Reading notes
This page describes data handling based on the current product implementation. Check your NDA and production authorizations first. ScheduMing has disabled sharing API inputs and outputs with OpenAI for model training or improvement. Response storage is disabled; security-monitoring retention remains subject to applicable provider policies.
Privacy at a Glance
- You retain ownership of your scripts and project content. Account and project permissions control access to the workspace; this does not mean that only you can decrypt its content.
- Newly uploaded script PDFs use Supabase private storage. Reading links usually expire after 5 minutes. Authorized members, anyone holding an unexpired link, and personnel with infrastructure access may obtain the content.
- When you use AI analysis, script text and the scene information needed for analysis are sent through the Supabase backend to the OpenAI API (GPT-6 Luna). ScheduMing has disabled sharing API inputs and outputs with OpenAI for model training or improvement. Requests use store:false to disable response storage; security-monitoring retention remains subject to applicable provider policies.
- Deleting a project removes the workspace project and its cloud project record. Associated files, AI processing records, copies on other devices and provider backups are not guaranteed to be removed at the same time. Contact support for comprehensive deletion.
- Account deletion is currently handled through email requests, without a complete self-service deletion process. Canceling a subscription, signing out and deleting an account are separate actions.
Information We Collect
- Account information: email address, display name, avatar, login provider, sessions, preferences, plan and subscription status.
- Production information: scripts, scenes, dialogue, cast and crew, contact details, locations, shooting schedules, call sheets, notes, reports, collaboration changes and attachments that you enter or import.
- Operational information: IP addresses, browser and request information, errors and activity records, AI task status, usage and billing identifiers. You choose which emails and attachments to send to support.
- Stripe handles payment information. The app stores customer, subscription, price and status identifiers and does not directly receive full payment card numbers.
Scripts, Production Data and Who Can Access Them
- Project access depends on the owner, approved members and their permission scopes. Share links may allow link holders to see a project preview and request access. When sharing, review the preview content, member permissions and link settings.
- Collaborators may download, export or save information they can access. Revoking access cannot retrieve copies already downloaded.
- ScheduMing backend services and personnel with database or infrastructure permissions may technically access project content. There is currently no end-to-end encryption or zero-knowledge design.
- Support troubleshooting, service maintenance, security incidents or legal requirements may involve administrative access. There is currently no uniform per-access approval and auditing process that we can guarantee to users. Workspace permissions do not mean that internal personnel are absolutely unable to access content.
- Before uploading, confirm that you are authorized to allow the services listed on this page to process the content, including within the permissions granted by the production company, rights holders and your NDA.
AI Processing
- Current script analysis calls the OpenAI API (GPT-6 Luna). Basic analysis and advanced element analysis send the script text, scene excerpts and related character or production information needed for parsing. Ordinary schedule editing does not automatically send the entire project to AI.
- The browser first reads the PDF, FDX or TXT file. AI tasks save input information in Supabase script-imports storage and save tasks, chunks and analysis results in the database before the backend calls OpenAI. Canceling a task does not delete this saved information.
- ScheduMing does not use uploaded scripts, project content or analysis results to train AI models and has disabled sharing API inputs and outputs with OpenAI for model training or improvement.
- For Short Form storyboard PDFs, when you start AI generation, the browser sends an image and the text of each selected page through the Supabase backend to the OpenAI API (GPT-6.1 Terra) to read frames, shot details and captions. These page images and text are not saved in ScheduMing. The PDF file itself is not uploaded; the frames cut from it are saved as project pictures.
- OpenAI requests use store:false to disable response storage. This is separate from abuse-monitoring retention, which may still apply under OpenAI policies. Zero Data Retention requires separate OpenAI approval and activation; this page does not promise that arrangement. Official information: https://developers.openai.com/api/docs/guides/your-data .
- You can turn off optional AI and use supported local parsing workflows. Some files require AI to complete recognition. If the interface indicates that AI is required and your authorization does not allow it, stop the import or use a format that can be parsed locally.
How We Use Information
- We use information for authentication, saving and syncing projects, member collaboration, scheduling, generating reports, analyzing scripts when you request it, managing plans, troubleshooting and preventing abuse.
- The system has no feature for selling scripts or project information. Information is sent to the providers below to deliver these services, or to others through your sharing and export actions. Necessary legal disclosures may also occur.
Account Presence Statistics and Operational Alerts
- When operational alerts are enabled, signed-in users on visible pages of the production website send a heartbeat containing only account identity and time every 30 seconds. Heartbeats pause when the page is in the background or offline. The system counts distinct accounts to determine online user counts and continuous online duration; it does not record clicks, page content or script text.
- The service operator may receive emails when an account registers, remains online for more than an hour, or a configured user count is reached. Resend processes these emails. They contain only account identifiers, display names, registration or presence times and user counts, without scripts, project content or user email addresses.
- Account presence records are retained for up to 7 days. Sent or failed notification records are retained for up to 30 days; unsent events expire after 7 days. Cleanup depends on backend scheduled jobs operating correctly. Email copies in the inbox are subject to retention arrangements of the operator’s mailbox and email provider.
Data Storage and Security
- Supabase provides authentication, a Postgres database, Storage, Realtime and Edge Functions. Project content is stored in the database, new script PDFs in the private project-assets bucket, and AI inputs in script-imports.
