Legal
Terms of Service
Last updated July 26, 2026 • Effective July 26, 2026
1. Welcome
These Terms of Service (“Terms”) govern your use of IntiSafe, a secure operating system for intimacy coordination workflow. IntiSafe is operated by CINTIMA LLC, a California limited liability company (“IntiSafe,” “we,” “us,” or “our”).
By creating an account, accessing the platform, or using any IntiSafe service, you (“you” or “User”) agree to be bound by these Terms. If you do not agree, do not use the platform. We’ve written these Terms in plain language; where legal terms are necessary, we’ve kept them as direct as possible.
These Terms govern your access to and use of IntiSafe. They include the Data Processing Agreement set out in Schedule A, which forms part of these Terms and which you accept when you accept these Terms.
2. Who Can Use IntiSafe
To use IntiSafe, you must be at least 18 years old, have the legal authority to enter into binding agreements, provide accurate registration information, and comply with these Terms and all applicable laws.
IntiSafe is built for intimacy coordinators, production professionals, and authorized production stakeholders. While anyone meeting the above criteria may create an account, the platform is designed for professional use in film and television production contexts. By using IntiSafe, you represent that your use is for professional or educational purposes related to film, television, or live production, and not for any purpose that would constitute a misuse of performer or production information.
3. Your Account
You create your account through our authentication provider (Clerk), using an email verification code or by signing in with Google or Apple. When you create your account, you accept these Terms and our Privacy Policy.
You are responsible for maintaining the confidentiality of your account credentials and your recovery key, for all activity under your account, for notifying us immediately of any unauthorized access at support@intisafe.app, and for the accuracy of the information you provide.
About your recovery key. IntiSafe uses true end-to-end encryption. Your recovery key is the only way to access your encrypted data on a new device or after clearing your browser. We cannot recover your data if you lose your recovery key — there is no backdoor and no company-held copy we can unlock for you, under any circumstances, including at your own request. This is a deliberate feature of the encryption model, not a limitation we can override. Please save your recovery key somewhere durable, such as a password manager or a printed copy kept somewhere safe. See Section 5.3.
4. Membership and Billing
4.1 The Membership
IntiSafe is offered as a single membership: $69 USD per month, billed monthly. There are no annual contracts, no per-project fees, and no long-term commitments. Pricing is in US dollars.
4.2 Free Trial
New accounts start with a 14-day free trial. The trial requires no credit card and begins automatically when you create your account. During the trial you have full access to the platform.
At the end of the 14-day trial, if you have not started a paid membership, your account becomes read-only: you can still view and export all of your projects and documents, but you cannot create or edit until you subscribe. We do not automatically charge you when the trial ends, because we never collected a card to begin the trial. The free trial is available once per account.
4.3 How Billing Works
When you start a paid membership, billing is handled through Clerk Billing, which uses Stripe as the payment processor. Stripe securely collects and stores your card details; we never see or store your full card number. Your membership renews automatically each month until you cancel. CINTIMA LLC is the merchant of record for your membership.
4.4 Cancelling, Pausing, and Your Data
You may cancel or pause your membership at any time. When you cancel or pause, your membership remains active through the end of the current paid period and then stops renewing — we do not issue further charges after you cancel. You can resume at any time.
Your data is never deleted when you cancel, pause, or lapse. If your membership ends for any reason — cancellation, pause, non-payment, or an expired trial — your account becomes read-only. You keep full view access to all of your projects and documents and can export all of your data at any time in PDF or JSON format, at no charge, including from a closed account. Your records stay yours regardless of membership status. See Section 11.3.
4.5 Taxes
Prices are shown exclusive of tax. Because CINTIMA LLC is the merchant of record, we are responsible for collecting and remitting any sales tax, VAT, GST, or similar taxes where we are obligated to do so; where applicable, tax is calculated and added at checkout (via Stripe Tax) based on your location. You are responsible for any other taxes, duties, or fees imposed by your jurisdiction that are not collected by us.
