1. Data Controller

The data controller responsible for your personal data is EndCreditsPro, domiciled in Spain. For any data protection matter, you can contact us at hello@endcredits.pro.

2. Data We Collect

Account data

When you register for EndCreditsPro, we collect:

Email address
Name (if provided)
Password (stored in hashed form — we never store your plain-text password)

Waitlist data

If you join our waitlist, we collect your email address so we can tell you when EndCreditsPro becomes available. If you have also accepted analytics cookies, we attach that email address to your analytics profile in PostHog (see section 5), so that we can understand which pages led you to sign up and, if you later create an account, connect your website visits to it. Without analytics consent, your email address is not sent to PostHog.

Usage data

We automatically collect information about how you use the website and the service:

Pages visited, links and buttons clicked, and features used
Browser type, operating system, device type, screen size and language
Approximate location (country/city), derived from your IP address at the moment of collection. PostHog is configured to discard the IP address itself; Google Analytics does not store full IP addresses
Referring URL, time zone and session duration
If you have accepted analytics cookies: recordings of your sessions (see "Session recording" in section 5)

Before any analytics data is sent, we remove sensitive parameters from web addresses (for example access tokens, authorisation codes and email addresses).

Communications

If you contact us by email, we retain a record of that correspondence.

3. How We Use Your Data

We use your data to:

Create and manage your account
Provide the EndCreditsPro service
Send essential service communications (account confirmations, important updates)
Analyse how the service is used in order to improve it
Comply with our legal obligations

We do not use your data for advertising, and we do not sell your personal data to third parties.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract performance — processing necessary to provide the service you have signed up for (Art. 6(1)(b) GDPR)
Legitimate interests — aggregate, cookieless visit counting to improve the service, which stores nothing on your device and does not identify you (Art. 6(1)(f) GDPR)
Legal obligation — where required by applicable law (Art. 6(1)(c) GDPR)
Consent — for analytics cookies, similar browser storage and session recording, where you have given consent or, outside the EU, have not opted out (Art. 6(1)(a) GDPR)

5. Third-Party Services

PostHog (product analytics)

We use PostHog (PostHog Inc.) to understand how visitors use our website and app, for example which pages lead people to join the waitlist or where they get stuck. PostHog acts as our data processor. We use PostHog's EU Cloud, so analytics data is stored on servers in the European Union. PostHog is configured to discard your IP address after deriving an approximate location from it.

What PostHog collects depends on your choice:

With your consent — PostHog sets first-party cookies (named ph_*) on the endcredits.pro domain and uses your browser's local storage to recognise you across visits, and to link your website visits with your use of the app at app.endcredits.pro if you sign up. It records page views, clicks and the events described above, and may record your session (see below).
Before you decide, or if you reject — PostHog runs in cookieless mode: nothing is stored on your device, no session is recorded and no profile is created. Page views and events are counted using an anonymous identifier that PostHog's servers compute from a hash of your IP address, browser and our site, combined with a secret value that changes every day. This lets us count unique visitors per day without being able to recognise you on later days.

Session recording

If you accept analytics cookies, PostHog may record how you interact with our pages (mouse movement, clicks, scrolling and page changes) so that we can find and fix usability problems. Recordings reconstruct the page rather than capturing video of your screen. Everything you type into form fields, such as your email address, is masked in the recording and never captured. In the app, credits content (for example, the names in a production's credits) is also masked. Sessions are never recorded without your consent.

Google Analytics

We use Google Analytics (Google LLC) to understand how visitors use our website. Google Analytics runs in Consent Mode: it sets cookies on your device only if you have consented (see section 6). Without consent it sets no cookies and only sends cookieless, aggregated signals. Usage data is sent to Google servers, which may be located in the United States. We have enabled IP anonymisation so your full IP address is never stored by Google. Google is certified under the EU–US Data Privacy Framework. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

For more information on how Google uses data, see Google's Privacy Policy.

6. Your Privacy Choices

Visitors in the European Union and nearby regions — we show a banner asking you to accept or reject analytics cookies. Until you choose, we treat you as if you had rejected them. Rejecting is as easy as accepting, and you can use the website either way. We work out whether to show the banner from your browser's time zone. If we cannot tell, we show it.
Visitors elsewhere — analytics cookies are enabled by default, and you can turn them off at any time.
Global Privacy Control — if your browser sends a Global Privacy Control (GPC) signal, we treat it as a rejection of analytics cookies, wherever you are.
Changing your mind — use the Privacy choices link in the footer of every page (or ). If you withdraw consent, we delete the PostHog cookies and storage on your device and switch back to cookieless counting.

Your choice is stored in a cookie named ecp_consent on the endcredits.pro domain for 180 days, so it applies to both the website and the app. See our Cookie Policy for the full list of cookies.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (for example, for accounting or legal compliance purposes).

If you join the waitlist, we keep your email address until the service launches and you have been invited, or until you ask us to remove it.

PostHog analytics events and session recordings are kept for the retention period of our PostHog plan (currently up to one year for events and up to 30 days for session recordings) and are then deleted. Anonymised, aggregated analytics data (which cannot identify you) may be retained indefinitely for service improvement purposes.

8. International Transfers

PostHog analytics data is stored in the European Union (PostHog EU Cloud). PostHog Inc. is a US company, so limited access from outside the EEA (for example, by its support staff) may occur under the Standard Contractual Clauses in PostHog's data processing agreement.

Google Analytics data may be transferred to and processed in the United States. Such transfers are subject to appropriate safeguards under GDPR, including Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable.

9. Your Rights

Under GDPR and Spanish data protection law (LOPDGDD), you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — request correction of inaccurate or incomplete data
Erasure — request deletion of your personal data ("right to be forgotten")
Restriction — request that we restrict processing of your data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at hello@endcredits.pro. We will respond within 30 days. If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish data protection authority:

Agencia Española de Protección de Datos (AEPD)
www.aepd.es

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Passwords are stored using industry-standard hashing algorithms. Access to personal data is restricted to personnel who need it to provide the service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page. Continued use of the service after any changes constitutes acceptance of the updated policy.

12. Contact

For any questions about this Privacy Policy or how we handle your data, contact us at hello@endcredits.pro.