Privacy Policy

1. Introduction

SageMaster Corporation (“SageMaster,” “we,” “us,” or “our”) operates SceneMate, an AI-powered rehearsal platform for actors (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our website, mobile applications, and related services. By using SceneMate, you consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you register, we collect your email address, username, full name (optional), and authentication credentials managed through Firebase Authentication (including Google Sign-In and Apple Sign-In).
• Script Content: Scripts you upload (PDF, DOCX, TXT, FDX) are encrypted using AES-256-GCM envelope encryption before storage. We process script text solely to provide parsing, rehearsal, and AI coaching features.
• Rehearsal Data: Line attempts, accuracy scores, session history, coaching feedback, and progress analytics generated during your use of the Service.
• Self-Tape Recordings: Video recordings you voluntarily create and upload through our self-tape feature.
• Chat Messages: Messages exchanged with our AI script study assistant are stored to provide conversation continuity.
• Payment Information: Billing is processed by Stripe (web) and Apple In-App Purchases (iOS). We do not store credit card numbers. We retain Stripe customer IDs, subscription IDs, and Apple transaction identifiers for account management.

2.2 Information Collected Automatically

• Usage Data: Feature usage patterns, session durations, pages visited, and interaction events.
• Device Information: Device type, operating system, browser type, screen resolution, and unique device identifiers.
• Log Data: IP addresses, access timestamps, referring URLs, and error logs for security and debugging purposes.
• Firebase Analytics: We use Firebase services which may collect analytics data in accordance with Google’s privacy practices.

2.3 Information from Third Parties

• OAuth Providers: If you sign in with Google or Apple, we receive your email address and basic profile information as authorized by you.
• Payment Processors: Stripe and Apple provide us with transaction confirmations, subscription status, and billing event notifications.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service;
• Process script uploads, parsing, and AI-assisted rehearsal features;
• Generate personalized coaching, scoring, progress analytics, and beat analysis;
• Facilitate AI text-to-speech synthesis for rehearsal partner lines;
• Process payments, manage subscriptions, and administer free trials;
• Enable script sharing and team collaboration features;
• Send transactional communications (account verification, password resets, billing receipts);
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues;
• Comply with legal obligations and enforce our Terms & Conditions;
• Aggregate and anonymize data for internal analytics and service improvement.

4. AI and Third-Party Processing

SceneMate uses third-party AI services to deliver core features. When you use these features, relevant data is transmitted to the following providers:

• OpenAI: Dialogue text for coaching summaries, emotional cues, partial cues, and line hints. No personally identifiable information beyond script dialogue text is sent.
• Google Gemini: Script text for LLM-based extraction during parsing, scene beat analysis, and chat study assistant responses.
• ElevenLabs: Dialogue text for text-to-speech audio synthesis. Only the line text and selected voice configuration are transmitted.

These providers process data under their own privacy policies and terms. We do not send your personal account information (name, email, payment details) to these AI providers. We contractually require that these providers do not use your content to train their models where such contractual protections are available.

5. Data Security

• Encryption at Rest: All uploaded scripts are encrypted using AES-256-GCM envelope encryption with keys managed through Google Cloud KMS (hardware security module-backed) before storage in Firebase Storage. Only encrypted ciphertext is stored.
• Encryption in Transit: All data transmitted between your device and our servers uses TLS 1.2 or higher.
• Authentication: We use Firebase Authentication with secure token-based verification. Passwords are never transmitted to or stored on our backend servers.
• Access Controls: Backend services verify Firebase ID tokens on every request. Users can only access their own data or data explicitly shared with them.

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

• Active Accounts: We retain your data for as long as your account is active or as needed to provide the Service.
• Account Deletion: When you delete your account, we permanently delete all associated data including scripts, encrypted files, characters, scenes, dialogue lines, shares, rehearsal sessions, line attempts, chat messages, self-tapes, subscription records, and your Firebase Authentication user record.
• Billing Records: Certain transaction records may be retained as required by tax and accounting regulations, even after account deletion.
• Backups: Data may persist in encrypted backups for a limited period after deletion, after which it is permanently purged.

7. Data Sharing and Disclosure

We do not sell your personal information. We may share data in the following circumstances:

• Service Providers: With trusted third parties who assist in operating the Service (Firebase/Google Cloud, Stripe, OpenAI, ElevenLabs), subject to confidentiality obligations.
• Script Sharing: When you share a script with another user, the recipient can view the script content and associated metadata. You control who has access.
• Team Plans: Team administrators can view team member status and manage team membership. They cannot access individual members’ script content or rehearsal data.
• Legal Requirements: When required by law, regulation, legal process, or governmental request; to enforce our Terms & Conditions; to protect the rights, property, or safety of SageMaster, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as a business asset, subject to the successor entity honoring this Privacy Policy.

8. Your Rights and Choices

• Access and Portability: You can access your scripts, rehearsal data, and progress analytics through the Service at any time.
• Correction: You can update your profile information (username, full name) through the profile settings.
• Deletion: You can delete your account and all associated data at any time through the profile page. This action is irreversible.
• Subscription Management: You can manage, cancel, or modify your subscription through the billing portal (Stripe) or through iOS Settings (Apple subscriptions).
• OAuth Revocation: You can revoke Google or Apple sign-in access through those platforms’ account settings.

For residents of the European Economic Area (EEA), United Kingdom, or California, additional rights may apply including the right to object to processing, data portability requests, and the right to lodge a complaint with a supervisory authority. Contact us to exercise these rights.

9. Children’s Privacy

SceneMate is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without parental consent, we will take steps to delete that information promptly. If you believe we have collected information from a child under 16, please contact us immediately.

10. International Data Transfers

Your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws different from your country of residence. By using the Service, you consent to the transfer of your information to these jurisdictions. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy.

11. Cookies and Tracking Technologies

Our web application may use cookies and similar technologies for authentication session management (Firebase Auth tokens), remembering preferences, and analytics. You can control cookie settings through your browser. Disabling cookies may impair certain features of the Service, particularly authentication.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised “Last updated” date. For significant changes, we may also provide notice through the Service or via email. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: