Privacy Policy

For privacy requests, data access, correction, or deletion, contact us at [email protected]. We will respond within a reasonable period.

• Studio administrators, producers, and reviewers who use ShotTrack Media.
• Vendor company members invited into a studio workspace.
• Google Account holders who voluntarily connect Google Drive for Media Shuttle storage.

Depending on how you use the Service, we may process:

• Identity & account: username, display name, email address(es), phone (optional), role, studio membership, vendor company affiliation, password hashes (we never store plaintext passwords).
• Authentication & session: login cookies/JWTs, ShotTrack Media device tokens, approximate IP address, user-agent, and device name for desktop clients.
• Production workspace content: shows, shots, assignments, bids, invoices, notifications, notes, and related metadata you enter.
• Media Shuttle transfer metadata: package names, relative file paths, file sizes, checksums, validation results, transfer status, audit actions, and download events. When transfers are direct-to-storage, media file bytes typically go to your configured storage provider rather than through our servers.
• Google Drive connection data: OAuth refresh and access tokens, Google account email, Google account id, granted scopes, and Drive folder ids/names you select as the Media root. We do not receive your Google password.
• Support & diagnostics: messages you send us, and limited server logs needed for security, uptime, and debugging.
• Cookies / local storage: authentication cookies (login session), optional performance preferences (last project and page), and browser session storage used to pre-cache the shots list so the Shots page opens faster. Consent for performance cookies is asked once and remembered. We do not use third-party advertising cookies on the core product.

• Directly from you or your studio admin (account creation, forms, uploads).
• From your organization's configuration of vendors and roles.
• From Google, only after you complete Google's OAuth consent for Drive / email scopes used by Media Shuttle.
• Automatically from your browser or desktop client when using the Service.

• Provide the Service — authenticate users, store workspace data, run transfers, send notifications (contract / legitimate interest).
• Security and abuse prevention — detect unauthorized access and protect studios (legitimate interest / legal obligation).
• Google Drive operations you request — list/create/read files under authorized folders using tokens you grant (consent / contract).
• Communications — service emails about transfers, invites, or account issues (contract / legitimate interest).
• Improve reliability — aggregate diagnostics and fix defects (legitimate interest).

ShotTrack Media's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is used only to provide and improve user-facing Media Shuttle features (connect Drive, choose a Media root, upload/download/copy package files, show connection status).
• We do not sell Google user data, and we do not use it for advertising or credit decisioning.
• We do not transfer Google user data to third parties except as needed to operate the Service (e.g. hosting), to comply with law, or with your direction — and then only under appropriate restrictions.
• Human access to Google user data is limited to cases such as security incidents, user support with your permission, or legal compliance.
• You may revoke access at any time in ShotTrack Media → Connections (Disconnect) and in your Google Account security settings.

We do not sell personal information. We may share data with:

• Other users in your studio or vendor company according to roles you configure (e.g. producers seeing vendor deliveries).
• Infrastructure processors (hosting, database, email/SMS/WhatsApp delivery) that process data on our instructions.
• Storage providers you configure (Google Drive, S3, MinIO) for media bytes and keys.
• Authorities when required by law or to protect rights and safety.

We may process data in regions where our hosting providers operate. Where required, we use appropriate safeguards for cross-border transfers.

• Account and workspace data: while your organization uses ShotTrack Media, then for a limited period for backups, disputes, and legal requirements.
• Media Shuttle audit/download logs: retained for security and operational history.
• Google OAuth tokens: until you disconnect, an admin removes the connection, or tokens are revoked/expired.
• Server logs: typically short-lived unless needed for investigations.

We implement administrative, technical, and organizational measures appropriate to the risk, including TLS in transit, hashed passwords, vaulted storage credentials, role-based access control, and device-token authentication for desktop clients. No system is perfectly secure; please contact us to report vulnerabilities.

• Access, correct, or update profile information in Settings.
• Request export or deletion of personal data by emailing us (subject to legal holds and studio admin controls over shared workspace data).
• Disconnect Google Drive and revoke Google permissions.
• Sign out and clear local desktop configuration.
• Object to or restrict certain processing where applicable law provides that right.

ShotTrack Media is a professional B2B tool and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will post the updated version at this URL with a revised "Last updated" date. Continued use of the Service after changes become effective constitutes acceptance of the updated policy where permitted by law.

ShotTrack Media privacy contact: [email protected]

Related documents: Terms of Service.