4.6 Pricing Changes
We will provide at least thirty (30) days’ advance notice of any change to membership pricing before it affects your account.
5. Your Data and Content
5.1 You Own Your Content
You retain all rights to the content you upload to IntiSafe — including scripts, scene notes, rider documentation, performer information, production reports, and any other materials ("Your Content"). We do not claim ownership of Your Content.
5.2 What We Can Do With Your Content
To provide the service, you grant IntiSafe a limited license to store, process, and transmit Your Content as necessary to operate the platform. Because Your Content is end-to-end encrypted (Section 5.3), this license is in practice limited to storing and transmitting encrypted data we cannot read. We do not use Your Content for marketing, training AI models, advertising, or any purpose unrelated to providing the service to you.
5.3 End-to-End Encryption and No Backdoor
IntiSafe is built with true end-to-end encryption. Your Content is encrypted on your device before it reaches our servers. Encrypted files (such as scripts and other documents) are stored in Cloudflare R2, and associated records and metadata are stored in our Supabase database. In both cases, what leaves your device is encrypted with a key only you hold.
We cannot read the contents of your encrypted data, and we cannot recover it for you. There is no company-held key, no master key, and no backdoor. If you lose your recovery key, your encrypted data is permanently unrecoverable — by you and by us. We designed it this way on purpose: for a product whose promise is that your intimacy-coordination work is private even from us, any recovery path we controlled would make that promise false.
Because of this design, if we are ever compelled by legal process to produce data stored on our servers, we can produce only ciphertext (unreadable encrypted data) and account metadata (such as your name, email, and billing records) — never the readable contents of Your Content, regardless of any legal demand.
5.4 Data Accuracy and Lawful Use
You represent that:
• You have the authorization to upload and process all content you submit, including production materials received in the course of a professional engagement
• Your use of IntiSafe complies with all applicable laws, including data protection laws
• You have obtained any necessary consents from individuals whose information appears in Your Content (including performers, production personnel, and other parties)
• You will not upload content that is unlawful, infringes third-party rights, or violates the privacy rights of others
5.5 Sensitive Information
IntiSafe is designed to handle sensitive information related to intimacy coordination workflow. You acknowledge that:
• You are responsible for ensuring your use of the platform complies with any applicable employment agreements, union rules (including SAG-AFTRA standards), production contracts, and confidentiality obligations
• IntiSafe is a tool, not a replacement for professional judgment, legal advice, or compliance with industry standards
• You will not rely on IntiSafe as a substitute for proper consent processes, legal documentation, or production protocols
5.6 Security and Breach Notification
We implement and maintain reasonable technical and organizational security measures designed to protect Your Content. If we become aware of a security incident that results in unauthorized access to or disclosure of your personal information that is not protected by end-to-end encryption, we will notify you as required by applicable law, including California Civil Code § 1798.82, without unreasonable delay. Because most of Your Content is end-to-end encrypted and unreadable to us, a compromise of our storage would expose only ciphertext and account metadata, not the readable contents of Your Content.
6. Acceptable Use
You agree not to:
• Use IntiSafe for any unlawful purpose
• Upload content you are not authorized to access or process, or that you have not received in the course of a legitimate professional engagement
• Attempt to reverse-engineer, decompile, or circumvent the platform's security
• Interfere with the operation of the platform or other users' use of it
• Use automated systems to access the platform except as expressly permitted
• Resell, sublicense, or redistribute access to your account
• Use the platform to harass, harm, or violate the rights of any person
• Misrepresent your identity or affiliation
We reserve the right to suspend or terminate accounts that violate these rules.
7. Intellectual Property
7.1 Our IP
IntiSafe — including the software, design, logo, name, documentation, and underlying technology — is owned by CINTIMA LLC and protected by copyright, trademark, and other intellectual property laws. These Terms do not grant you any rights to our IP except the limited right to use the platform as described in these Terms.
7.2 Feedback
If you send us feedback, suggestions, or feature requests, we may use them freely without obligation to you. You grant us a perpetual, royalty-free license to use such feedback to improve the platform. We do not acquire ownership of your feedback by virtue of this license.
