Privacy policy

Who we are

Cinema Priority ("we", "us") runs an alert service for IMAX 70mm cinema ticket restocks and new showtimes at cinemapriority.co.uk. We are the data controller for the personal data described in this policy and we process it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For anything privacy-related, contact privacy@cinemapriority.co.uk.

The data we collect

• Account details: your name, email address and password. Passwords are stored only as secure hashes; we never see or store them in plain text. If you sign in with a magic link, we store the short-lived verification token needed to complete sign-in.
• Session and security data: when you log in we record a session token together with the IP address and browser identifier it was created from, so we can keep your account secure and let you stay signed in.
• Membership and billing data: your membership tier and status, together with Stripe customer and subscription references. Payments are handled by Stripe; your card details go directly to Stripe and are never stored on our servers.
• Country signal: our hosting provider tells us which country a request comes from so we can show prices in the right currency. We use this per request and do not build a location history.
• Correspondence: anything you send us by email, including privacy requests.

We do not run advertising or analytics trackers and all fonts and assets are served from our own domain rather than third-party networks.

How we use it and our lawful bases

• To provide the service (performance of a contract): running your account and membership, delivering the alerts you have signed up for, sending service messages such as sign-in links and billing notices and taking payment through Stripe.
• To keep the service secure (legitimate interests): detecting and preventing fraud, abuse, scraping and unauthorised access, using session and security data.
• To improve the product (legitimate interests): understanding how memberships are used so we can fix problems and improve coverage.
• To meet legal obligations (legal obligation): keeping billing records we are required to retain for tax and accounting purposes.

We do not sell your personal data, we do not send marketing without your consent and we do not make automated decisions about you that have legal or similarly significant effects.

Who we share it with

We share personal data only with the processors we need to run the service: Stripe (payments and billing) and Cloudflare (hosting, database and session storage). When we send sign-in links or service messages by email, an email delivery provider processes your email address on our instructions. Each processor acts under contract. If you choose to join the members' Discord server, Discord processes your data under its own privacy policy. We may also disclose data where the law requires it.

International transfers

Some of our processors store or process data outside the UK, including in the United States. Where that happens we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or standard contractual clauses.

How long we keep it

We keep account data for as long as your account exists. If you close your account or ask us to delete it, we delete or anonymise your personal data without undue delay, except billing records, which we keep for up to six years where UK tax law requires it. Sessions and magic-link tokens expire automatically and are periodically removed.

Your rights

Under the UK GDPR you have the right to access your personal data, correct it, delete it, restrict or object to our processing of it and receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time. To exercise any of these rights, email privacy@cinemapriority.co.uk. We respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use only essential cookies: the session cookie that keeps you signed in. We set no advertising or analytics cookies. If you pay for a membership, Stripe may set its own cookies on its checkout pages under its own policy. Full detail is in our cookies policy.

Changes to this policy

If we change this policy we will update this page and the date at the top. Significant changes will be flagged to members by email or in their account. This policy is governed by the laws of England and Wales.