Privacy

This is short because we collect very little. We are not an advertising business and we do not have anything to gain from knowing more about you than we need to take your money and play you a film.

Last updated 12 October 2026

The short version

We keep your email address, and your name if you gave us one.
We never see your card. Stripe handles payment; we are told whether it worked.
There is one cookie, and it is the one that keeps you signed in. No advertising cookies, no third-party trackers, no pixel from anybody.
We do not sell your data, share it for marketing, or profile you.
Ask us to delete you and we will.

Who is responsible

The data controller is Cyberpunk Studios Ltd, trading as Cyberpunk Studios, at 114 St Luke's Road, Southend-on-Sea, Essex, SS2 4AD, registered with the Information Commissioner’s Office as ZC267803. For anything on this page, write to contact@cyberpunkstudios.co.uk and a person will answer.

What we collect, and why

Email address	So you can sign in, so we can send your receipt, and so we can reach you if something goes wrong with an order. Lawful basis: performing our contract with you.
Your name	Optional on an account. Required if you write to us through the form, because we need to know who we are replying to. Lawful basis: contract, or your consent on the enquiry form.
What you have bought or subscribed to	So we can let you watch it. It is kept with your account, one record per purchase — and whether it was refunded — with what you watched and downloaded recorded against it. Lawful basis: performing our contract with you.
When you pressed play or took a download, and from where	The time, and the town and country your connection comes from — never your address or your exact location. Each 24 hours after you press play is one record, however often you pause. We need the times to work out what each film’s streaming costs the studio. We use the town to spot a film being shared — one account playing in two places at once. We look at it; nothing is blocked automatically. The town and country are cleared after 90 days. Lawful basis: our legitimate interest in knowing what each film costs to stream, and in stopping films being shared.
Payment information	Handled entirely by Stripe. We receive your email, whether the payment succeeded, and a reference. We never receive your card number. Lawful basis: contract, and our legal duty to keep records of sales.
Delivery address and phone	Only if you order a poster or a disc, and only so it can reach you. Collected by Stripe at the checkout. A disc we post ourselves, so your name, address and phone are emailed to the two people who run the studio for that; a poster’s go to whoever prints and posts it. Lawful basis: performing our contract with you.
Who sent you, and who you sent	If you joined from somebody’s link, whose it was — so they can be credited — and the code in your own link, which every account has. Never public. The credit itself is held by Stripe on their account, not by us; somebody who has never paid us has a Stripe account made for it the first time they earn some. Lawful basis: contract — it is how the credit the scheme promises is paid.
A filmmaker’s page	Only if your films are on the site. The name you choose, where you are based, what you write about yourself and a photo, if you add one — public, because a page is for publishing. You write it and change or remove it in your own portal; we can take a page off the site too. What your films earn is never on it. Lawful basis: your consent — you choose what goes on it, and can take it down whenever you like.
A filmmaker’s payouts	Only if your films are on the site. You set up payouts with Stripe, which collects who you are and your bank details and keeps them — we never see your bank details. We keep the reference of your Stripe payout account, the country of your bank and the currency Stripe pays you in, what Stripe says of it (set up, or what it still needs), your balance line by line, and every withdrawal you make. Lawful basis: performing our contract with you — paying you your share — and our legal duty to keep records of what we paid.
A video call with us	Only if we invite you. Your name and email address, to send the invitation, a reminder and your own link; whether you joined; and, if the call may be recorded, that you agreed. A call is not kept unless it was recorded — which is only ever with your agreement, asked before you join — and then we keep the recording in our own storage, for Cyberpunk Studios’ own use only. Cloudflare runs the call; its AI transcripts and summaries are switched off. The call remembers the camera and microphone you chose, on your own device, and sets no cookie. Lawful basis: our legitimate interest in talking to the filmmakers we work with; for a recording, your consent.
Checking films for AI	If you make films here, or appear in one. Each week we take still frames from a few films chosen at random, and look at their posters and pictures, to check that nothing in them was generated by AI. The pictures alone are sent to Hive, a checking service, which scores them — on terms that it keeps none of them and trains nothing on them. We keep the score and the moment in the film, never the picture, and a person looks at anything the score flags. Lawful basis: our legitimate interest in keeping our promise that nothing here was generated by AI.
Server logs	Our host records requests, including IP addresses, for a short period. This is how anybody keeps a website running and secure. Lawful basis: our legitimate interest in a working, secure site.
How films are watched	See Knowing what people watch, below.