7.3 Copyright Complaints (DMCA)
We respect intellectual-property rights and respond to notices of alleged copyright infringement under the Digital Millennium Copyright Act (17 U.S.C. § 512).
Encryption note. Because Your Content is end-to-end encrypted, we cannot view, assess, or selectively remove the contents of a user’s encrypted materials. Our response to a valid notice is therefore limited to actions we can take at the account or file-record level (for example, disabling access to an identified item or, for repeat infringers, the account).
Filing a notice. Send a written notice to our Designated Agent (below) that includes: (a) your physical or electronic signature; (b) identification of the copyrighted work claimed to be infringed; (c) identification of the material claimed to be infringing and information reasonably sufficient to let us locate it; (d) your contact information; (e) a statement that you have a good-faith belief the use is not authorized by the owner, its agent, or the law; and (f) a statement, under penalty of perjury, that the information is accurate and that you are the owner or authorized to act on the owner’s behalf.
Counter-notice. If your material was disabled, you may submit a counter-notice with (a) your signature; (b) identification of the removed material and its prior location; (c) a statement under penalty of perjury that you have a good-faith belief it was removed by mistake or misidentification; and (d) your contact information and consent to jurisdiction as required by § 512(g). We may restore the material as permitted by law.
Repeat infringers. We will, in appropriate circumstances, disable or terminate the accounts of users who are repeat infringers.
Designated Agent: support@intisafe.app
8. Privacy and Data Processing
8.1 Privacy
Our handling of personal information is governed by our Privacy Policy, which is incorporated into these Terms by reference. By using IntiSafe, you also agree to the Privacy Policy.
8.2 Data Processing
When you use IntiSafe to record personal information about performers, production personnel, or other third parties, you act as the data controller of that information and CINTIMA acts as your data processor. The terms governing that processing are set out in the Data Processing Agreement in Schedule A, which is incorporated into and forms part of these Terms. By accepting these Terms, you accept the Data Processing Agreement. A standalone, separately signable copy is available on request at support@intisafe.app.
9. Service Availability and Changes
9.1 Reliability
We work to keep IntiSafe available and functional, but we do not guarantee uninterrupted access. The platform may be unavailable due to maintenance, updates, technical issues, or causes beyond our control.
9.2 Platform Changes
We may add, modify, or remove features over time. We will provide reasonable notice of material changes that significantly affect your use of the platform.
9.3 Beta and Pre-Release Features
Some features may be offered as beta, preview, or pre-release. These features are provided "as is" and may be changed or removed without notice.
10. Force Majeure
Neither party is liable for any failure or delay in performance (other than payment obligations already due) caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, government action, labor disputes, power or internet failures, epidemics or pandemics, or failures of third-party infrastructure or service providers. The affected party will notify the other promptly and resume performance as soon as reasonably practicable. If a force-majeure event affecting our performance continues for more than sixty (60) days, either party may terminate the membership on notice, and we will refund any prepaid, unused fees.
11. Termination
11.1 By You
You may stop using IntiSafe, cancel your membership, or close your account at any time. Cancellation is governed by Section 4.4.
11.2 By Us
We may suspend or terminate your account if you violate these Terms, fail to pay applicable fees, or engage in conduct that creates risk for IntiSafe or other users. Where reasonable, we will provide notice and an opportunity to address the issue first.
11.3 Your Records After Termination
IntiSafe treats your production documentation as legal records. Following any account closure, cancellation, pause, or lapse — whether by you or by us — your projects remain accessible in read-only mode, and you may export all of your data in PDF or JSON format at any time, at no charge, including after account closure. You can resume a paid membership at any time to regain full editing access.
We will not delete your project data unless you affirmatively request it in writing. If you request deletion, we will complete that deletion within thirty (30) days and confirm in writing. Because of end-to-end encryption, most of Your Content is unreadable to us at all times; deletion removes the encrypted data and associated records we hold. We may retain billing records as required by tax and accounting law (see Section 4.5 and the Privacy Policy).