- The app uses project access controls, database row-level access policies, private files and short-lived signed links. The website is configured with HTTPS, security response headers and backend identity checks. These measures do not constitute a security certification or an absolute security guarantee.
- Earlier versions used public script URLs. Migration tools exist in the repository, but production-wide verification has not been completed, so we cannot guarantee that all historical scripts have been converted to private files.
- Browser LocalStorage and IndexedDB also store projects, script PDFs, offline collaboration or recovery information. On shared devices, use a separate browser profile and clear site data. Before clearing it, confirm that syncing and necessary exports are complete.
Third-Party Services / Subprocessors
- Supabase: accounts, production databases, script files, AI inputs and analysis results, collaboration and backend processing.
- Vercel: website and CDN, API routes, share previews, operational requests and logs. Share preview routes may read project titles and sharing information.
- OpenAI: user-initiated AI analysis inputs, script text and related scene information, using GPT-6 Luna. ScheduMing has disabled sharing API inputs and outputs for model training or improvement and disabled response storage; security-monitoring retention remains subject to applicable OpenAI policies.
- Stripe: payments, customer, subscription and billing information. The current payment code does not send script text to Stripe.
- Google: identity information for Google sign-in, Maps/Places location queries and online font requests. Location features may send search text or coordinates, and font requests expose network request information. Google/Waze navigation links and external icon requests may also transmit request information or the destination address you choose.
- Open-Meteo: location coordinates for weather, sunrise and sunset queries. The current weather code does not send script text.
- Authentication emails are sent through Supabase Auth; the actual SMTP email provider has not yet been verified. The hosting provider for the support mailbox has also not yet been verified. Providers’ own processing terms and retention arrangements also apply.
Cookies, Browser Storage and Analytics
- Login sessions and app preferences use browser storage. Projects, offline copies and recovery information may also remain on this device. This information is not stored solely on servers.
- No Google Analytics, Vercel Analytics, advertising tracking SDK or separate error monitoring SDK such as Sentry was found in the current app code. Hosting and backend services may still record requests, IP addresses and operational errors. This is not a promise that no logs are collected.
Data Retention
- Project and script information is retained for workspace, collaboration and recovery features. No uniform automatic expiration and deletion mechanism has currently been identified for all script files, AI tasks and outputs. We cannot promise automatic deletion after a fixed number of days.
- Task leases and cancellation status control processing only; they do not mean inputs and results have been deleted from storage. Operational logs, billing and support emails are retained according to the actual arrangements of the relevant systems. A complete retention schedule has not yet been verified.
- Provider backups may remain for a period after primary data is deleted. Production backup enablement, coverage, cycles and mechanisms for reapplying deletions after restoration have not yet been verified.
What Happens When You Delete a Project
- When an owner deletes a project, this device removes it from the workspace and records a deletion pending synchronization. Online synchronization deletes the cloud projects record, and associated collaboration records are handled according to database foreign-key rules. When offline, cloud deletion must wait for successful synchronization.
- The current project deletion workflow does not uniformly clean up PDFs, AI inputs, AI tasks and results in Supabase Storage or related records, and browser PDF caches are not guaranteed to be cleared together. Exported information and copies held by other members or devices are not remotely erased.
- To clean up associated files or analysis information, send the project identifier and deletion scope to support@scheduming.com. Do not send the entire script again just to request deletion.
What Happens When You Delete an Account
- Contact support@scheduming.com from your account email address and specify that you want to delete the account, projects you own, associated scripts and AI information. We need to verify the requester and scope. There is currently no self-service process that executes and verifies deletion of all associated data in one step.
- Signing out handles this device’s session and some caches, but does not delete the cloud account or projects. Deleting only the authentication user cannot be taken to mean that files, logs, payment records and copies on all devices have been removed.
- Deletion requests require separate handling of login sessions, the account, projects and collaboration information, Storage, AI records and local copies. Shared projects, information saved by others, Stripe records, support emails and backups require separate assessment. Immediate and complete deletion cannot be guaranteed.
- An account deletion request does not automatically cancel a Stripe subscription. Separately confirm cancellation through billing management or support.
Your Choices and Rights
- You can edit account and project information, adjust member access, choose available non-AI import workflows and use the app’s export features.
- For access, correction, export, deletion or other applicable privacy rights, contact support@scheduming.com from your account email address. We will handle requests under applicable law and after verifying identity. This page does not claim GDPR or any other compliance certification.
Cross-Border Data Processing
- The service is operated by an operator in Malaysia and uses international providers. OpenAI, Supabase and other providers may process data outside your country. This service does not promise data residency in a particular country.
- The Supabase project’s production region, all processing locations of hosting services and relevant cross-border contractual arrangements have not yet been fully verified. We do not currently promise that all information is stored only in Malaysia or a particular jurisdiction.
Age and Children
- ScheduMing is intended for professional production teams. Before using it, minors should obtain guardian and production company authorization as required by applicable law. Contact support if you identify inappropriate collection of children’s personal information. No separate age verification workflow has currently been identified.
Policy Changes
- This page will be updated with an updated date when the product or data handling changes. Material changes will be explained through appropriate product or contact channels. Review this page again before submitting new projects or using new features.
Contact and Last Updated
- The current operator of ScheduMing is Dan Design Studio Enterprise; SSM registration number CA0328344-X; location: Petaling Jaya, Selangor, Malaysia.
- Contact: support@scheduming.com. Last updated: October 4, 2026.