement is between

BoardFlow (processor): Common Scene, the trading name of Carlos Montenegro, sole proprietor, KVK 96085819, Tuigerstraat 60, 1033 PH Amsterdam, the Netherlands. Contact: hello@commonscene.org.

You (controller): the person or legal entity identified when the project is created. If you contract personally, identify yourself clearly enough to establish who is entering the agreement; a production or trade name alone does not create a separate legal person. If a separate legal entity is the controller, identify it by its legal name and confirm your authority to bind it. Project ownership in the app does not by itself determine the legal controller.

In plain language: the controller is the producer who decides why and how the production uses personal information. BoardFlow is the processor that handles it on that producer’s instructions. Subprocessors are suppliers used for that work. These roles concern personal information; they do not transfer ownership of your film or script to BoardFlow.

The acceptance record identifies the verified account, controller, representative/authority where applicable, covered project, exact agreement and schedule versions, and acceptance time. This agreement applies to that project's production personal data (Project Data). An invited collaborator need not accept a separate producer agreement unless the contracting controller changes. Changing an owner or role in the app does not transfer this agreement or identify a replacement controller. Before processing on a replacement controller's behalf, BoardFlow must record its legal identity and authority and its acceptance of the applicable agreement and schedule. Any transfer of existing Project Data also requires the original controller's lawful documented instruction or other lawful authority.

This agreement supplements the Beta Terms and prevails over conflicting provisions concerning Project Data processing. The Privacy Notice is information, not an additional contract. BoardFlow separately acts as controller for its general accounts, sign-in email, website, beta administration and own service-security purposes. Project membership, permissions, project-visible names, recovery records and security processing undertaken on your behalf remain within this agreement. General account authentication does not become processing on your behalf merely because the account can access your project.

1. Scope and instructions

BoardFlow hosts, displays, edits, schedules, exports and recovers production-planning records on your behalf. Project Data may concern project users, cast, crew and other people deliberately included or incidentally identifiable in scripts/images, and comprise names, contact details, roles, likenesses/images, scripts, scenes, shots, notes, schedules, call sheets and project-specific access/recovery records.

Processing lasts while the project is provided, including read-only availability, followed by the return/deletion period in Schedule 1. Beta expiry alone does not end processing. You can instruct closure without waiting for expiry.

Your authorised app actions and written support/closure instructions are documented instructions within this scope. BoardFlow processes Project Data only on those instructions, including for transfers outside the EEA, unless Union or Member State law requires processing. In that case, BoardFlow informs you beforehand unless the law prohibits notice on important public-interest grounds. BoardFlow immediately tells you if it considers an instruction to infringe applicable data-protection law.

BoardFlow does not sell Project Data or use it for unrelated product improvement or AI-model training. You decide the production's lawful basis, provide required notices and manage access. Do not deliberately enter special-category or criminal-offence data without a separately agreed scope and safeguards. Ordinary scripts or images can incidentally reveal sensitive information; this restriction is not a claim of automatic detection or an exemption from security duties.

Within the separately accepted Beta Plan Limits, new image uploads are automatically resized and compressed for production-planning previews. This processing is part of the requested service, not an unrelated use of Project Data. Image returns contain all stored project files in their stored form; original-resolution preservation is not included. Reaching a plan allowance does not itself authorise deletion or remove the return, deletion or security duties in this agreement.

2. Confidentiality and security

BoardFlow limits access to authorised people who are committed to confidentiality or an appropriate statutory duty. It implements appropriate technical and organisational measures under GDPR Article 32, described in Schedule 1. Measures may evolve without materially reducing the overall protection.

The edit lease coordinates changes and is not a substitute for access control or backups. No bespoke uptime guarantee, unlimited support or additional content licence is created by this agreement.

3. Subprocessors and international transfers

You give general written authorisation for the Project Data subprocessors identified in Schedule 1, including their relevant onward suppliers. Before an addition or replacement, BoardFlow sends notice to your recorded, verified contact email at least 14 calendar days before the proposed provider processes your Project Data. The notice identifies the provider, its role, relevant locations and safeguards, and how to object on data-protection grounds. A shorter period requires your documented agreement and must still allow a meaningful opportunity to object. BoardFlow retains evidence of the notice; merely updating a web page does not replace it. This process also covers changes in the relevant onward supplier chain, not only BoardFlow's direct suppliers.