Cookies

There is one, and it is necessary. It is called cps_session, it lasts 30 days, it cannot be read by JavaScript, and it holds who you are signed in as. It is signed, so it cannot be edited into giving somebody access they did not buy.

That is a cookie strictly necessary to provide a service you asked for, which is why this site does not throw a consent banner at you. If we ever add anything that is not strictly necessary, you will get a proper choice first, and this page will say so before it happens.

Knowing what people watch

We want to know how much of a film people watch and where they stop. It is how a studio learns whether an opening is working. We are honest about wanting it, and about the line we will not cross:

Aggregate and anonymous. We count how many people reached the ten-minute mark of a film. We do not build a record of what you personally watched, and we do not link viewing to your account for marketing or profiling.
Not shared with advertisers. There are none.
Shared in the aggregate with the filmmaker whose film it is — they are owed a statement, and they deserve to know how their work landed. It is numbers, never names.

Lawful basis: our legitimate interest in understanding whether our own films work, balanced against a privacy impact we have kept to near enough nothing by not identifying anybody. You can object — write to us.

This is separate from the record of your viewings and downloads described above. That one is kept with your account because it is what you bought; how far people get through a film is counted with no account attached at all, and the two are never joined.

Not switched on yet. This page will be dated again when it is.

Who else touches your data

We use a small number of suppliers, each doing one job. They process data on our instructions and cannot use it for their own purposes.

Stripe	Payments and subscriptions, and paying filmmakers. Holds card data and filmmakers’ bank details, which we never see.
Cloudflare	Stores and delivers the video, and runs our video calls.
Vercel	Hosts the site, keeps the server logs, and stores the pictures on it.
PRINT SUPPLIER	Prints and posts posters. Gets your delivery address, nothing else.
Resend	Sends receipts and replies to enquiries.
Hive	From when our AI checks are switched on: scores still frames and pictures from films for signs of AI generation, keeping none of them and training nothing on them.

Some of these are based outside the UK. Where data goes abroad it is protected by the safeguards UK law requires — standard contractual clauses, or the UK’s own adequacy arrangements with that country.

We will also hand over information if the law genuinely requires it. We will tell you if that happens, unless we are forbidden from doing so.

How long we keep things

Your sign-in cookie — 30 days, then it expires by itself.
Records of what you bought — six years, because HMRC requires records of sales to be kept that long.
When you watched and downloaded — as long as the purchase it belongs to; the town and country on it, 90 days.
Enquiries you send us — until the conversation is clearly over, then a year.
Server logs — a short period set by our host, typically days.

What you can ask for

Under UK data protection law you can ask us to:

Tell you what we hold about you, and give you a copy.
Correct anything wrong.
Delete it. We will, unless we are legally required to keep a sales record — and we will tell you if that applies.
Stop or restrict a particular use, including the viewing statistics above.
Hand it to you in a portable format.

Email contact@cyberpunkstudios.co.uk. We will answer within a month, and it is free.

If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first and gave us a chance to fix it.

Children

This is not a service for children, and some of the films carry certificates that say so. We do not knowingly collect information about anybody under 13. If you think we have, tell us and we will remove it.

Changes

If we change what we collect or what we do with it, we will update this page and change the date at the top. If the change is significant — a new supplier seeing your data, or a new use for it — members will get an email before it takes effect.