12. Disclaimers
THE PLATFORM AND ALL RELATED SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, CINTIMA LLC DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR TRADE USAGE.
We do not warrant that the platform will be error-free, uninterrupted, secure against all threats, or that it will meet your requirements.
Encryption and data-loss risk. You acknowledge that IntiSafe uses true end-to-end encryption and that, as described in Sections 3 and 5.3, we have no ability to recover your encrypted data or your recovery key. We make no warranty against, and expressly disclaim responsibility for, loss of or inability to access Your Content caused by your loss of your recovery key or account credentials, by your clearing of browser data, or by any device you control. You are solely responsible for retaining your recovery key and maintaining your own backups where appropriate.
Third-party services. The platform relies on third-party providers (including our authentication, payment, hosting, storage, and email providers). We do not warrant the availability, security, or performance of those third parties and are not responsible for their acts or omissions except as required by law.
Some jurisdictions do not allow the exclusion of certain warranties, so some of the above exclusions may not apply to you; in that case, such warranties are limited to the minimum scope and duration permitted by law.
13. Limitation of Liability
13.1 Exclusion of certain damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, CINTIMA LLC AND ITS MEMBERS, MANAGERS, EMPLOYEES, AND AGENTS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR DATA, ARISING OUT OF OR RELATING TO THESE TERMS OR YOUR USE OF (OR INABILITY TO USE) THE PLATFORM, WHETHER BASED IN CONTRACT, TORT, STRICT LIABILITY, OR ANY OTHER THEORY, AND WHETHER OR NOT WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
13.2 Data loss from lost keys or credentials. WITHOUT LIMITING SECTION 13.1, AND NOTWITHSTANDING ANYTHING TO THE CONTRARY, WE WILL HAVE NO LIABILITY FOR ANY LOSS OF, OR INABILITY TO ACCESS, YOUR CONTENT THAT RESULTS FROM YOUR LOSS OF YOUR RECOVERY KEY OR ACCOUNT CREDENTIALS, GIVEN THAT OUR END-TO-END ENCRYPTION MEANS WE CANNOT RECOVER THAT DATA FOR YOU.
13.3 Aggregate cap. OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE PLATFORM WILL NOT EXCEED THE GREATER OF (A) THE TOTAL AMOUNT YOU PAID US FOR THE MEMBERSHIP IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS ($100).
13.4 Exceptions. Nothing in these Terms limits liability that cannot be limited by law, including liability for fraud, gross negligence, willful misconduct, or death or personal injury caused by negligence. Some jurisdictions do not allow the exclusion or limitation of certain damages, so some of the above may not apply to you; in that case our liability is limited to the maximum extent permitted by law.
13.5 Basis of the bargain. You acknowledge that the disclaimers and limitations in Sections 12 and 13 reflect a reasonable allocation of risk and are an essential basis of the bargain between you and us, and that our pricing reflects this allocation. These limitations apply even if a limited remedy fails of its essential purpose.
14. Indemnification
14.1 Your indemnity
You will defend, indemnify, and hold harmless CINTIMA LLC and its members, managers, employees, and agents from and against any third-party claims, and any resulting damages, liabilities, costs, and expenses (including reasonable attorneys’ fees), arising out of or relating to: (a) your breach of these Terms; (b) your violation of any law or any right of a third party; (c) Your Content, including any claim that it infringes, misappropriates, or violates the rights or privacy of any performer, production, or other third party; or (d) your use of the platform in connection with any production, performer, or third party.
14.2 Our indemnity
We will defend you against any third-party claim alleging that the platform, as provided by us and used by you in accordance with these Terms, directly infringes that third party’s U.S. patent, copyright, or trademark, and we will pay damages and costs finally awarded against you (or agreed by us in settlement) for such a claim. Our obligation is conditioned on you (a) promptly notifying us in writing, (b) giving us sole control of the defense and settlement, and (c) reasonably cooperating at our expense.