BoardFlow must maintain the relevant supplier-notification arrangements and promptly relay relevant notices. If the required notice and objection process cannot be completed before a supplier change takes effect, affected processing must stop before the new supplier receives Project Data. The parties will try to resolve an objection. An unresolved objection prevents the proposed subprocessor from processing the affected Project Data. If no compliant alternative is available, either party may end the affected service, with your choice of return or deletion under section 6. This process does not permit BoardFlow to introduce an unnotified subprocessor or remove a legally required safeguard.

BoardFlow imposes the data-protection duties required by Article 28 on each subprocessor and remains responsible for its performance as Article 28(4) requires. Transfers outside the EEA follow your documented instructions and applicable Chapter V safeguards, identified in Schedule 1. A European hosting region alone is not an EEA-only promise.

4. Assistance and personal-data breaches

Taking account of the processing's nature, BoardFlow assists through appropriate technical and organisational measures, insofar as possible, with your responses to data-subject requests. Taking account of that nature and the information available to it, BoardFlow also assists with duties under GDPR Articles 32–36, including security, breach notification, impact assessments and prior consultation. If it receives a request about Project Data, BoardFlow informs you without undue delay and does not independently decide the response unless authorised or required by law.

BoardFlow notifies you without undue delay after becoming aware of a personal-data breach affecting Project Data. It supplies available information about the nature of the breach, affected data/people, likely consequences and measures taken or proposed, with updates in stages where necessary. You decide and make the controller's required regulator or individual notifications. BoardFlow fulfils its own legal duties separately.

For exceptional assistance beyond ordinary service support, the parties may agree a reasonable fee in writing before that work begins. A fee, disagreement over it or lack of advance payment does not delay or prevent BoardFlow's mandatory duties, including necessary assistance and breach notification. This is not a charge to an individual for exercising their data-protection rights.

5. Evidence and audits

BoardFlow makes available information necessary to demonstrate compliance and allows and contributes to audits, including inspections, by you or your mandated auditor as Article 28(3)(h) requires.

Use existing evidence and remote review first where suitable. Coordinate necessary inspections with reasonable notice, confidentiality and appropriate security, limiting avoidable disruption. Urgent legal needs remain unaffected. Neither a process rule nor a commercial liability limit makes the statutory audit right ineffective.

6. Data return and deletion

When the processing ends, at your choice BoardFlow returns or deletes Project Data and deletes existing copies unless Union or Member State law requires retention. BoardFlow handles a verified closure instruction without undue delay, confirms the return/deletion sequence and explains any restriction or delay. This does not create a bespoke response-time service guarantee or extend a statutory deadline. A return includes current structured records, relevant recoverable history and all stored project image bytes, including unused images; expiring links do not replace the files. Expiry or suspension does not remove this choice. Operator-assisted return remains available where account access is unavailable, and agreed safeguards continue until closure is completed.

Schedule 1 sets out the delivery and deletion sequence for active records, recovery versions, provider copies and copies held by the operator. While removal or backup expiry is being completed, copies remain protected, unavailable for ordinary use and subject to deletion again if restored. BoardFlow identifies any legally required retention and its basis. A closure confirmation must distinguish deletion already completed from restricted copies still awaiting deletion; it must not describe a project as fully erased while a known copy remains.

BoardFlow's separate account, acceptance and security records follow their own disclosed retention bases; they are not a licence to retain production content after closure.

7. Changes and responsibility

Ordinary feature and protective security changes within the agreed scope and overall protection do not require a new acceptance. Proposed material changes to this agreement or its schedules are communicated in advance and require written agreement, including recorded electronic acceptance, except for subprocessor changes already covered by section 3's authorisation and objection process. If agreement cannot be reached, you may end processing under section 6. Posting a new page alone does not amend this agreement.

The Beta Terms' commercial limitations apply only insofar as lawful and consistent with this agreement. They do not remove mandatory GDPR duties, individuals' rights or legally non-excludable remedies. No general indemnity or bespoke service-level commitment is added.

Schedule 1 Processing details

This schedule forms part of the agreement and describes the service's processing arrangements. It does not grant an unlimited storage allowance or promise a separate backup service.

Parties and covered project

The acceptance record must identify the controller as an individual or legal entity, with the individual’s name or entity’s legal name as applicable; it also records any optional production label, authorised representative and capacity where applicable, verified contact email, covered project identifier, exact agreement and schedule versions, and acceptance time. The BoardFlow operator is identified above. Processing activities, people and data categories are those in section 1.

