CRE Productions

Privacy Policy

What personal information the CRE Productions web application collects, why, who we share it with, and the choices you have.

Effective September 8, 2026

1. Who we are and what this covers

CRE Productions (COMMERCIAL REALESTATE PRODUCTIONS LLC) ("CRE Productions", "we", "us", or "our") is a commercial real estate photography and content production company. This Privacy Policy explains how we handle personal information in the CRE Productions web application at https://cre-productions.vercel.app and every portal within it (the "Application").

It covers the people who sign in to the Application: our staff, our clients and their colleagues, and the contractors who perform production work for us. It does not cover our marketing website, our social media pages, or how a client handles information in its own systems.

For most client and contractor data, we act as the controller of our own business records. Where we process personal information contained in material a client sends us for a specific project, we do so on that client's instructions.

2. Information we collect

Category	Examples	Where it comes from
Account and identity	Name, work email address, phone number, account type, assigned roles and permissions, employer or organization.	You, your employer, or our staff when an account is created.
Authentication	Credentials associated with your account, session cookies, and sign-in timestamps.	Generated when you sign in.
Project and production	Property addresses and details, shoot dates and durations, shot lists and briefs, assignments, deliverable lists, status history, quality-control notes.	You, our staff, and contractors working the project.
Communications	Comments, change requests, approvals and sign-offs, notification records, and emails we send you through the Application.	You and our staff.
Commercial and financial	Orders, packages and add-ons, invoice and payment status, contractor rates and earnings, commissions.	You, our staff, and our accounting system.
Content and media	Photographs, video, and social media material, together with the file and folder links that point to them, and any people or property visible in that material.	Produced by us or uploaded by contractors and clients.
Technical and audit	IP address, browser and device type, pages requested, timestamps, and an audit record of changes made in the Application.	Collected automatically when you use the Application.

We do not ask for and do not want government identifiers, payment card numbers, health information, biometric data, precise device location, or any other special-category data. Please do not put it into the Application.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles.

3. How we use information

We use personal information to:

create accounts, authenticate you, and keep you signed in;
run production work — scheduling shoots, assigning crew, tracking status, reviewing quality, and delivering finished work;
show you your projects, deliverables, and history in the portal appropriate to your account type;
send transactional messages: sign-in messages, assignment notices, status updates, delivery notices, invoices, and reminders;
prepare quotes and invoices, track payments, pay contractors, and keep our financial records;
provide support, investigate problems, and maintain an audit trail of who changed what;
secure the Application, detect and prevent abuse or unauthorized access, and enforce our terms; and
comply with legal, tax, accounting, and insurance obligations.

We do not send marketing email through the Application. Transactional messages are part of the service and cannot be turned off individually while your account is active, though we will honour a request to stop non-essential notifications where the Application supports it.

We do not use personal information to train machine learning models, and we do not make decisions producing legal or similarly significant effects about you by automated means alone.

4. Legal bases (UK and EEA users)

If the UK GDPR or EU GDPR applies to you, we rely on these legal bases:

Performance of a contract — to provide the Application and carry out the production work you or your employer engaged us for.
Legitimate interests — to secure the Application, keep audit records, prevent fraud and abuse, run and improve our business, and communicate about live projects. We balance these against your rights.
Legal obligation — to meet tax, accounting, and other statutory requirements.
Consent — only where we ask for it, and you may withdraw it at any time without affecting prior processing.

5. Cookies and similar technologies

The Application uses cookies that are strictly necessary to operate it. They hold your session so that you stay signed in as you move between pages, and they expire when the session does.

We do not use advertising cookies, third-party analytics trackers, pixels, or cross-site tracking in the Application. Blocking the necessary cookies will prevent you from signing in.

6. Who we share information with

We share personal information only as described here. Access inside the Application is enforced per account: you see only the projects and records provisioned to you.

We use the following service providers to run the Application. Each processes information on our instructions under a contract, and each has its own privacy policy:

Provider	What it does	What it processes
Supabase	Database, authentication, and file services.	Account, project, communication, financial, and audit data.
Vercel	Application hosting and delivery.	Request metadata, IP address, and operational logs.
Resend	Transactional email delivery.	Recipient name and email address, and message content.
Dropbox	Storage of photo and video files, raw and finished.	Media files, filenames, and folder structure.
Vimeo and Google Drive	Hosting for video and document deliverables we link to.	Media files and the links that reach them.
Slack	Internal and contractor notifications, where a workspace is connected.	Assignment details, project and property details, and recipient identity.
Intuit QuickBooks Online	Invoicing and accounting.	Client billing contact, invoice line items, and payment status.

We also share information:

with the contractors assigned to a project, limited to what they need to perform it;
with the client organization a project belongs to;
with our professional advisers — accountants, auditors, insurers, and lawyers — under a duty of confidence;
when required by law, subpoena, or other legal process, or to establish, exercise, or defend legal claims;
to protect the rights, property, or safety of any person, or to investigate suspected fraud or a security incident; and
with a successor in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. How long we keep information

We keep personal information for as long as it serves the purpose it was collected for, and then for as long as we need it for legal, tax, accounting, insurance, and dispute-resolution purposes. In practice:

Account records are kept while the account is active, and for a reasonable period after it closes so that project history remains attributable.
Project and production records, including comments, approvals, and status history, are kept as part of our permanent business record of the work.
Financial and invoicing records are kept for the period our tax and accounting obligations require, typically at least seven years.
Media files are kept according to the retention terms of the relevant engagement; the Application is not a long-term archive, and links may be removed after a project closes.
Authentication logs and audit records are kept for a limited period appropriate to security investigation.

8. How we protect information

We maintain technical and organizational measures appropriate to the risk, including encryption of data in transit, access controls enforced on every record rather than in the user interface alone, protected storage of credentials, and internal logging of changes made in the Application. We review these measures as our systems change.

No system is perfectly secure. We cannot guarantee the security of information transmitted to or from the Application, and you share it at your own risk. If we become aware of a breach affecting your personal information, we will notify you and any regulator as applicable law requires.

9. Your rights and choices

Subject to your jurisdiction and to our legal obligations, you may have the right to:

know what personal information we hold about you and get a copy of it;
correct information that is inaccurate or incomplete;
delete information, where we are not required to keep it;
restrict or object to certain processing, including processing based on our legitimate interests;
receive information you provided in a portable format;
withdraw consent, where we relied on it; and
be free from discrimination for exercising any of these rights.

To exercise a right, email sam@cre-productions.com from the email address on your account. We will verify your request and respond within the time applicable law allows. You may use an authorized agent where the law permits; we will ask for proof of authority.

If you are in the UK or the EEA, you may lodge a complaint with your local supervisory authority. If you are in California, note again that we do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information beyond the purposes permitted without an option to limit it.

If we hold information about you because a client sent it to us for a project, we will refer your request to that client and support them in responding.

10. Where information is processed

We operate in the United States, and our service providers process information there and in other countries where they operate. If you are outside the United States, your information will be transferred to and processed in a country whose data protection laws may differ from your own. Where a transfer is subject to UK or EU law, we rely on approved safeguards such as the European Commission's standard contractual clauses.

11. Children

The Application is a business tool for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy. When we do, we will change the effective date above, and where a change is material we will give notice in the Application or by email before it takes effect. Please review this page from time to time.

13. Contact us

For privacy questions or requests, email sam@cre-productions.com, addressed to CRE Productions (COMMERCIAL REALESTATE PRODUCTIONS LLC).