Privacy Policy

CineScope LLC ("CineScope LLC", "we") makes and operates two editions of the same guest feedback and operations software: CineScope, for cinemas (website cinescope.org, app at cinescope-app.com), and Foyer, for other venues such as hotels, restaurants, apartment buildings, gyms and stores (website foyerops.com, app at foyerops.app). In this policy, "the service" means both. This policy explains what we collect on these websites and in the service, why, how long we keep it, and the choices you have. Where something applies to only one edition, we say so. Questions? Email max@cinescope-app.com.

Information we collect

There are two kinds of information here. For our websites, and for the account and billing details of the businesses that subscribe, we decide how the information is used. Inside a customer's account — the reports its guests send, the records it keeps about its staff and crew, and the email addresses guests choose to leave — the customer (the venue) decides, and we process that information only on its behalf and on its instructions. We call that second kind "customer data".

• Information you give us. Name, business name, email address and any message you send when you contact us, request a demo or pricing, or ask for support through our websites.
• Billing information. When you subscribe, payment is processed by Stripe. We receive subscription and billing status; we never see or store your full card number.
• Staff accounts (customer data). For each person a customer gives an account: name, work email address, role, and the locations they cover; if added, a separate address for notifications, a mobile number for text alerts, and a profile photo. Passwords are stored only as bcrypt hashes. If someone uses two-step verification, we store what is needed to check it: an authenticator-app secret and one-time recovery codes (stored as hashes), or the public key of a passkey. Face and fingerprint data never leave the person's own device. We also keep display preferences and when each person last signed in.
• Guest reports (customer data). What a guest sends through a QR form: the place (taken from the placard), the issue type, an optional seat number, a description, and — where the venue's account can check one — an optional photograph. The form does not ask guests for their name or phone number, and it refuses a description that appears to contain personal details, such as an email address, a phone number, a street address or a payment card number. With each report we keep the language the form was shown in (for example, Spanish), which we count but never show beside the report. Before a guest's photograph is kept, an AI model checks that it is safe to show staff and relevant to the report; a photograph that fails is never stored, and camera metadata such as location is removed from photographs before they are stored. Where a report is in another language and the venue uses translation, an English translation is stored beside the original. Reports belong to the venue that collected them.
• Guest email addresses — only if a guest chooses to leave one (customer data).
  • "Email me when it's resolved." The report form offers an optional email box (on by default in both editions; each venue can switch it off), and the confirmation screen offers it again to a guest who left it empty. A guest who fills it in receives one email when the venue marks the report resolved, in the language they used, saying what their tracking page says: the place, their reference, the dates, any closing line the venue wrote for them, and any thank-you code. The address is kept apart from the report, is never shown to the venue's staff (a report shows only that its guest will be emailed), is never sent to any AI provider, and is left out of exports and backups. It is deleted as the email is sent; if that never happens, it is deleted when the report is rejected or deleted, when the venue switches the feature off, or after 90 days at the latest. One address can be waiting on at most five reports at a time.
  • Community-ratings emails (CineScope only; off unless a cinema switches it on). After rating a film, a guest can leave an email address to hear when films at that cinema are rated highly by its audiences. Nothing is sent until the guest confirms by email; after that, at most one email a week, sent in the cinema's name with its street address, each with a one-tap unsubscribe that deletes the address. The address is stored encrypted and is never linked to the guest's rating, and the service gives no one — at the cinema or at CineScope LLC — a way to read, export or add to the list; staff see only how many people are on it.
• Ratings (customer data). Film ratings (CineScope) and visit ratings record the score, when it was given, and where (the venue, and for films the screen and the film). They carry no identifier and are not linked to any person or email address.
• Thank-you codes (customer data). If a venue offers its own discount codes to guests, the service records which report each code was given for; for a code given after a rating, only the venue, the room and the day. Codes are redeemed in the venue's own systems, which we never see. Because a venue can look up which report a redeemed code came from, a guest who redeems a code may become identifiable to that venue.
• Crew records (CineScope Staffing; customer data). For the hourly staff a cinema schedules: name, phone number and email address if the manager adds them, the cinemas they work at, whether they can run a shift, employment type and weekly-hours limit, availability, time off, shifts, the requests they make (such as time off or swaps), the checklists they tick, a manager's note on why their hours are limited, and a PIN for the shared back-office tablet (stored only as a hash). The app has no field for a date of birth or a work-permit number, and asks managers not to type them into the note.
• Other records customers keep in the service (customer data). Case notes and history, inspection records and certificates, invoices and the supplier contacts behind them, guides, announcements to staff and who confirmed reading them, and — in CineScope — showtime schedules and the ticket-sales figures the service fetches from a cinema's point-of-sale system at its request.
• Bug reports and assistant feedback. When a staff member uses "Submit a bug", the report comes to us with their name and role, what they wrote, the page they were on, the app version, their browser, screen size and time zone, the last few errors the page hit, and a screenshot if they add one. When the AI assistant can't answer part of a question, or a reader tells us an answer missed, we keep a short note of what was missing, the tools the assistant tried and the asker's role — not who asked and not their question, other than any words the reader types into that feedback box.
• Push notifications. If a staff member turns on notifications on a device, we keep that browser's push subscription: an address at the browser maker's push service and the keys needed to encrypt messages to it.
• Security and technical data. For each staff sign-in session we keep the IP address and browser it came from, so people can see and end their own sessions. A sign-in and security log records sign-ins (including failed ones), password and two-step changes, account changes, backup downloads and support access, with IP address and browser. On the guest forms, IP addresses are used only in memory, to limit how often one address can submit; they are not stored with reports or ratings. Our hosting providers keep standard server logs (IP address, browser type, pages requested) for security and troubleshooting.
• Usage counts. We keep counts of how each account uses the service — for example scans per placard per day, sign-ins per day, reports per month, and the languages reports arrive in — to run, support and improve it. These counts contain no one's words and identify no guest or staff member.

