Privacy notice
How DreamSheets collects and uses personal data, including the crew details that productions keep in it. Last updated 24 September 2026.
Who we are
DreamSheets is operated by CODE:HILL LTD, a company registered in England and Wales with company number 14704543. Our registered office is Units 5-7 Averys Park, Harvard Way, Ringmer, BN8 5WG. In this notice "we" and "us" means that company.
Our role and yours
For the data a production keeps in DreamSheets, such as crew names, contact details, bookings and rates, the production company that holds the account is the controller, and we are its processor. We handle that data only to run the service for them and on their instructions. If you're a crew member and want to know what a production holds about you, ask that production first. We'll help them answer.
For DreamSheets accounts, website enquiries and the security of the service, we are the controller.
What we hold
Account holders
- Name and email address.
- Which productions you belong to, and your access on each: owner, editor or viewer.
- Your sign-in activity: sign-ins, failed sign-ins and password changes, with the IP address they came from.
- When you were last active on a production, so colleagues can see who's online.
- Your settings on each view, such as date ranges and hidden units.
Passwords are held by our authentication provider, Supabase Auth. We never see or store them.
Crew records kept by a production
- Name, role, department, phone number and email address.
- Start and end dates, and whether someone is engaged on contract or daily.
- Bookings, holidays, overtime and other day flags, and notes added by the production office.
Productions shouldn't put anything in DreamSheets that isn't needed to schedule and cost the crew, and in particular no health information or other special category data.
People who contact us
What you send through the contact or request-access form: your name, email address, company or production, role, and your message. The form emails it to our support inbox. It isn't stored in the DreamSheets database. We also see the IP address it was sent from, which we use to stop the form being abused.
Why, and on what basis
- Running the service for a production, under our contract with the production company, which is the controller for that data.
- Your account: to provide the service you've been invited to use (contract), and to keep it secure (legitimate interests).
- Security records such as sign-in activity and IP addresses: to detect and stop misuse (legitimate interests).
- Replying to enquiries: because you asked us to (legitimate interests).
We don't sell personal data, use it for advertising, or make automated decisions about people with it.
Who we share it with
People on a production see that production's data, according to the access the owner gives them. Beyond that, we use these suppliers to run the service:
- Supabase: the database and account sign-in.
- Hostinger: the server the application runs on, in the UK, and sending email, such as invitations and password resets.
We'll disclose data if the law requires us to. If the business changes hands, data would pass to the new owner under the same terms.
Where it's held
Your production data is stored in the United Kingdom: the database runs in London (Supabase on AWS) and the application server with Hostinger in the UK.
How long we keep it
- Production data is kept for as long as the production company's account is active. When an agreement ends, we delete the production data on request, or in line with the terms agreed with the production company, after giving them the chance to export it.
- Backups: a copy of the database is taken each night and kept for 30 days. Deleted data can remain in those copies until they expire.
- Failed sign-in records, which hold the IP address and a one-way hash of the email address, are used only to block repeated guessing and are kept only as long as needed to protect accounts.
- Who's online: cleared after ten minutes without activity.
- Schedule-edit history, recording who changed what on a production's schedule and when, is kept for 90 days, and is deleted with the production.
- A production's activity record, covering invitations, access changes, removals and changes of ownership, is kept for as long as the production exists, and its owner can see it. After a production is deleted, that record, and the rest of the activity log, is kept only as long as needed for the security of the service.
- Enquiry emails are kept only as long as needed to deal with your enquiry and any follow-up, then deleted.
Cookies and browser storage
The public pages of this website set no cookies, and we use no analytics, advertising or tracking of any kind.
Once you sign in, DreamSheets uses these cookies. They're all needed for the service to work as you've set it up, so we don't ask for consent to them.
| Cookie | What it's for | Lasts |
|---|---|---|
| dreamsheets_session | Keeps you signed in and remembers which production you have open | 14 days |
| dreamsheets_crew_sort | How the crew list beside the calendar is sorted | 1 year |
| dreamsheets_delivery_units | Which units you've hidden on Events | 1 year |
The app also keeps some layout settings, such as the width of the crew list and which panels are open, in your browser's local storage. Clearing your browser's site data removes them.
Your rights
You can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict how we use it, or object to our using it. Where we're a processor for a production, we'll pass your request to that production and help them answer it. We'll reply within one month.
Contact and complaints
Email support@dreamsheets.co.uk with any question about this notice or your data. If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk.