Data Processing Agreement
Your customers' data, on your terms.
Last updated 5 October 2026.
The short version
Your lab decides what happens to your customers' photos and details. Filmara only stores and delivers them for you. We never sell them, never use them to train AI, and never market to your customers. Nobody at Filmara opens them in Filmara without giving a reason, and every time is shown to you. If something goes wrong, you hear from us within 48 hours. When you leave, it all goes.
Who is who
Under the UK GDPR and the EU GDPR, your lab is the controller of your customers' personal data and Filmara is your processor. Filmara means the operator named in our Terms. This agreement is part of those Terms. It applies from the moment your lab uses Filmara to deliver to customers, with nothing to sign. If you want a signed copy for your records, email hello@filmara.app.
What we handle for you
Whose data: your customers, the people in their photos, and your own staff.
What data: names, email addresses, the scans you upload, the messages and spots marked on them, and order details from your shop when you connect it.
Why and for how long: to send rolls to your customers and carry the conversation about them, for as long as you use Filmara, then as set out under “When you leave”.
Only on your instructions
We use your customers' data only to provide Filmara to you: what you do in Filmara, and your settings, are your instructions. We don't use it for anything of our own. We contact your customers only to do what Filmara does for you, such as delivering a roll, passing on a reply, or a notice our Terms describe. If we're ever legally required to do something else with it, we tell you first unless the law forbids it.
Who at Filmara can see it
Filmara is run by one person, who is bound to keep your data confidential. Day to day, the owner's view of Filmara shows each lab's plan, counts and problems, not your customers or their photos.
To open your customers, rolls or conversations in Filmara, the owner has to give a reason, and the door stays open for one hour, onto one lab at a time. Each time is recorded: when, why, and each page opened or change made. You see the record in Settings, Who at Filmara looked, and we email you when it happens. Nothing in Filmara can change or remove the record. Only closing your account deletes it, with the rest of your data.
Two things sit outside the record. A roll's link works for anyone who has it, as it does for your customer. And the companies under “Who hosts it” hold the data itself: the owner signs in to them only to keep Filmara running, and those visits aren't in your record.
Keeping it safe
What protects your data today:
- Every page and every connection uses HTTPS, enforced by the browser (HSTS).
- Passwords are stored only as scrypt hashes. Sign-in cookies hold a session, never a password.
- Every request is checked against the lab it belongs to, in the code that touches the data. One lab can never reach another's customers.
- Each roll has its own unguessable link, and private keys in our addresses are kept out of analytics.
- Every change to sign-in, data or storage is attacked by our own tests and reviewed by a separate reviewer before it ships.
Who hosts it
We use these companies to run Filmara. Each is bound by its own data processing terms with us, with protections at least as strong as this agreement.
| Company | What it does | Where |
|---|---|---|
| Vercel | Runs the site, stores the photos, and counts page visits without cookies or private links | United States (Washington, D.C.) |
| Neon | Holds the database: accounts, roll details, customers, messages and orders | United Kingdom (London) |
| Resend | Sends Filmara's emails, including roll deliveries and replies to your customers | United States |
Stripe takes your lab's own payments. It never receives your customers' data.
Before we add or replace a company that handles your customers' data, we email you at least 30 days ahead. If you object, tell us; if we can't meet the objection, you can export everything and leave, and we refund what you've paid for the time you don't use.
Data outside the UK and EU
Photos and the site itself are hosted in the United States. Accounts, roll details, messages and orders are kept in London. Moving data between them is covered by the hosting companies' data processing terms. Wherever Filmara is worked on from, opening your data follows the rules above and is recorded.
Helping with your customers' rights
If one of your customers asks to see, correct or delete their data, we help you answer. You can export everything from Settings at any time. To erase one customer completely, email us and it's done within 30 days; a one-step erase in Settings is on the way.
If something goes wrong
If your customers' data is lost, stolen or exposed, we tell you without undue delay and within 48 hours of finding out, with what happened, what data, roughly how many people, and what we're doing. We keep you updated as we learn more, and help you with any notice you have to give.
When you leave
Export everything in one click from Settings: originals, customers, dates and conversations. Closing your account in Settings deletes everything at once. If you stop paying without closing it, your data is deleted on the dates in our Terms, after a reminder.
Checking up on us
Ask us anything about how your data is handled and we answer in writing. Your record of who at Filmara looked is always in Settings. Once a year, or after a breach, you can ask for a fuller review of our measures.
Questions
Email Owen directly at hello@filmara.app. See also our Privacy page.