How we use information

• To provide, secure and support CineScope and Foyer, including the features each customer turns on, such as notifications, translation and the AI features described under "Service providers".
• To send a guest the one email they asked for when their report is resolved and, where a cinema offers it, community-ratings emails on that cinema's behalf.
• To process subscriptions, invoices and refunds.
• To reply to your inquiries and provide onboarding and support.
• To meet legal, tax and accounting obligations.

We do not sell or share personal information for advertising purposes, and we do not use customer data to train AI models.

Cookies

On our websites. This site uses cookies and local storage that are strictly necessary: keeping your session, remembering your cookie-notice choice, and completing checkout through Stripe. We do not run advertising trackers. We use Google Analytics to measure how the site is used, and it is loaded only after you choose "Accept" in our cookie notice — if you choose "Essential only", no analytics script runs and no analytics cookie is set. IP addresses are anonymized in Google Analytics. You can clear or block cookies in your browser at any time; checkout may not work without essential cookies.

In the service. The CineScope and Foyer apps use only strictly necessary cookies. Each is marked HttpOnly, so page scripts cannot read it, and is sent only over HTTPS:

• qrir_session — keeps a staff member signed in; ends at sign-out, after 7 days, or after 12 hours without use.
• qrir_crew (CineScope Staffing) — keeps a crew member signed in to their own shifts on their own phone; up to 90 days, renewed when used.
• qrir_floor (CineScope Staffing) — tells a shared back-office tablet which cinema it is in; it identifies a building, never a person; up to 1 year.
• qrir_crew_recover (CineScope Staffing) — holds a sign-in code request for 15 minutes while a crew member gets back into their shifts.

The apps also use local storage on your device for a few preferences, such as the language a guest chose for the report form and display settings in the staff app. The apps load no analytics or advertising scripts.

Service providers

We share information only with providers that help us run the service, under contract and only as needed:

• Cloudflare — hosts the service: each customer account's database, stored files such as photographs and documents, and logs. Cloudflare Workers AI also runs the AI triage model described below.

• TypeSafe AI — makes the model that AI triage's first step uses; it runs on Cloudflare Workers AI.

• Anthropic — provides the Claude models behind the AI features listed below.

• Resend — delivers email: notifications, sign-in codes and security alerts to staff, links and codes to crew, a guest's one "resolved" email, community-ratings emails, and bug reports to us.

• Twilio — delivers text messages: alerts to staff who have a mobile number on their account (these never include what a guest wrote), and sign-in codes to crew (CineScope).

• Browser push services — run by the maker of each staff member's browser (for example Apple, Google, Mozilla or Microsoft), they carry push notifications. Each notification is encrypted end to end for the device, so the push service cannot read it, and it carries where, how urgent and which case — never a guest's words or contact details.

• Stripe — payments and billing.

• Google Analytics — measures how our websites are used, only after a visitor accepts (see "Cookies").

• Our website platform — our websites' contact, demo and support forms are stored in a database run by Supabase through Lovable, and Lovable's email service sends them to our team.

• Cronitor — uptime monitoring; it receives counts and response codes, never customer or guest data.

