Privacy Policy

1. Who We Are

Studio 22 Productions ("we," "us," or "our") is a video production and creative services company based in Texas. This Privacy Policy describes how we collect, use, store, and protect information through our internal business management platform ("HQ") and our public website at studio22productions.co.

Questions? Email us at devante@studio22productions.co .

2. Information We Collect

2a. Financial data (via Plaid)

We use Plaid Technologies, Inc. ("Plaid") to access financial account information for internal business management purposes only. Through Plaid, we collect:

• Bank account and credit card transaction history
• Account balances (current and available)
• Account metadata (account name, type, institution)
• Investment holdings and portfolio balances (if connected)
• Liability balances such as credit card and loan balances (if connected)

This data is accessed solely by the business owner and is used exclusively for internal financial reporting and business management. It is never shared with or sold to any third party. By connecting a financial account through Plaid Link, you agree to Plaid's End User Privacy Policy at plaid.com/legal .

2b. Billing and payment data (via Zoho Billing & Stripe)

We use Zoho Billing to track customer invoices and payments and Stripe to process payments. We access this data via their APIs to display business income summaries within HQ. No raw payment card numbers are stored by us.

2c. Account and authentication data

HQ uses Supabase for authentication via magic link (passwordless email). We store your email address and session tokens to authenticate access. Sessions expire after 6 hours of inactivity.

2d. Contact inquiries (public website)

If you submit a contact or consultation request via our public website, we collect your name, email address, phone number, and message content. This information is used only to respond to your inquiry.

3. How We Use Your Information

We use the information collected for the following purposes:

• Displaying real-time and historical financial summaries within our internal HQ dashboard
• Generating business financial reports and analytics
• Managing invoices, outstanding payments, and expenses
• Authenticating access to the HQ platform
• Responding to contact inquiries from prospective clients
• Complying with applicable tax and accounting obligations

We do not sell, rent, lease, or share your personal or financial data with third parties for marketing purposes under any circumstances.

4. How We Store and Protect Your Data

Encryption in transit

All data transmitted between your browser and our servers, and between our servers and third-party APIs (Plaid, Stripe, Zoho), uses TLS 1.2 or higher. Our platform is served exclusively over HTTPS via Vercel.

Encryption at rest

Financial data snapshots are stored in Supabase (PostgreSQL on AWS), which encrypts all data at rest using AES-256. API keys and access tokens are stored as encrypted environment variables within Vercel's secret management system. Plaid access tokens are never logged or written to unencrypted storage.

Access controls

The HQ platform is protected by Supabase magic-link authentication and is accessible only to the authenticated business owner. Database tables are protected by Row Level Security (RLS) policies that enforce per-user data isolation at the database level. All third-party service accounts (Plaid, Stripe, Zoho, Vercel, Supabase) are protected by multi-factor authentication where supported.

5. Data Retention and Deletion

We retain data as follows:

• Plaid financial data (live): Cached in memory for 30 minutes (balances: 24 hours). Not persisted to long-term storage beyond daily snapshots.
• Daily financial snapshots: Retained for 3 years in Supabase for reporting and tax purposes, then permanently deleted.
• Contact form submissions: Retained for 2 years, or until the business relationship concludes, then deleted.
• Authentication sessions: Expire after 6 hours and are purged from Supabase automatically.

To request deletion of any data we hold, email us at devante@studio22productions.co and we will respond within 30 days.

6. Third-Party Services

We use the following third-party services to operate our platform. Each has its own privacy policy:

7. Your Rights

Depending on your location, you may have the right to access, correct, or delete personal information we hold about you. To exercise any of these rights, please contact us at devante@studio22productions.co . We will respond within 30 days.

If you have connected a financial account via Plaid and wish to revoke access, you may do so at any time through the Plaid Portal (my.plaid.com) or by contacting us to remove your access token from our system.

8. Cookies

Our public website uses only essential cookies necessary for basic functionality (such as session management). We do not use advertising cookies or third-party tracking. Our internal HQ dashboard uses cookies and localStorage solely for authentication session management.

9. Children's Privacy

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the date of the most recent revision. We encourage you to review this page periodically.

11. Contact

For any privacy-related questions or requests, contact: