Privacy Policy Your data, handled with care

Dekupa is an AI assistant that turns a screenplay into a structured production breakdown. The service is operated by Dekupa, based in Türkiye.

For any privacy question, or to exercise your rights, contact us at [email protected]. We act as the data controller for the personal data described in this policy.

This policy applies to our website at dekupa.com (which collects a beta waitlist) and to the invite-only product at app.dekupa.com.

Dekupa is based in Türkiye, but we honour the rights of users in the EU, EEA and UK under the General Data Protection Regulation (GDPR) and the UK GDPR.

Where this policy refers to legal bases, data-subject rights, and international transfers, we apply GDPR standards regardless of where you are located.

Website and waitlist data: when you join our beta waitlist or contact us, we collect:
- your email address
- a marketing-consent flag (whether you agreed to receive marketing email)
- optional details you choose to provide: company name, project count, and a free-text message
- a hashed (one-way) IP address, plus UTM parameters, referrer, and user-agent string for security and basic attribution

This website data is stored in Cloudflare D1.

Product data (app.dekupa.com): when you use the invite-only product, we process:
- account information
- the screenplay files you upload (.fdx and .pdf)
- the production breakdowns generated from them

We rely on the following GDPR legal bases:

• To operate the waitlist and respond to enquiries — legal basis: legitimate interests (running and growing the service) and, where you submit a form, taking steps at your request.
• To send marketing email — legal basis: your consent. Marketing is double opt-in and you can withdraw consent at any time.
• To provide the product (process uploads, generate and store breakdowns, manage your account) — legal basis: performance of a contract with you, or our legitimate interest in delivering the service during the beta.
• To secure the service (the hashed IP, anti-bot challenges, abuse prevention) — legal basis: legitimate interests in protecting Dekupa and its users.
• To meet legal obligations where applicable — legal basis: legal obligation.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms.

To generate a breakdown, the text of your screenplay is sent to a third-party large-language-model (LLM) API. The AI produces a first draft of the breakdown, which you then edit and confirm.

To reduce exposure of sensitive details, we mask personally identifying details — such as character names and specific locations — on these AI calls. Masking reduces but does not entirely eliminate the screenplay content shared for processing, so we are being transparent about it here.

Your files and breakdowns are not used to train AI models, are not sold, and are not shared with third parties except the sub-processors listed below who help us run the service.

We use the following sub-processors to operate Dekupa:

• Cloudflare — hosting, the D1 database, the Turnstile anti-bot challenge, and cookieless Web Analytics.
• Resend — transactional email and opt-in marketing email.
• An LLM API provider — to generate breakdowns from screenplay text (with masking as described above).

These providers process data only on our instructions and under appropriate data-processing terms. We may update this list as the service evolves and will reflect changes here.

Your uploaded files and generated breakdowns are stored encrypted in the EU region.

Because Dekupa is operated from Türkiye and some sub-processors operate internationally, certain processing may involve transfers outside the EEA/UK. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision, so that your data continues to receive a comparable level of protection.

If you would like more detail on a specific transfer or safeguard, contact us at [email protected].

• Waitlist data is kept while we operate the waitlist and pursue the beta; you may ask us to delete it at any time.
• Marketing-consent records are kept while you are subscribed and for a reasonable period afterwards to evidence consent.
• Account, uploaded files, and breakdowns are kept while your account is active. If you close your account or ask us to delete your content, we will delete it within a reasonable period, subject to any limited retention required by law.

We do not claim that files are never stored — they are stored (encrypted in the EU) so the service can work. We retain them no longer than needed for the purposes above.

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data (the "right to be forgotten")
• Portability — receive your data in a structured, commonly used, machine-readable format
• Object to processing based on legitimate interests, and to opt out of marketing at any time
• Restrict processing in certain circumstances
• Withdraw consent at any time where we rely on consent (this does not affect prior processing)

To exercise any right, email [email protected]. We will respond within the timeframes required by law. You also have the right to lodge a complaint with your local data protection authority.

We take reasonable technical and organisational measures to protect your data, including encryption of stored files, hosting through established infrastructure providers, one-way hashing of IP addresses, and an anti-bot challenge on our forms.

No method of transmission or storage is completely secure, but we work to protect your data and to limit who can access it. If we become aware of a personal data breach that affects you, we will act in line with our legal obligations.

Dekupa is a professional tool intended for adults working in film and media production. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16 (or the applicable age of digital consent in your country).

If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.

As a beta product, this policy will evolve. We will update the date below and, for material changes, take reasonable steps to notify you.

For any privacy matter, contact [email protected].