Privacy Policy

Last updated: 25 August 2026

In short. The PDF of your screenplay is never uploaded: it is read by code running in your own browser. What we store is the breakdown that comes out of it, including the text of each scene, because that is what lets you find your projects again from another computer. We never sell it, never share it, and never use it to train any model. You can download it all or delete it all, yourself, at any time.

1. Who is responsible

The data controller is [COMPANY NAME], VAT number [VAT NUMBER], registered office at [REGISTERED ADDRESS]. For anything about your data, write to ciao@breakdown27.com.

2. What happens to your screenplay, precisely

This is the part that matters most, so it is written without hand-waving.

3. What we collect

DataWhyLegal basis
Email, name, password (hashed)To have an account and sign inPerformance of the contract
Projects, drafts, scene text, breakdowns, notesTo provide the service and keep your workPerformance of the contract
Plan, subscription status, billing datesTo give you what you paid forPerformance of the contract
Number of scenes and credits used per monthTo apply the quota of your planPerformance of the contract
Payment dataHandled entirely by Stripe — we never see your cardLegal obligation, contract
Technical logs (IP, errors)Security and keeping the service workingLegitimate interest

We do not use advertising trackers, and we do not profile you.

4. Who else touches it

These are our processors. Each one only gets what it needs to do its job:

Some of these operate outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses. We never sell your data to anyone, for any purpose.

5. How long we keep it

Your projects stay as long as your account exists. Delete a project and it goes immediately; delete your account and everything goes with it. Invoices are kept for as long as tax law requires, which in most of Europe is ten years. Technical logs are kept for a few weeks.

6. Your rights

You can access, correct, delete, export and restrict the use of your data, and object to processing based on legitimate interest. Two of these you can exercise yourself, without asking anyone, from the account page in the app: Download everything and Delete my account. For the rest, write to us and we answer within 30 days. You can also complain to your data protection authority.

7. Security

Traffic is encrypted in transit. Passwords are stored hashed with PBKDF2 and never in clear text. Sessions use signed cookies. Access to the database is restricted to the application. No system is perfect: if a breach ever affected your data, we would tell you and the authority, as the law requires.

8. Children

The service is not intended for people under 18 and we do not knowingly collect their data.

9. Changes

If we change this policy in a way that matters, we will tell you by email before it takes effect. The date at the top always says when it was last touched.