14.3 Exclusions and remedy
Section 14.2 does not apply to any claim arising from Your Content, from modifications not made by us, from combination of the platform with materials or services we did not provide, or from your use of the platform other than as permitted by these Terms. If the platform becomes, or in our opinion is likely to become, the subject of an infringement claim, we may at our option and expense (i) procure the right for you to continue using it, (ii) modify it to be non-infringing, or (iii) terminate the affected functionality and refund any prepaid, unused fees. Section 14.2 and this Section 14.3 state our entire liability and your sole remedy for any third-party intellectual-property claim. Our obligations under Section 14.2 are subject to the limitations in Section 13.
15. Disputes and Governing Law
15.1 Governing law
These Terms, and any dispute arising out of or relating to them or the platform, are governed by the laws of the State of California, without regard to its conflict-of-law rules, and (for arbitrability) by the Federal Arbitration Act.
15.2 Informal resolution first
Before starting an arbitration or court proceeding, you and we agree to try to resolve the dispute informally for at least sixty (60) days after written notice of the dispute (to support@intisafe.app for notice to us, or to your account email for notice to you). The notice must describe the dispute and the relief sought. This step is a condition to starting a formal proceeding; the limitations period is tolled while it runs.
15.3 Binding individual arbitration
Except for the matters carved out in Section 15.6, any dispute, claim, or controversy arising out of or relating to these Terms or the platform — including its formation, validity, breach, or termination — that is not resolved informally will be resolved by binding individual arbitration administered by JAMS under its Streamlined Arbitration Rules then in effect, before a single arbitrator. Arbitration will take place in Los Angeles County, California, or, at your election, by videoconference or (for claims of $10,000 or less) on documents only. The arbitrator decides all threshold questions of arbitrability except those reserved to a court by Section 15.4. Judgment on the award may be entered in any court of competent jurisdiction.
15.4 Class-action and jury-trial waiver
YOU AND WE AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate more than one person’s claims or preside over any representative or class proceeding. IF THE PRE-DISPUTE CLASS-ACTION WAIVER IN THIS SECTION IS FOUND UNENFORCEABLE AS TO A PARTICULAR CLAIM, THAT CLAIM (AND ONLY THAT CLAIM) WILL BE SEVERED AND HEARD IN COURT, AND THE REMAINDER WILL PROCEED IN ARBITRATION. WHERE ARBITRATION PROCEEDS, YOU AND WE EACH WAIVE ANY RIGHT TO A JURY TRIAL.
15.5 Arbitration fees; mass-arbitration
We will pay JAMS filing and arbitrator fees to the extent required by JAMS’ consumer-arbitration minimum standards; otherwise fees are allocated under the JAMS rules. If 25 or more similar demands are filed by or with the coordination of the same or coordinated counsel, the parties will follow JAMS’ mass-arbitration or batch procedures (if any) to stage and resolve them efficiently.
15.6 Carve-outs
Either party may (a) bring an individual claim in small-claims court if it qualifies, and (b) seek injunctive or other equitable relief in the state or federal courts located in Los Angeles County, California to protect intellectual-property rights or confidential information, without waiving arbitration for other claims. For any matter that proceeds in court, you consent to the exclusive jurisdiction and venue of those courts.
15.7 30-day opt-out
You may opt out of Sections 15.3–15.5 (arbitration, class-action waiver, and jury-trial waiver) by emailing support@intisafe.app within thirty (30) days after you first create your account, stating your name, account email, and that you opt out of arbitration. Opting out does not affect any other provision of these Terms. The acceptance timestamp recorded at your sign-up starts this 30-day window.
15.8 Consumers outside the U.S.
If you use IntiSafe as a consumer and the mandatory-arbitration, class-waiver, venue, or governing-law provisions of this Section are prohibited or unenforceable under the mandatory law of your country of residence, those provisions do not apply to you to the extent prohibited, and nothing in these Terms deprives you of the protection of mandatory consumer-protection rules or of the right to bring proceedings in your local courts where that right cannot be waived.
