Last updated: April 18, 2026
Introduction
ProdComm, operated by Criton ("Company," "we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service ("Service"). This policy applies to all users of the Service, including production administrators, crew members, and visitors to our website.
Information We Collect
Account Information
- Name, email address, and password
- Company or production entity name
- Billing and payment information
Production and Crew Information
- Production details (names, dates, locations, departments, shooting states)
- Crew contact information (names, phone numbers, email addresses, home addresses)
- Job titles, roles, departments, compensation rates, and start dates
- Individual crew call times by department and walkie channel assignments
- Call sheet data (scenes, talent, locations, call times, weather, meal counts, emergency info)
- Production report data (actual crew hours, overtime, meal break times, scene completion, talent wrap times)
- Risk assessment data (hazard descriptions, risk levels, control measures, crew acknowledgments)
- Hot cost report data (department labor costs, overtime analysis, meal penalties, forced call records)
- Tax incentive data (qualified spend classifications, incentive percentages, projected rebate calculations)
- Crew timeline data (start dates, wrap dates, per diem rates, housing allowances, car allowances per crew member)
- Crew residency and classification data (resident state, distant hire vs local hire status, qualified spend status)
- Travel and living data (flight bookings, hotel reservations, per diem arrangements, car rentals, ground transport — including vendors, confirmation numbers, dates, and costs)
- Talent deal data (deal terms, compensation rates, rate types, guarantees, post/ADR terms, and perks including personal assistant rates, trailer assignments, housing arrangements, companion travel, self-drive allowances, and publicity allowances)
- Union affiliation data (union name, member numbers, and associated fringe benefit rates used for cost calculations)
- Background/extras data (daily headcounts, hours, and estimated costs per background category)
- Budget and cost report data (uploaded budget files, weekly cost reports, parsed line items with account codes, vendor names, and PO numbers)
- Turnaround data (crew wrap times, next-day call times, rest period calculations)
- Approval workflow records (submission, approval, rejection history with timestamps and notes)
- Location permit data (permit numbers, expiry dates, uploaded permit documents)
- Talent status tracking data (real-time status changes with timestamps)
- Talent release records (performer names, signatures, guardian information for minors)
- Documents and files uploaded to the platform
- SMS message content and delivery/acknowledgment records
- Incoming SMS questions from crew and AI-generated responses
Sensitive Personal Information (Onboarding)
When crew members complete onboarding through ProdComm, we collect and process the following categories of sensitive personal information:
- Government identifiers: Social Security numbers (SSN), driver's license numbers, passport numbers
- Financial information: Bank account numbers, routing numbers, account types for direct deposit
- Government-issued identification documents: Photographs of driver's licenses, passports, and other identity documents for I-9 verification
- Tax information: Filing status, withholding preferences, state tax elections, dependent information
- Employment eligibility: Citizenship status, work authorization status, visa information
- Emergency contact information: Names, relationships, and phone numbers
- Electronic signatures: Digital signatures captured via mobile device for employment forms, offer acceptances, and agreements
- Voice recordings: Recordings of onboarding calls, offer acceptance conversations, and crew hotline interactions
- Biometric-adjacent data: IP addresses, device information, and user agent strings captured alongside electronic signatures for audit purposes
Information Automatically Collected
- Log data (IP address, browser type, access times, referring URLs)
- Device information (device type, operating system, unique device identifiers)
- Usage data (features used, pages visited, actions taken)
- Cookies and similar tracking technologies (see Cookies section below)
How We Use Your Information
We use the information we collect for the following purposes:
- Provide, operate, maintain, and improve the Service
- Process crew onboarding, including collecting personal information, generating employment forms, facilitating electronic signatures, and auto-creating crew directory entries upon completion
- Conduct AI-powered phone calls for crew onboarding, information hotlines, department routing, injury reporting, and location agreement creation
- Process incoming SMS messages from crew and generate AI-powered responses using call sheet data
- Recognize callers by phone number and personalize greetings and responses
- Create and distribute call sheets via SMS with personalized per-crew call times
- Send production-wide alerts, notifications, and safety acknowledgment requests
