Privacy policy

This policy explains how Cutscene (“we”) uses personal data when you visit this website, when you contact us, when we contact you about our services, and when we work together. It gives you the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is:

Company

Cutscene

Legal form and registration

Mathieu Neumar, entrepreneur individuel (EI), nom commercial Cutscene — SIRET 893 491 605 00026 — TVA non applicable, art. 293 B du CGI

Postal address

51 rue du Général Leclerc, 94270 Le Kremlin-Bicêtre, France

Person in charge

Mathieu Neumar

Privacy contact

mathieu@cutscene.studio

Our postal address may be a business domiciliation address. Mail sent there reaches us, but the quickest way to reach us about your data is by email.

2. What we process, why, and on what legal basis

When you contact us (contact form or email)

• Data: your name, work email, company, product website, what you need, budget, timeline and message.
• Purpose: answering you and preparing a quote.
• Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)).

When we work together (clients)

• Data: contact details of the people we work with, project communications, and billing information.
• Purpose: delivering the project, invoicing and accounting.
• Legal basis: performance of the contract (Art. 6(1)(b)) and our legal obligations for accounting records (Art. 6(1)(c)).

When we contact you first (B2B prospecting)

• Data: your professional email address, first and last name, job title or role, your company’s name and website, and public information about the company (its product, recent launches, country and language). We never collect information about your private life.
• Purpose: sending you a small number of individual business emails about our video services. We only write when the message relates to your professional function, for example to a founder or a head of marketing about a product launch.
• Legal basis: our legitimate interest in offering our services to businesses (Art. 6(1)(f)), within the framework the CNIL sets for business-to-business prospecting. You can object at any time, see section 8.

When you browse this website

• Data: technical data such as your IP address and browser type, processed by our host to deliver and secure the site. Your IP address is also used briefly, in memory, to limit abuse of the contact form and of our audience measurement.
• Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f)).
• Audience measurement and cookies: see section 6.

3. Where prospect data comes from

When we contact you first, we found your professional details in public sources: the company’s own public web pages (such as its contact, team or about pages) and public launch posts, for example on Hacker News. Every email we send names the exact page where we found your address.

We don’t buy contact lists, and we don’t collect data from websites whose terms forbid it or from profiles whose visibility is restricted.

4. Who receives your data

We don’t sell or rent personal data. Only the founder has access to it, along with these service providers, who act as our processors:

• Google Workspace (Google), for sending and receiving email.
• Google Cloud (Google Cloud France SARL), which hosts this website and its videos in the European Union (Belgium). When you send the contact form or unsubscribe, your request waits in a private Cloud Storage space in the same region until our own system collects it, and that copy is deleted 90 days later. The page views counted by our audience measurement pass through the same space and are deleted once our system has collected them.
• Google Analytics (Google Ireland Limited), only if you accept it in the cookie banner: audience statistics, see section 6.
• Anthropic, an automated text-processing service that helps us draft emails and sort the replies we receive. It receives only what the task needs: public company information, professional contact details and the content of replies. A person reviews and approves emails before they are sent.
• An email verification service, if we use one to check that an address exists before writing to it. We will name it here when we do.

5. Transfers outside the EU

Some of these providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework when the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

6. Audience measurement and cookies

Our emails contain no tracking pixels and no tracked links: we don’t measure whether or when you open or click them, in line with the CNIL recommendation of March 12, 2026 (deliberation 2026-042).

Audience measurement without cookies

To know how many people visit this website and what they read, the site counts its own page views, without cookies.

• What is recorded for each page view: the address of the page (for example /en/privacy), the domain of the website you came from (for example google.com, never the full address), the campaign tags of the link you followed, if any (utm_source, utm_medium, utm_campaign), the type of device (mobile, tablet or computer, deduced from your browser’s identification, which is not kept), the language of the page and of your browser, whether you arrived from another website, and the date and time.
• What is not: no cookie, no identifier, and your IP address is not stored. Page views are not linked to one another, and nothing follows you to other websites.
• Purpose: audience statistics for this website (visits, pages viewed, where visits come from), and nothing else.
• Legal basis: our legitimate interest in knowing how our website is used (Art. 6(1)(f)). Because it is strictly limited to audience measurement, it needs no consent, under the exemption the CNIL grants to this kind of measurement (Article 82 of the French Data Protection Act).
• Retention: 25 months, then deleted.
• How to object: turn off the switch below, and your visits from this browser are no longer counted (the choice is kept in your browser’s local storage, as cutscene.measure). If your browser sends the Global Privacy Control signal, your visits are not counted at all.

Google Analytics, only if you accept

• How it works: if you click “Accept” in the cookie banner, we also use Google Analytics, a service of Google Ireland Limited, to understand our visits better. If you decline, or until you choose, Google Analytics is not loaded and receives nothing.
• Data: the pages you view and how you move through the site, technical information about your device and browser, and an approximate location.
• Cookies: _ga and _ga_TCWMJ9HVRG, which tell visitors and their visits apart. They expire after 13 months at most.
• Settings: Google signals and ad personalization are turned off, and Google Analytics keeps the data for 14 months.
• Legal basis: your consent (Art. 6(1)(a), and Article 82 of the French Data Protection Act).
• Transfer: data may be transferred to Google LLC in the United States, under the EU–US Data Privacy Framework.
• Withdrawing your consent: at any time, with the “Cookies” link at the bottom of every page or the “Manage cookies” button below. We then delete the Google Analytics cookies from your browser.

Your choice and other cookies

• Your choice in the cookie banner is kept for 6 months in your browser’s local storage (cutscene.consent). After that, we ask again.
• Apart from Google Analytics, the only cookie this website can set is NEXT_LOCALE, which remembers the language you chose, for one year. It is strictly functional and needs no consent.

7. How long we keep it

• Prospects who don’t engage: deleted after 12 months. In every case, prospect data is never kept longer than 3 years after the last contact that came from you, such as a reply.
• Inquiries that don’t lead to a project: 3 years after your last message.
• Clients: for the duration of the contract, then archived for as long as the law requires (accounting records: 10 years).
• Do-not-contact list: when you object or unsubscribe, we keep your email address (and, if you ask, your company’s domain) for 3 years, only to make sure we never contact you again.
• Audience statistics: 25 months; Google Analytics data, if you accepted it: 14 months (section 6).

8. Your rights

You also have the right to:

• access your data and get a copy of it;
• have it corrected if it is wrong;
• have it erased;
• restrict how we use it;
• receive the data you gave us in a portable format;
• object to any processing based on our legitimate interest.

To exercise these rights, write to mathieu@cutscene.studio or to our postal address. We answer within one month. If we have a reasonable doubt about your identity, we may ask you to confirm it.

9. Complaints

If you think we are not handling your data properly, you can lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr), or with the authority of the EU country where you live or work.

10. Automated decisions

We don’t make decisions about you based solely on automated processing. Automated tools help us draft and sort emails, but a person decides who we contact and approves what we send.

11. Changes to this policy

We will update this page if our practices change. The date at the top shows the latest version.