16. Changes to These Terms
We may update these Terms from time to time. When we make material changes, we will notify you via email or through the platform at least thirty (30) days before the changes take effect. Your continued use of IntiSafe after changes take effect constitutes acceptance of the updated Terms. If you do not agree to updated Terms, you must stop using the platform before the effective date.
The app records each user’s acceptance of a specific dated version of these Terms (including Schedule A) and re-prompts for acceptance when the version changes.
17. Miscellaneous
Entire agreement. These Terms (together with the Privacy Policy, the Data Processing Agreement in Schedule A, and any other documents referenced herein) constitute the entire agreement between you and IntiSafe with respect to the subject matter hereof.
Severability. If any provision is found unenforceable, the remainder of these Terms continues in full force and effect.
No waiver. Our failure to enforce any provision of these Terms does not waive our right to enforce it later.
Assignment. You may not assign these Terms or any rights under them without our prior written consent. We may assign these Terms in connection with a sale, merger, acquisition, or reorganization without your consent.
No agency. Nothing in these Terms creates a partnership, joint venture, employment relationship, or franchise between you and IntiSafe.
Headings. Section headings are for convenience only and do not affect interpretation.
18. Contact
Questions about these Terms? Contact us at:
CINTIMA LLC · support@intisafe.app
Schedule A — Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of, and is incorporated by reference into, the IntiSafe Terms of Service (the “Terms”) between you (the Intimacy Coordinator, “you” or “Controller”) and CINTIMA LLC, operator of IntiSafe (“CINTIMA,” “IntiSafe,” or “Processor”). You accept this DPA when you accept the Terms. A standalone, separately signable copy is available on request at support@intisafe.app. Where the Terms and this DPA conflict on the subject of data processing, this DPA controls.
A1. Definitions
Terms not defined here have the meaning given in the Terms or in applicable Data Protection Law. “Data Protection Law” means all laws applicable to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, and applicable US state privacy laws including the CCPA/CPRA. “Controller,” “Processor,” “Personal Data,” “Processing,” “Data Subject,” “Special Category Data,” “Personal Data Breach,” and “Sub-processor” have the meanings given in the GDPR (and the equivalent terms under other Data Protection Law, such as “business,” “service provider,” and “sensitive personal information” under the CCPA/CPRA).
A2. Roles of the Parties
A2.1 With respect to the Personal Data you enter into or process through IntiSafe (the “Controller Data”), you are the Controller and CINTIMA is the Processor. CINTIMA processes Controller Data only on your behalf and under your documented instructions.
A2.2 You determine what Personal Data is collected, from whom, for what purpose, and on what legal basis. CINTIMA does not determine the purposes or means of processing Controller Data and does not process it for its own purposes.
A3. Scope and Details of Processing
The subject matter, duration, nature, and purpose of the processing, and the categories of Data Subjects and Personal Data, are set out in Annex I.
A4. Your Instructions
A4.1 CINTIMA processes Controller Data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by law — in which case CINTIMA will inform you of that legal requirement before processing, unless the law prohibits it.
A4.2 Your instructions are: (a) the Terms and this DPA; (b) the configuration and use choices you make within IntiSafe; and (c) any further written instructions the parties agree.
A4.3 CINTIMA will inform you if, in its opinion, an instruction infringes Data Protection Law. CINTIMA has no obligation to monitor the lawfulness of your processing.
A5. The End-to-End Encryption Model
A5.1 IntiSafe applies true end-to-end encryption to Controller Data content. Controller Data content is encrypted on your device before it reaches CINTIMA’s systems, using a key held only by you. CINTIMA holds no key and no backdoor.
A5.2 As a result, CINTIMA processes Controller Data content only as ciphertext it cannot read, together with a limited layer of account and operational metadata described in Annex I.
