GREYSET — Privacy Policy

Effective: July 10, 2026 · Applies to the GREYSET web app (greyset.app) and the GREYSET companion iOS app.

The short version

GREYSET is a previsualization tool. We collect the minimum needed to run the product, we don't sell data, we don't show ads, and we don't use third-party tracking.

GREYSET iOS app

• No account, no personal data. The iOS app works without any sign-in and sends no personal information to us.
• Camera & motion: used on-device for AR tracking so you can move a virtual film camera by walking around. Camera images never leave your phone.
• Pairing: when you scan the QR code shown by the GREYSET web app, your phone streams camera position data (not video of your surroundings) directly to your own computer over an encrypted peer-to-peer connection. We do not receive or store this data.
• Recorded takes are stored locally on your device and on your own computer.

GREYSET web app

• Account (optional): if you sign in (Google or e-mail), we store your e-mail address and your saved projects so they sync across devices. Hosted on Supabase servers in the EU (Frankfurt).
• Hosting & infrastructure: the site and its API run on Cloudflare (Pages, Workers KV). Cloudflare processes connection data including your IP address to serve and protect the site. We store a per-day visit COUNT only — no per-visitor record, and nothing is stored on your device.
• Sign-in e-mails are delivered by Resend; your address is passed to them only to send that mail.
• Payments: handled by Stripe. We never see or store your card details. Stripe's privacy policy: stripe.com/privacy.
• AI features: scene descriptions (or photos you explicitly submit for scene reconstruction) are processed by Anthropic's API to build your 3D scene, then discarded from the request. They are not used to train models.
• Waitlist: if you join the mailing list on our landing page, we store your e-mail solely to notify you about GREYSET. To be removed, email [email protected] and we delete the entry.

What we don't do

• No selling or sharing personal data with advertisers.
• No third-party analytics or tracking SDKs.
• No reading your scenes or projects except to operate the service.

Your rights

Email [email protected] to get a copy of your data or to have your account deleted; we action it within 30 days and it removes your projects and billing profile. (There is no self-service delete button yet.) EU users have the rights granted by the GDPR (access, rectification, erasure, portability, objection).

How long we keep things, and why we may

• Account & projects — kept while your account exists, deleted within 30 days of a deletion request. Basis: performance of our contract with you.
• Billing records — kept as long as tax law requires (in Poland, 5 years from the end of the accounting year). Basis: legal obligation.
• Waitlist e-mail — until you ask us to remove it. Basis: your consent.
• Visit counts — aggregate numbers only, no personal data.

Where your data goes

Your account and projects are stored in the EU (Supabase, Frankfurt). Some processors — Cloudflare, Stripe, Anthropic and Resend (which delivers our sign-in e-mails) — are based in the United States or operate globally, so data may be transferred outside the EEA under the European Commission's Standard Contractual Clauses.

Contact

PANDA PRODUCTION Bartosz Białobrzeski — data controller.
ul. Zgierska 18C, 04-092 Warszawa, Poland · NIP 1132843279
[email protected]