Privacy Policy

Kindred Enterprises Ltd ("Kindred", "we", "us", "our"), trading as CineOS Registered in England & Wales · Company No. 13719173 · Registered office: London, United Kingdom. Trading as CineOS via cineos.co. Contact: [email protected]

Last updated: 28 August 2026.

This Privacy Policy explains how Kindred collects, uses, and protects your personal data when you use our website at cineos.co, the CineOS platform, and our related services (the "Service"). We handle your data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Kindred Enterprises Ltd, trading as CineOS, is a company registered in England & Wales (Company No. 13719173) and is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, contact us at [email protected].

2. The data we collect

We collect and process the following categories of personal data:

• Account & identity data — your name and work email address, collected when you request access and when we create your account on the CineOS platform.
• Contact & enquiry data — your name, work email and message content, collected when you submit a form or contact us.
• Usage data — pages visited, features used, approximate location, and device and browser type, collected via analytics cookies only where you have accepted them (see section 8).
• Communications — emails and messages you exchange with us, collected directly from you.

2.1 No social sign-in

CineOS accounts are created by us for named business contacts and are accessed with an email address and password. There is no "sign in with Google" or other social login on cineos.co, and we do not receive profile data from any social or identity provider. Sign-up requests must come from a company email address; we do not accept requests from free consumer mailboxes.

2.2 The CineOS discovery service

The public discovery service at app.cineos.co has no user accounts and does not build personal profiles. There we handle only a coarse location, used to rank nearby showtimes, and non-identifying booking-referral records used to count handoffs to cinema websites.

3. How we use your data and our legal basis

We use your personal data for the following purposes, relying on the lawful bases set out under UK GDPR:

• To create and manage your account and authenticate sign-in — performance of a contract.
• To measure and improve how the website is used, via analytics — consent (you can withdraw it at any time).
• To provide, operate and improve the Service, including delivering CineOS audits and reports — legitimate interests.
• To respond to your enquiries and provide support — legitimate interests / contract.
• To send service-related and, where you have opted in, marketing communications — consent / legitimate interests.
• To maintain security and prevent fraud or abuse — legitimate interests / legal obligation.
• To comply with our legal and regulatory obligations — legal obligation.

4. Service providers and data sharing

We do not sell your personal data. We share it only with trusted service providers ("data processors") who help us run the Service, under contracts that require them to protect your data:

• Supabase — database, authentication and backend hosting.
• Vercel — website and application hosting.
• Google (Google Analytics 4) — website analytics, loaded only if you accept analytics cookies.
• Resend — transactional and notification email delivery.
• AI engine providers (OpenAI, Anthropic, Google, Perplexity, Microsoft) — queried as part of delivering an Audit. We send film and market queries, not your personal data.

We may also disclose your data where required by law, to enforce our terms, or to protect the rights, safety and property of Kindred or others.

5. International transfers

Some of our service providers are located outside the UK. Where we transfer personal data internationally, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement (or Addendum to the EU Standard Contractual Clauses) to ensure your data remains protected.

6. Data retention

We keep your personal data only for as long as necessary for the purposes set out in this policy, including to satisfy any legal, accounting or reporting requirements. When you close your account, we delete or anonymise your data unless we are required to retain it by law.

7. Your rights

Under UK GDPR you have the right to access your data; to request correction or erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies and analytics

We use two categories of cookie and similar browser storage, and only one of them needs your permission.

Strictly necessary. A small number of cookies and equivalent browser storage keep you signed in to the platform, maintain session security, and remember your cookie choice. Under PECR these do not require consent, because the site cannot work without them. They are not used for tracking.

Analytics — consent required. We use Google Analytics 4 to understand which pages are visited, how people arrive, and where they drop off, so we can improve the site. These cookies are set only if you accept them. Until you do, Google Analytics is not loaded, no analytics cookie is written, and nothing is sent to Google. We run Google Consent Mode with analytics and advertising storage denied by default, and IP anonymisation on.

No advertising or cross-site tracking. We do not use advertising or retargeting cookies, we do not run ad personalisation, and we do not sell or share personal data with advertisers or data brokers.

Your choice, and changing it. A banner asks you to accept or reject analytics cookies on your first visit; rejecting is exactly as easy as accepting. You can change your mind at any time via the Cookie settings link in the site footer, or by clearing this site's data in your browser. Withdrawing consent stops any further analytics collection. You can also control cookies through your browser settings, though blocking strictly necessary cookies may stop parts of the platform working.

Analytics data collected through Google Analytics 4 is retained for 14 months and then deleted automatically.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. No method of transmission or storage is completely secure, but we work to protect your data and review our measures regularly.

10. Children

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.

12. Contact us

Kindred Enterprises Ltd, trading as CineOS · [email protected] · London, United Kingdom.