A5.3 The parties acknowledge that this architecture shapes several obligations below. Where an obligation would require CINTIMA to access, read, produce in readable form, correct, or selectively delete the content of Controller Data, CINTIMA cannot perform it, because only you hold the key. In those cases CINTIMA’s obligation is limited to the assistance it can actually provide (for example, at the account, file-record, or metadata level), and you retain sole ability to action content-level requests using the export and management tools IntiSafe provides.
A6. Confidentiality
CINTIMA ensures that persons authorized to process Controller Data are bound by appropriate confidentiality obligations and access such data only on a need-to-know basis. Because content is end-to-end encrypted, authorized personnel can in any event access only ciphertext and metadata, not readable content.
A7. Security
A7.1 CINTIMA implements and maintains the technical and organizational measures set out in Annex II, designed to ensure a level of security appropriate to the risk.
A7.2 You acknowledge that the measures in Annex II are appropriate for the processing under this DPA, and that you are responsible for your own device security and for safeguarding your recovery key, without which encrypted content cannot be recovered by anyone, including CINTIMA.
A8. Sub-processors
A8.1 You grant CINTIMA general authorization to engage the Sub-processors listed in Annex III to process Controller Data in connection with providing IntiSafe.
A8.2 CINTIMA imposes on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remains responsible to you for each Sub-processor’s performance.
A8.3 CINTIMA will give you at least thirty (30) days’ notice of any intended addition or replacement of a Sub-processor (by updating the published Sub-processor list and notifying you), during which you may object on reasonable data-protection grounds. If the parties cannot resolve a reasonable objection, you may terminate the affected service as your sole remedy.
A9. Assistance to You
A9.1 Data subject rights. Taking into account the nature of the processing and Section A5, CINTIMA assists you by appropriate technical and organizational measures, insofar as possible, to respond to Data Subject requests. You acknowledge that, because content is end-to-end encrypted, you — not CINTIMA — action access, correction, portability, and content-level deletion requests using IntiSafe’s export and management tools; CINTIMA’s assistance is limited to account-, record-, and metadata-level actions.
A9.2 Security, breach, and impact assessments. CINTIMA assists you, taking into account the nature of processing and the information available to it, with security of processing, notification of Personal Data Breaches (Section A10), data protection impact assessments, and prior consultation with supervisory authorities.
A10. Personal Data Breach
A10.1 CINTIMA notifies you without undue delay after becoming aware of a Personal Data Breach affecting Controller Data, providing the information reasonably available to it to help you meet your own notification obligations.
A10.2 The parties acknowledge that, because Controller Data content is end-to-end encrypted and unreadable to CINTIMA, a compromise of CINTIMA’s storage would expose only ciphertext and account metadata, not readable content.
A11. Return and Deletion of Controller Data
A11.1 On termination or expiry of your IntiSafe account, and consistent with IntiSafe’s records-retention commitment, you retain read-only access to, and the ability to export, your Controller Data in PDF or JSON format at any time, at no charge, including after account closure. This continued access and export capability is the parties’ agreed method for the return of Controller Data.
A11.2 CINTIMA will not delete Controller Data except on your affirmative written instruction, or as otherwise required by law. On your written deletion instruction, CINTIMA will delete the encrypted Controller Data and associated records it holds within thirty (30) days and confirm deletion in writing, except for data CINTIMA must retain by law (such as billing records).
A12. Audits and Information
A12.1 CINTIMA makes available to you information reasonably necessary to demonstrate compliance with its processor obligations and this DPA, and allows for and contributes to audits on reasonable prior notice, no more than once per year absent a Personal Data Breach or regulatory requirement, subject to confidentiality and CINTIMA’s security policies. CINTIMA may satisfy this obligation by providing a relevant third-party certification, attestation, or audit report where available.
A12.2 The parties acknowledge that, given the end-to-end encryption model, an audit can verify CINTIMA’s controls and metadata handling but cannot access readable content, which CINTIMA does not hold in readable form.