- Generate employment forms (W-4, I-9, state tax forms, deal memos) using data collected from crew members
- Generate SAG-AFTRA Exhibit G performer time reports with meal penalty violation calculations
- Generate AI-powered risk assessments from call sheet data and distribute for crew acknowledgment
- Parsing uploaded budget files and cost reports using AI (GPT-4o) to extract line items, account codes, and department totals for hot cost calculations
- Resolving crew compensation rates from union agreement databases when deal memos specify "Scale" rates
- Generate hot cost reports with department-level labor cost analysis
- Calculate daily hot cost estimates using crew rates, per-union fringe percentages, overtime rules, and meal penalty thresholds
- Project tax incentive rebates based on qualified spend classifications and user-configured state incentive rates
- Generate crew timeline projections, idle day budget tracking, and distant hire cost forecasts
- Track travel and living arrangements for production coordination and cost management
- Store and display talent deal terms and perk fulfillment status for production coordination
- Look up union rate cards and fringe benefit schedules to resolve scale-based compensation rates
- Detect turnaround violations by comparing crew wrap times against next-day call times
- Process injury reports, geocode incident locations via Google Maps/Places API, find nearest medical facilities, and send directions via SMS
- Process location agreements, talent releases, and document signatures with approval workflow gates
- Track location permit status and generate expiry alerts
- Enforce role-based access permissions per team member per production module
- Compile production documentation into wrap books at end of show
- Process transactions and send billing notifications
- Respond to inquiries and provide customer support
- Analyze usage patterns to improve the Service
- Detect, prevent, and address fraud, security issues, and technical problems
- Comply with legal obligations, including tax record retention requirements
SMS Communications
ProdComm sends SMS text messages on behalf of production companies to crew members, talent, and other production-related contacts. This section describes our SMS practices and your rights.
Consent
SMS messages are sent only after explicit consent is collected through one of the following:
- Public demo signup at https://prodcomm.com/demo — offers a separate, optional SMS consent checkbox, unchecked by default; the demo starts without it, and texts are sent only when it is checked
- Production employment — crew members consent to receive production-related SMS as part of their deal memo or employment paperwork with the production company that hires them
- Verbal consent — when crew members call the production line and complete onboarding by voice, they are asked to confirm SMS consent during the call
Types of Messages
SMS messages from ProdComm include: call sheet distribution, schedule and location updates, onboarding instructions, safety messages, signature requests, and replies to crew inquiries.
Frequency
Message frequency varies based on production phase and your role. Frequency is typically higher during active production days and lower during prep, wrap, and hiatus.
Opt-Out and Help
You may opt out of SMS at any time by replying STOP to any message from ProdComm. We honor opt-out requests immediately and suppress the recipient from future SMS for that production. Reply HELP to receive assistance information. Message and data rates may apply based on your mobile carrier plan.
Mobile Phone Number Use
Mobile phone numbers and SMS opt-in data are not shared with third parties for marketing purposes. Mobile phone numbers collected through ProdComm are used solely for the SMS communications described above and are processed by Twilio as our telephony provider.
How We Protect Sensitive Data
We implement industry-standard technical and organizational measures to protect sensitive personal information:
- Encryption at rest: SSNs, bank account numbers, routing numbers, and other sensitive fields are encrypted using AES-256-CBC encryption before storage
- Encryption in transit: All data is transmitted exclusively over HTTPS/TLS. The Service does not support unencrypted HTTP connections
- Access controls: Sensitive data is accessible only to authorized production administrators within the scope of their production. SSNs and bank details are never displayed in full after submission
- Secure link access: Public-facing onboarding pages (signature capture, secure forms, document upload) use per-person secure links with token validation
- Audit trails: Electronic signatures include timestamp, IP address, and device information. Voice recordings include call SID, duration, and timestamp
- Secure file storage: Government ID photographs and uploaded documents are stored in access-controlled storage with authenticated download links
Information Sharing and Disclosure
We do not sell your personal information to third parties. We have not sold personal information in the preceding twelve (12) months.