When AI runs, and what it receives.

• AI triage has its own setting with three choices. One-step, the default in both editions: each new guest report — its words and any translation, the place, the issue type, the seat, and short descriptions of jobs already open in the same place — is read by TypeSafe AI's model on Cloudflare Workers AI, which sends the reports it is very sure are genuine straight on to the venue's staff. This step runs even when the AI assistant is switched off; only setting AI triage to Off stops it. Two-step also has Anthropic's Claude review whatever the first step left, and apply its verdicts without a person confirming. Off: nothing reads reports automatically. Emergencies are never decided by AI.
• The AI assistant setting (on by default; an account admin can switch it off) controls everything sent to Anthropic: staff questions to the in-app assistant and the account data its answers draw on (which can include report text and staff and crew names); translation of guest reports; AI verification of the review queue and Two-step triage (report text, translations, the place and seat, and for a report a staff member filed, their name); the safety check of guest photographs (the photo, with the place and issue type); and, where also switched on, reading invoices, inspection certificates and guide PDFs. In CineScope it also covers the Staffing agent, which turns a manager's sentence into availability changes (it receives crew names, availability and time off, never phone numbers or email addresses), and the AI checks of showtime schedules and opening hours (films, showtimes and sales figures). Each assistant question is also read first by TypeSafe AI's model on Cloudflare Workers AI, together with the previous exchange, to choose which of the assistant's tools to load. Switching the AI assistant off stops all of this — and with it translation and the photograph field on the guest form.
• Assistants your staff connect themselves. If a customer switches on "Let staff connect their own AI assistant" (off by default), a staff member can connect an AI assistant of their own, such as Claude, and ask it the questions the in-app assistant answers. Those answers, and the figures and report text behind them, then go to that assistant's provider under the staff member's own account, outside our control and our agreements; the customer can stop report text going there with a separate setting.
• Guest email addresses are never sent to any AI provider.

At a customer's direction. When a cinema connects its point-of-sale system, the service fetches schedules and sales from that POS provider using the cinema's own credentials. In CineScope the service also reads public weather data from Open-Meteo (it sends each cinema's town or postcode — or its name, if neither is set — and its map location). No personal information goes to it.

Providers may process data outside your country; where required we rely on standard contractual clauses or an equivalent transfer mechanism.

Content sent to Anthropic, and to Cloudflare Workers AI for AI triage, is processed only to produce the requested output and is not used to train their models.

Retention

We keep account and billing records for as long as your subscription is active and afterwards only as long as required for legal, tax and dispute-resolution purposes. Inside the service, customer data is kept while the customer's account is active, unless the customer deletes it sooner or the table below gives a shorter period.

Your rights

CineScope and Foyer are built with the principles of the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA) in mind. Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, to withdraw consent, and to opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information, so there is nothing to opt out of. You also have the right not to be discriminated against for exercising these rights.

To exercise a right, email max@cinescope-app.com. We respond within the time limits that apply to your request. If you are a guest who submitted a report or a rating at a venue, contact that venue — they control the report and we act on their instructions. Because a venue's staff can't see the email address a guest leaves for the "resolved" email, a guest who wants that address deleted before it is used can also write to us. Every community-ratings email has a one-tap unsubscribe that deletes the address. If you are a staff member or crew member of one of our customers, contact your employer, who controls your records; we will help them respond.

Security

Traffic to these sites and to the service is encrypted in transit with HTTPS. Access to production systems is limited to people who need it. Our security pages, at cinescope.org/security and foyerops.com/security, describe our safeguards in more detail. No online service can promise perfect security, so please tell us right away if you suspect a problem with your account.

Children

CineScope and Foyer are business tools sold to organizations, not to consumers, and our websites are not directed at children. We do not knowingly collect personal information directly from children under 13 through our websites.

Some people whose information is in the service can be minors, because our customers enter it as employers or as venues:

• In CineScope's Staffing feature, cinemas keep records about their crew, who can include 14- to 17-year-olds. These records are created and maintained by the employer, and we process them only on the employer's behalf and on its instructions. Crew members can open their own shifts through a personal link and choose a PIN for a shared tablet, but they have no account with us. The service has no field for a date of birth or a work-permit number.
• Anyone, including a child, can scan a placard. The forms ask no one's name or age. A guest who leaves an email address for the "resolved" email receives that one email, and the address is then deleted.

If you believe we hold a child's personal information in a way this section does not describe, contact us and we will work with the customer concerned to address it.

Changes

We may update this policy. Material changes will be announced on this page with a new "last updated" date.