Privacy policy

Spell Movies is operated by Spell Movies, LLC. When this policy says we or us, it means that company. We decide what personal data is collected on this service and why, which makes us the controller of it under European and United Kingdom data protection law.

You can reach our privacy team at the address in the contact section at the end of this policy.

We have kept the list short on purpose. Everything here is either needed to run the service or is something you have separately agreed to.

We do not collect payment card numbers. Payment is taken by the payment provider for your platform, which sends us a record of the outcome and never sends us the card.

We do not use any third party tracker, advertising pixel or analytics software development kit. Nothing on this service reports your behaviour to another company.

This part is unusual enough to be worth explaining plainly, because it is the reason the analytics we do collect is much less revealing about you than it would ordinarily be.

Behavioural analytics is stored in a separate analytics store from the account database. Your account identifier never reaches it. Instead your account carries a second identifier that is generated at random and that means nothing outside our systems, and only that one is written to the analytics store. The only thing that connects the two is a single column in the account database, and that column is deleted when your account is deleted.

Your network address and the identifying string your browser or app sends are not written to the analytics store at all. They are used at the edge to route the request, to work out which country you are in, and to stop one caller flooding the service, and the address is reduced to a one way value for that last purpose.

The rule is enforced on our servers rather than in the app. If you have turned analytics off, an event sent by a modified client is refused when it arrives, not merely ignored by the app that sent it. Events our own servers raise about an account that has opted out are given a throwaway identifier that joins to nothing.

If you are in the European Economic Area or the United Kingdom, the law asks us to name a legal basis for each use. These are ours.

Analytics, personalisation and marketing are three separate choices and all three start switched off. Nothing is pre ticked and closing the banner does not count as agreement.

Every choice you make is recorded against the version of these policies that was published when you made it, along with the date and where in the product you were asked. We never overwrite an earlier answer. If you change your mind we write a new record, so the history of what you agreed to and when is complete.

When we change these policies in a way that matters, we publish a new version and ask you again. Until you answer, the new version does not carry your consent.

You can change any of the three at any time in the privacy section of your account.

We do not sell your personal data, and we do not share it for anyone else's advertising.

The companies that help us run the service see the parts of it they need to do their job, and nothing more. They are bound by contract to use it only for us. They are, in the categories that matter to you:

• Our cloud infrastructure provider, which hosts the database, the video and the analytics store.
• Our sign in provider, which operates the Spell ID account system.
• The payment providers for the platform you subscribed on, which take payment and tell us the outcome.
• Our email provider, which sends account messages such as sign in confirmations and receipts.
• The speech and language services used to produce our subtitles and dubs. These process the film, not you.

We report anonymous, aggregated viewing figures to the studios and rights holders we license films from, because our licences require it. Those reports contain counts and durations. They do not contain anything that identifies you.

We will disclose personal data if a court or an authority lawfully compels us to, and if the business is sold or merged, to the buyer, who would then be bound by this policy until they published a replacement.

Our systems run in the United States. If you use the service from outside the United States, your personal data is transferred there and processed there.

For viewers in the European Economic Area, the United Kingdom and Switzerland, that transfer is made under the safeguards required by law, and we will name the specific mechanism in this section. You may ask us for a copy of the safeguards at the contact address below.

The fourteen day backup window is the one honest caveat on deletion. When you delete something we delete it from the live systems straight away. It remains inside encrypted backups until those backups expire, and nobody reads a backup except to recover from a failure.

Depending on where you live you have some or all of these rights. We honour all of them for everyone, wherever you are, because maintaining two standards would be worse than maintaining one.

• Get a copy. Download everything we hold against your account as one file, from the privacy section of your account. It includes your profiles, your viewing progress, your list, your ratings, your devices, your payment records and your full consent history.
• Correct it. Change your details in your account, or write to us for anything you cannot change yourself.
• Delete it. Delete your account from the privacy section of your account. This removes your profiles, your devices, your viewing history and your identity from our systems, and removes your events from the analytics store. It cannot be undone.
• Withdraw consent. Turn off analytics, personalisation or marketing at any time, in the same place you turned them on. Withdrawing does not undo what was lawfully done before you withdrew.
• Object, or ask us to restrict. Tell us you object to a use we base on our legitimate interests, and we will stop unless we have a compelling reason not to, which we would explain.
• Take it elsewhere. The file you download is machine readable and portable.
• Complain. To us first, we would hope. You can also complain to your national data protection authority.

We will not charge you for any of this and we will not treat you differently for asking. Deletion is completed within thirty days, other than the payment records the law makes us keep and the backup window described above.

You must be at least thirteen to hold an account on Spell Movies. We ask for your date of birth once, when you set the account up. If the date you give is below thirteen, the account is closed at that moment and we do not let it be used.

That is not because children should not watch films. It is because an account carries payment, consent and data rights that a child cannot hold. The supported way for a child to watch is a child's profile on an adult's account. A child's profile has its own content ceiling, needs the account code to change or to leave, and never sees the parts of the product that are not for children.

In several European countries the age at which a person can agree to their own data being used for analytics is higher than thirteen, and differs by country. If you are old enough to hold an account but below that age where you live, you keep the account and we do not ask you for analytics, personalisation or marketing consent. The service runs for you on what it needs to work, and nothing else. If we learn that a child below thirteen has an account anyway, we close it and delete the data.

• The database is encrypted at rest, runs across more than one data centre, and is backed up automatically.
• Everything travels over an encrypted connection.
• Profile codes are never stored as you typed them. They are hashed with a secret that is kept away from the hashes.
• Video is delivered under short lived signed credentials, so a link copied out of the player stops working.
• Access to production systems is limited to the people who need it, and administrative actions are logged.

If a breach happens that puts you at real risk, we will tell you and the relevant authority within the time the law allows.

When we change this policy in a way that matters we publish the new version here with a new version number and effective date, and we ask for your consent again before relying on it. Minor corrections that do not change the substance are made without a new version.

Write to our privacy team about anything in this policy, including a request to exercise any of the rights above.