We may share your information in the following circumstances:
Service Providers (Subprocessors)
We share information with third-party service providers who process data on our behalf to operate the Service. These providers are contractually prohibited from selling, sharing, or using your personal information for any purpose other than performing the services we specify. Our agreements with these providers include CCPA/CPRA-required provisions restricting their use of your data:
- Twilio — Telephony, SMS messaging, voice call services, and phone number provisioning. Receives crew phone numbers, call data, SMS content, and delivery status
- ElevenLabs — AI voice synthesis and conversational AI for crew hotline, onboarding calls, injury reporting, and department routing. Processes voice conversation data and call transcripts
- Google (Gemini) — Primary language model powering the AI voice agent's reasoning and response generation during phone calls
- OpenAI — AI language processing for risk assessment generation, SMS reply generation, call sheet parsing, and form generation
- Google Maps / Places API — Geocoding of injury locations and nearest medical facility lookup. Receives street addresses provided during injury reports
- AWS S3 — Secure file storage for documents, signatures, permit files, I-9 identity documents, and generated PDFs
- Railway — Cloud hosting infrastructure. Application servers and PostgreSQL database hosted on Railway
- Resend — Transactional email delivery for location agreement signing links, welcome emails, and document notifications
- PostHog — Product analytics. Collects anonymized usage data to improve the Service. No PII is sent to PostHog
At Your Direction
We share information when directed by you, including:
- Transmitting completed form packets (W-4, I-9, state tax forms) to payroll companies you designate
- Sending onboarding documents to crew members via SMS or email
- Sharing production information with crew members within your production
Legal Requirements
We may disclose information when required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect the rights, safety, or property of ProdComm, our users, or others.
Business Transfers
In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to this Privacy Policy.
Voice Recordings
The Service records voice calls for the following purposes:
- Compliance documentation for verbal offer acceptances
- Quality assurance and accuracy verification of data collected via phone
- Dispute resolution
Voice recordings are stored securely via Twilio's recording infrastructure, which provides encryption at rest and in transit. Recordings are retained for the duration of the production plus one (1) year, or as required by applicable law, whichever is longer.
Two-Party Consent: If your production operates in a two-party consent state (including California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington), our AI voice agent discloses that the call is being recorded at the beginning of each call. Production administrators are responsible for ensuring compliance with applicable call recording laws in their jurisdiction.
Data Retention
We retain different categories of information for different periods:
- Account data: Retained for the duration of your account plus one (1) year after closure
- Employment tax records (W-4, state tax forms): Retained for a minimum of four (4) years after the date the tax is due or paid, whichever is later, as required by IRS regulations
- I-9 forms and supporting documents: Retained for three (3) years after the date of hire or one (1) year after termination of employment, whichever is later, as required by USCIS regulations
- Voice recordings: Retained for the duration of the production plus one (1) year
- Electronic signatures and audit trails: Retained for the duration of the associated document's retention period
- Production data (call sheets, contacts, documents): Retained for the duration of your account. Deleted or anonymized within ninety (90) days of account closure, unless subject to a legal hold
- Crew data retained for cross-production use (contact information, work history): If crew data is retained beyond a single production to facilitate faster onboarding on future productions, this constitutes a Secondary Use. We will disclose this use and provide an opt-out mechanism for crew members who do not wish their data to be retained
You may request early deletion of specific data by contacting us at privacy@prodcomm.com. We will honor such requests unless retention is required by law. Film productions are temporary in nature; we do not retain data longer than reasonably necessary for the purposes described above.
Data Breach Notification
In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, we will:
- Investigate and contain the breach as quickly as possible
- Notify affected users via email within seventy-two (72) hours of becoming aware of the breach, or as required by applicable law
- Notify applicable regulatory authorities as required by law (including state attorneys general under applicable state breach notification laws)
- Provide a description of the breach, the types of information involved, and the steps we are taking to address and mitigate the breach
Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purpose for collecting the information, and the categories of third parties with whom we share it
- Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions (such as legal retention requirements for tax and employment records)
- Right to Correct: You may request that we correct inaccurate personal information
- Right to Opt-Out of Sale: We do not sell personal information. We do not share personal information for cross-context behavioral advertising
- Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information (such as SSN, financial data, and government IDs) to only what is necessary to provide the Service. We collect SPI solely for the purpose of production crew onboarding and do not use it for any secondary purpose. To exercise this right, use the "Limit the Use of My Sensitive Personal Information" link at the bottom of our website or contact us using the methods below
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights
Request to Limit Use of Sensitive Personal Information
Under the California Privacy Rights Act (CPRA), you have the right to request that we limit our use of your sensitive personal information (SSN, financial account data, government-issued IDs) to only what is necessary to provide the Service. We collect sensitive personal information solely for production crew onboarding — payroll processing, tax withholding, direct deposit setup, and I-9 employment eligibility verification. We do not use this information for any secondary purpose, including cross-context behavioral advertising or profiling.
To submit a request to limit the use of your sensitive personal information:
We will acknowledge your request within ten (10) business days and complete it within forty-five (45) days, as required by law.
