Privacy

Privacy Policy.

What we collect, why we collect it, and your rights. Short version: as little as possible, no ads, and analytics only if you agree.

Privacy Policy GDPR / DSGVO · last updated: August 2026

1. Controller

The controller responsible for the processing of your personal data (Verantwortlicher) is:

Fynn Schmidt — TillyGen, Oberlohnstraße 3, 78467 Konstanz, Germany. Contact: admin@tillygen.com, phone +49 7531 693 156. Full details in the imprint.

2. Visiting this website (server logs)

Our marketing website is hosted on Railway (Railway Corp.) in the EU region europe-west4 (Amsterdam, Netherlands). When you load a page, our hosting infrastructure processes technical access data — IP address, date and time of the request, the page requested, referrer, and user agent — in server logs. This is necessary to deliver the site, keep it secure, and defend against abuse.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, reliably functioning website). Log data is retained only as long as technically necessary and then deleted or anonymised.

3. Cookies & local storage

Without your consent the public marketing website sets no cookies at all. We store one value in your browser's localStorage — your language choice (tg_lang) — so the site remembers your preferred language. This value stays on your device and is not transmitted to us. Analytics and marketing cookies are only set after you agree; see section 4.

A technically required session cookie is only set inside the password-protected admin area, which is not accessible to normal visitors. Legal basis for the strictly necessary local storage and admin session: Art. 6(1)(f) GDPR / § 25 (2) TDDDG (strictly necessary for a service you requested).

4. Analytics & marketing (only with your consent)

We use two Google services (both operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Google Analytics 4 to understand how this site is used — which pages are read, which are not — and Google Ads to measure which of our ads lead to a sign-up (conversion tracking) and, where applicable, for remarketing. Nothing is loaded or stored until you agree. On your first visit a banner asks for your consent; the Google script is only requested after you click “Agree”. If you decline, no connection to Google is made at all.

If you consent, both services store cookies on your device and process a shortened IP address, the pages you visit, approximate location (country/region level), and browser and device data. Google Ads additionally records whether your visit followed one of our ads and whether it led to a sign-up. Until you agree, all Google Consent Mode categories — analytics as well as advertising — remain set to “denied”. Data may be transferred to the USA on the basis of the EU standard contractual clauses and the EU–US Data Privacy Framework.

Enhanced conversions (Google Ads): once the Google Ads tag has been loaded with your consent, it also looks for contact details you have entered on the page yourself — email address, phone number, name and postal address. Any such value is hashed with SHA-256 in your browser and transmitted to Google in that hashed form only, where it is matched against Google accounts so that a sign-up can be attributed to a click on one of our ads. The plain-text values are never transmitted, and Google may not use them for any other purpose. Without your consent nothing is collected, and collection stops as soon as you withdraw it.

Legal basis: Art. 6(1)(a) GDPR and § 25 (1) TDDDG (consent). Your choice is stored in your browser's localStorage (tg_consent). You can withdraw it at any time with effect for the future: . Retention: analytics data is deleted after 14 months at the latest.

5. Self-hosted fonts

All fonts are hosted on our own infrastructure. No requests are sent to Google Fonts or other third-party font CDNs when you load our pages, so no data is shared with such providers for the purpose of displaying text.

6. Embedded videos (Vimeo)

Some pages embed product videos from Vimeo (Vimeo.com, Inc., USA). We load the player in Vimeo’s Do-Not-Track mode (dnt=1), which instructs Vimeo not to set tracking cookies and not to collect analytics for these embeds. When a page with an embedded video loads, your browser still connects to Vimeo’s servers and transmits technical data such as your IP address — this is technically required to deliver the video.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our product on our own website). Transfers to the USA are safeguarded as described in section 11. For details, see Vimeo’s privacy policy.

7. Account & app usage

To use the TillyGen web app (app.tillygen.com) and our iPad, iPhone, and Watch apps, you create an account. We process the data you provide and generate in this context — in particular your email address, name, login credentials, and the project content you create (briefs, shot lists, storyboards, schedules, and related files).

Legal basis: Art. 6(1)(b) GDPR (performance of the contract for the use of the service). Account and project data is stored with Supabase (Supabase, Inc.), which provides our database and authentication as a processor on our behalf.

8. Payments

Paid plans are processed through Stripe (Stripe Payments Europe, Ltd. and affiliates). When you subscribe, you enter your payment details directly with Stripe; we receive the information needed to manage your subscription (e.g. plan, billing status, and the last digits of your payment method), but we do not store full card numbers. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) (statutory retention duties). For details on how Stripe processes your data, see Stripe's privacy policy.

9. Sign-up & product emails

When you register or opt in to product updates, we process your email address to send you a confirmation email (double opt-in) and, after confirmation, service messages and occasional product news. Transactional and confirmation emails are sent through Resend (Resend, Inc.) as our processor.

Legal basis: Art. 6(1)(b) GDPR for service and transactional emails tied to your account, and Art. 6(1)(a) GDPR (consent) for optional product news. You can withdraw consent at any time — with effect for the future — via the unsubscribe link in any marketing email or by writing to admin@tillygen.com.

10. AI processing (Tilly AI)

Our AI features (Tilly AI) process the project content you submit — for example your brief or notes — in order to generate suggestions such as shot lists, storyboards, and schedules. This processing happens to provide the functionality you request. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

Where Tilly Terra is used, inference runs on EU-hosted infrastructure and your content is not used to train AI models. AI output is generated for your use only; you remain responsible for reviewing it before you rely on or publish it.

11. Recipients & processors

We only pass on personal data where necessary and use carefully selected processors bound by data processing agreements (Auftragsverarbeitung, Art. 28 GDPR):

  • Railway — website and application hosting
  • Supabase — database and authentication (account and project data)
  • Stripe — payment processing for paid plans
  • Resend — transactional and confirmation emails
  • AI infrastructure providers used to deliver Tilly AI / Tilly Terra features

Embedded Vimeo videos (section 5) involve Vimeo.com, Inc. as an independent recipient of technical access data, not as our processor.

12. Transfers to third countries

We aim to keep processing within the EU/EEA — our hosting runs in the EU (see section 2). Some of our providers (e.g. Supabase, Inc., Resend, Inc., Vimeo.com, Inc.) are US companies or use sub-processors outside the EU/EEA. Where personal data is transferred to a third country, such transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified, the EU-U.S. Data Privacy Framework, together with appropriate additional measures. The safeguards for each provider are documented in our records of processing activities.

13. Retention

We keep personal data only as long as necessary for the purposes described above or as required by law. Account and project data is retained for the duration of your account; after deletion it is removed within a reasonable period, subject to statutory retention obligations (e.g. tax and commercial law) for billing data. Server logs are kept only as long as technically necessary.

14. Your rights

  • Access to your data (Art. 15 GDPR)
  • Rectification (Art. 16) and erasure (Art. 17)
  • Restriction of processing (Art. 18) and data portability (Art. 20)
  • Objection to processing based on legitimate interest (Art. 21)
  • Withdrawal of consent at any time, effective for the future (Art. 7(3))
  • Complaint to a supervisory authority (Art. 77) — for us: LfDI Baden-Württemberg

To exercise any of these rights, email admin@tillygen.com.

15. Changes to this policy

We will update this policy when the product or legal requirements change; the current version is always available at this address.