Security measures

The service uses the following measures, applied according to the processing risks:

• Individual verified-email accounts; permissions tied to authorised project membership and role.
• Server-side database read/write restrictions and private image storage rather than public project galleries. Privileged support access is limited to authorised processing, support and security needs; authorised people are subject to confidentiality.
• Encrypted network connections to the hosted service; supplier credentials used for privileged operations are not supplied to ordinary browser users.
• A project edit lease, save/reload controls and recoverable project versions to reduce conflicting edits and assist recovery. The lease is not an access-control substitute; versions do not contain every image file's bytes.
• Project-scoped exports and image downloads. A complete assisted return also includes relevant recoverable history and unused stored images.

BoardFlow assesses security, investigates reported incidents and reviews controls as the service changes. It must maintain risk-appropriate availability and recovery measures under Article 32. The beta does not include a guaranteed restore point, continuous off-site backup, or a fixed maximum period of lost work. User exports supplement, and do not replace, BoardFlow's legal duties.

Providers and transfers

The authorisation covers those suppliers only for the stated service roles and the relevant onward suppliers identified in the linked lists when acceptance is recorded. BoardFlow retains dated supplier-list evidence so the accepted authorisation can be identified. It does not authorise every supplier to receive every category of Project Data, or unrelated AI or product-development processing. Subsequent relevant supplier changes remain subject to section 3; a changed supplier web page alone does not amend the accepted authorisation. BoardFlow provides the applicable transfer safeguards on request, subject to necessary confidentiality protection. Where processing cannot comply with Chapter V, BoardFlow must not continue the affected transfer merely because a provider is listed here.

Supabase also provides general account authentication, and Resend delivers those sign-in emails, for BoardFlow's separate account-controller activities. The Privacy Notice describes their roles, locations and safeguards. Resend is not authorised by this schedule to receive your script, gallery or cast/crew records. Netlify's general website enquiries and optional-update processing is likewise described in the Privacy Notice; this schedule covers it only insofar as it processes Project Data for the stated delivery role.

Contacts and notices

BoardFlow contact: hello@commonscene.org. Controller contact: the verified email recorded with acceptance. Changes of contact must be recorded. Subprocessor additions/replacements follow section 3's 14-calendar-day notice and objection procedure.

Send rights requests, security concerns and closure instructions to hello@commonscene.org. Do not send a sign-in code or an unencrypted production archive. BoardFlow contacts the recorded controller without undue delay for a relevant breach or rights request and retains the minimum evidence needed to handle it. You should keep your contact email current. This schedule does not promise guaranteed email delivery or round-the-clock support.

Return and closure

1. Use Close project in Settings, or request assistance by email, identifying the project and whether you choose return followed by deletion or deletion only. BoardFlow checks the instruction, identity and authority proportionately. A submission acknowledgement is not a completed-deletion receipt. Closing one project must not delete another project or a shared user's account.
2. Save pending changes before starting closure. The app freezes new changes and settles active uploads before return or deletion. During a transition from older upload permissions, previously issued capabilities may need to expire first; the app shows any resulting delay. For return-first closure, download the complete ZIP containing structured current records, relevant recoverable history and every stored project image, including unused/nested images, in their stored form. Save and check the download, then explicitly confirm deletion. An encrypted package or other agreed secure channel is used for an assisted return. Self-service JSON and image downloads are useful working copies, but the JSON alone contains no image bytes and is not a complete history archive.
3. Once any requested return is confirmed as saved, the durable background worker ends ordinary project access and automatically deletes the active project records, recoverable versions and stored images due for deletion. A deletion-only instruction does not require an unwanted export. The process uses the Storage service to remove image objects, not only their database references.
4. BoardFlow also removes operator-held copies due for deletion and requests removal of relevant supplier-held copies. A residual recovery copy awaiting removal or scheduled expiry is isolated from normal use, retained only for that completion process or a specific legal requirement, and subject to deletion again if restored. BoardFlow explains its status and applicable expiry or removal arrangement to you; an unspecified backup lifetime is not permission for indefinite retention.
5. The closure receipt identifies the project, instruction, completed actions, remaining restricted copies and any specific lawful retention basis. BoardFlow follows up on outstanding removal; it does not certify complete erasure while known copies remain.

Requests are handled without undue delay, with timing and any constraints explained for the actual request. The app records the instruction and automates the complete self-service return and verified live-data deletion, with visible progress and automatic retry after interruptions. Assisted return remains available where self-service access or browser capacity is insufficient. Supplier/operator residual-copy review and removal may require operator assistance. This is not a promise of instant one-click erasure or a bespoke completion deadline. Statutory deadlines and the duties in section 6 remain unaffected. Minimal account/acceptance evidence and separately justified security records follow the Privacy Notice; they must not be used to retain the closed project's script or images as general legal evidence.