How to Submit Privacy Requests
California law requires us to provide at least two methods for submitting privacy requests. You may use either:
We will verify your identity before processing your request. You may also designate an authorized agent to submit requests on your behalf with proper written authorization.
We will respond to verifiable consumer requests within forty-five (45) days, as required by law.
Your California "Shine the Light" Rights (Civil Code 1798.83)
California residents may request, once per calendar year, information about whether we disclosed their personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. If you have questions, contact us at privacy@prodcomm.com.
Categories of Information Collected (CCPA Disclosure)
In the preceding twelve (12) months, we have collected the following categories of personal information:
- Identifiers (name, email, phone number, address, SSN, driver's license number)
- Financial information (bank account numbers, routing numbers)
- Employment information (job title, department, compensation, start dates)
- Government-issued identification (photographs of IDs for I-9 verification)
- Internet or electronic network activity (usage data, log data)
- Geolocation data (IP-based location)
- Audio/visual information (voice recordings of onboarding calls)
- Sensitive personal information (SSN, financial account information, government IDs, citizenship/immigration status)
- Professional or employment-related information (union affiliations, deal terms, compensation rates, per diem and housing allowances, qualified spend classifications, travel booking details)
International Users and GDPR
If you are located in the European Economic Area (EEA), United Kingdom (UK), or other jurisdiction with data protection laws, you have additional rights:
- Legal Basis for Processing: We process your personal data based on: (a) your consent, (b) performance of a contract, (c) compliance with legal obligations, and (d) our legitimate business interests
- Right of Access: You may request a copy of the personal data we hold about you
- Right to Rectification: You may request correction of inaccurate data
- Right to Erasure: You may request deletion of your data, subject to legal retention requirements
- Right to Restrict Processing: You may request that we limit processing of your data
- Right to Data Portability: You may request your data in a structured, machine-readable format
- Right to Object: You may object to processing based on legitimate interests
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time
International Data Transfers
Your personal data may be transferred to and processed in the United States, where our servers and service providers are located. For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards as required by applicable law.
Data Protection Officer
For data protection inquiries, contact our Data Protection Officer at privacy@prodcomm.com. You also have the right to lodge a complaint with your local data protection authority.
Data Controller and Data Processor Roles
Depending on the context, ProdComm acts in different capacities:
- Data Controller: For account holder information, website visitors, and marketing communications, ProdComm acts as the data controller and determines the purposes and means of processing
- Data Processor: For crew member personal information collected during onboarding on behalf of a production company, ProdComm acts as a data processor. The production company (our customer) is the data controller and determines the purposes and means of processing. We process such data only on the instructions of the production company
Enterprise and studio clients may request a Data Processing Agreement (DPA) by contacting legal@prodcomm.com.
Cookies and Tracking Technologies
We use cookies and similar technologies for the following purposes:
- Essential cookies: Required for the Service to function (authentication, session management). Cannot be disabled
- Analytics cookies: Help us understand how users interact with the Service. Can be disabled via browser settings
We do not use advertising or tracking cookies. We do not participate in cross-site behavioral advertising. You can control cookie preferences through your browser settings. Disabling essential cookies may impair Service functionality.
Third-Party Services
Our Service integrates with third-party services that have their own privacy policies. We encourage you to review their policies:
Children's Privacy and Minors on Set
Our Service is not intended for direct use by individuals under 18 years of age. However, we recognize that film and TV productions routinely involve minor talent members.
If a minor (under 16 or under 13) will interact with the Service — including talent release signing, SMS check-in, or onboarding — the production company must obtain verified parental or guardian consent before any personal information is collected from the minor. A parent or legal guardian must complete all forms and signatures on behalf of the minor. The Service's talent release feature includes guardian signature support for this purpose.
We comply with the Children's Online Privacy Protection Act (COPPA) and the California Age-Appropriate Design Code Act. If we become aware that personal information has been collected from a child without verified parental consent, we will take steps to delete that information promptly.
Production companies are solely responsible for ensuring compliance with applicable child labor laws, COPPA, and state-specific minor protection requirements in their jurisdiction.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least thirty (30) days before changes take effect. The "Last updated" date at the top of this policy indicates when it was most recently revised.
Contact Us
If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:
- Email: privacy@prodcomm.com
- Legal inquiries: legal@prodcomm.com
- Contact Form