Privacy policy

Who we are

Cinema Priority ("we", "us") runs an alert service for IMAX 70MM cinema ticket restocks and new showtimes at cinemapriority.co.uk. We are the data controller for the personal data described in this policy and we process it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For anything privacy-related, contact hello@cinemapriority.co.uk.

The data we collect

• Account details: your name, email address and password. Passwords are stored only as secure hashes; we never see or store them in plain text. If you sign in with a magic link, we store the short-lived verification token needed to complete sign-in.
• Social sign-in details: if you choose to continue with Google or Discord, that provider sends us your name, email address, whether they have verified it and your profile picture, along with the account identifier that lets us recognise you next time. We store the provider access and refresh tokens encrypted, so the connection keeps working. We do not store provider ID tokens. We never receive your password for that account, and we ask them for nothing beyond your basic profile and email address. When you connect Discord we record whether that attempt succeeded or failed, including the error code, so we can tell when the connection is broken. You can disconnect a provider at any time from your account page.
• Session and security data: when you log in we record a session token together with the IP address and browser identifier it was created from, so we can keep your account secure and let you stay signed in.
• Membership and billing data: your membership tier and status, together with Stripe customer and subscription references. Payments are handled by Stripe; your card details go directly to Stripe and are never stored on our servers.
• Country signal: our hosting provider tells us which country a request comes from so we can show prices in the right currency. We use this per request and do not build a location history.
• Correspondence: anything you send us by email, including privacy requests.

We do not run advertising or analytics trackers and all fonts and assets are served from our own domain rather than third-party networks.

How we use it and our lawful bases

• To provide the service (performance of a contract): running your account and membership, delivering the alerts you have signed up for, sending service messages such as sign-in links and billing notices and taking payment through Stripe.
• To keep the service secure (legitimate interests): detecting and preventing fraud, abuse, scraping and unauthorised access, using session and security data.
• To improve the product (legitimate interests): understanding how memberships are used so we can fix problems and improve coverage.
• To meet legal obligations (legal obligation): keeping billing records we are required to retain for tax and accounting purposes.

We do not sell your personal data, we do not send marketing without your consent and we do not make automated decisions about you that have legal or similarly significant effects.

Who we share it with

We share personal data only with the processors we need to run the service: Stripe (payments and billing) and Cloudflare (hosting, database and session storage). When we send sign-in links or service messages by email, an email delivery provider processes your email address on our instructions. Each processor acts under contract. If you choose to join the members' Discord server, Discord processes your data under its own privacy policy. We may also disclose data where the law requires it.

Signing in with Google or Discord works the other way round: you are sending data to us rather than us sharing data with them. When you press one of those buttons you are taken to that company's own sign-in page, where it decides what to ask you and sets its own cookies under its own privacy policy. It tells us that you approved the connection and passes on the details listed above. Those companies are not acting as our processors when they do this, they are separate controllers of your relationship with them, and we cannot see anything else in your account with them.

International transfers

Some of our processors store or process data outside the UK, including in the United States. Where that happens we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or standard contractual clauses.

How long we keep it

We keep account data for as long as your account exists. You can request deletion from your account page. That starts a 30-day grace period where you can sign in and restore the account. If you do not restore, we erase or anonymise personal data from our systems shortly after that window ends.

• When you request deletion: sign-in methods (email, Google, Discord) stay usable for the 30-day restore window. If you have a paid plan, you stay in the Cinema Priority Discord server until that billing period ends; otherwise we remove you from Discord when deletion is requested.
• Deleted promptly after the grace period: your profile (name, email, avatar), sign-in methods, sessions, Discord OAuth link, alert rules, and membership entitlement rows tied to your account.
• Billing and tax (up to six years): invoices, payment records and related identifiers held by Stripe as our payment processor, where UK tax and accounting law requires retention. We do not keep your card number.
• Transactional email logs (up to two years): anonymised send and delivery records (for example that a password-reset or deletion confirmation was sent), without a usable email address, so we can investigate delivery problems and abuse.
• Operational alert receipts: technical delivery receipts keyed only by an opaque member id with no name or email, kept for service reliability and then aged out with our normal log rotation.
• Sessions and one-time links: expire automatically and are periodically removed.

If you restore within the 30 days, your account data stays as it was. A paid subscription that was set to end at the period boundary does not restart unless you choose Keep my paid plan.

Your rights

Under the UK GDPR you have the right to access your personal data, correct it, delete it, restrict or object to our processing of it and receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time. You can start account deletion yourself from your account page. For other rights, or if you cannot access the account, email hello@cinemapriority.co.uk. We respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use only essential cookies: the session cookie that keeps you signed in. We set no advertising or analytics cookies. If you pay for a membership, Stripe may set its own cookies on its checkout pages under its own policy. Full detail is in our cookies policy.

Changes to this policy

If we change this policy we will update this page and the date at the top. Significant changes will be flagged to members by email or in their account. This policy is governed by the laws of England and Wales.