Privacy Policy
Last updated 24 September 2026
This explains what 10AM does with personal data. Good Software Inc is the controller for the data described here. Where a studio uses 10AM to hold information about its own clients and crew, the studio is the controller and we are its processor.
What we collect
Account data: your name, your email address, the sign-in codes we send you, and a record of your sessions including IP address and browser, so you can see and end them. Studio data: everything you put in -- clients and their contacts, projects, shooting lists and the spreadsheets they came from, shoot days, call sheets, offers, invoices, receipts, notes and photographs. Client access: when a studio invites somebody to a client page, we store that person's email address and a hashed password, and we record when they last opened it. Notes they leave carry their email address, which everybody with access to that page can see. Activity: a log of what happened in your studio -- who did what and when -- so a studio can see its own history.
Why we use it
To run the service, to sign you in, to send transactional email such as sign-in codes and invitations, to keep the service secure, and to meet our legal obligations. We do not use your data for advertising and we do not sell it.
Where it is kept
The application and its database run in Frankfurt, Germany. Uploaded files -- photographs, spreadsheets, documents -- are stored with Cloudflare R2. Some providers below are based outside the EU; those transfers rely on the European Commission's standard contractual clauses.
Who else processes it
Render, for hosting and the database. Cloudflare, for file storage and delivery. Postmark, for transactional email. It receives the recipient address and the contents of the message. Anthropic, for reading a shooting list. When a spreadsheet is uploaded, we send its column headings and up to twenty-five sample rows so the columns can be identified. We do not send the whole file, and the data is not used to train models. Google, for address autocomplete. What somebody types into an address field is sent to the Google Places API while they type. Slack, only if a studio connects one: activity messages from that studio are then posted to the channel it chose.
Artificial intelligence
10AM uses a model in one place: working out which column of an uploaded spreadsheet holds the product code, the description and the colour. It names columns. It never writes a value into your data, and every value in your shooting list comes from the file you uploaded.
How long we keep it
Your studio's data is kept while the studio is open. Invoices and the records behind them are kept as long as the law requires, which in Germany is ten years. Sign-in codes expire within minutes; sessions end when you sign out or when you end them.
Your rights
You may ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict it. Write to us and we will answer within a month. You may also complain to a data protection authority. If the data is about you but held by a studio using 10AM -- because you are their client or their crew -- ask the studio first. We will help them answer.
Cookies
One cookie, to keep you signed in, and a short-lived one to remember that you have opened a client page you were given a password for. No advertising cookies and no third-party tracking.
Security
Traffic is encrypted. Passwords for client pages are stored hashed and cannot be read back, by us or by the studio. Access to a studio's data is limited to the people it has invited.
Contact
Write to hello@10am.app with anything about this policy, including a request about your own data.
Good Software Inc