A13. International Transfers
CINTIMA processes Controller Data in the United States and in the regions where its Sub-processors operate. Where your use of IntiSafe involves the transfer of Personal Data subject to GDPR, UK GDPR, or Swiss law to a country without an adequacy decision, the parties incorporate the applicable Standard Contractual Clauses (and the UK International Data Transfer Addendum / Swiss addendum as applicable), together with the supplementary measures described in Annex II, including end-to-end encryption.
A14. Special Category Data
Controller Data may include information that could be classified as Special Category Data under GDPR/UK GDPR or sensitive personal information under US state law. As the Controller, you are responsible for determining the applicable classification and for establishing a lawful basis and any required conditions for processing it. This allocation is consistent with the Privacy Policy.
A15. Your Obligations and Warranties
You warrant that you have a lawful basis for the processing you direct, that you have obtained all consents and provided all notices required from Data Subjects (including performers and production personnel), and that your instructions comply with Data Protection Law. This mirrors your representations in Terms Section 5.4 and the indemnity in Terms Section 14.1.
A16. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms (including the aggregate liability cap in Section 13), except to the extent Data Protection Law prohibits such limitation.
A17. Term
This DPA takes effect when you accept the Terms and continues for as long as CINTIMA processes Controller Data on your behalf. It is governed by the law and dispute-resolution provisions of the Terms, except where Data Protection Law requires otherwise (including, for EU/UK Data Subjects, mandatory local rules).
Annex I — Details of Processing
Subject matter. Provision of the IntiSafe intimacy-coordination workflow platform to you.
Duration. For the term of your IntiSafe account and as set out in Section A11.
Nature and purpose. Hosting, storage, encryption, transmission, and processing of Controller Data to enable you to run intimacy-coordination workflow, including script breakdown, director and actor calls, rider and consent documentation, shoot-day tracking, daily reports, and post-wrap records.
Categories of Data Subjects. Performers and actors; background performers; production personnel; and other individuals whose information you record.
Categories of Personal Data — Content (end-to-end encrypted; ciphertext only to CINTIMA): names and professional identifiers; body-exposure and garment/consent records; scene and rider documentation; and any other information you enter.
Categories of Personal Data — Account and operational metadata (accessible to CINTIMA): your name, email, country, professional role; billing records; authentication events; record identifiers, timestamps, and standard server/security logs.
Special Category Data. Content may include information that a controller could classify as sensitive or special category data. See Section A14.
Frequency. Continuous, for the duration of the account.
Annex II — Technical and Organizational Security Measures
• True end-to-end encryption of content — Controller Data content is encrypted on your device (client-side AES-256-GCM) before transmission; the encryption key is held only by you; CINTIMA holds no key and no backdoor.
• Encryption in transit — TLS/HTTPS for all connections.
• Access control — limited personnel access to systems holding Personal Data, on a need-to-know basis; content is in any event ciphertext to CINTIMA.
• Sub-processor controls — content stored with Sub-processors as encrypted blobs and records.
• Recovery-key model — you hold the sole recovery key; loss renders encrypted content permanently unrecoverable by any party.
• Security reviews — regular review of infrastructure and code.
Annex III — Approved Sub-processors
CINTIMA engages the following Sub-processors to process Controller Data in connection with providing IntiSafe:
• Clerk — Authentication and identity; membership and billing state. Data processed: name, email, sign-in method, account and membership status.
• Stripe (via Clerk Billing) — Payment processing. Data processed: name, email, billing address, payment details.
• Supabase — Database for records and metadata. Data processed: encrypted content records and account metadata.
• Cloudflare — Application hosting and encrypted file storage (R2). Data processed: encrypted file blobs; standard server and security logs.
• Loops — Transactional and marketing email. Data processed: email, name, role, country, and message content (for the contact form).
The Sub-processor list is kept current and published; changes are handled under Section A8.
Annex IV — Cross-Border Transfer Mechanism
Where applicable under Section A13, the operative Standard Contractual Clauses (controller-to-processor module), the UK International Data Transfer Addendum, and the Swiss addendum are incorporated by reference and available on request at support@intisafe.app.