Privacy Notice

This notice applies to humanprovenance.film, operated by The Mise En Scène Company (MSC), the data controller for personal data processed through this site. HPF is an initiative of MSC and is not a separate legal entity. MSC’s registered details are under Contact below.

For questions about how we handle your data, contact contact@humanprovenance.film.

Registering interest

The register-interest form collects your name, organisation, role or job title, work email address, choice about email updates, and the time of submission. It is processed through Cloudflare and recorded in a Google Sheet held by MSC, and we use it to record your interest.

If you tick the updates box, your email address is added to our MailerLite mailing list and we send updates about the standard, usually around once a month. You can unsubscribe at any time using the link in an email or by contacting us. If you leave it unticked, we do not send you mailing-list updates.

Descriptor survey

The descriptor survey, which ran as the Pre-v1 Consultation Survey until 30 September 2026 and remains open until 31 October 2026, is hosted on Google Forms. It may collect:

• the part of the screen or related industry you represent;
• whether you are responding individually, for an organisation or both;
• the country or territory where your work is primarily based;
• your responses to the consultation, including optional free-text responses;
• your name, organisation, role and email address if you express interest in the pre-v1 working group;
• your email address if you separately ask to join the mailing list; and
• the date and time of submission and routine submission metadata recorded by Google Forms.

We use consultation responses to analyse feedback and inform the development of HPF v1.0. We consider the roles, professional experience, and production context that respondents describe when interpreting their feedback, and look at broad patterns by professional perspective and geography where appropriate. AI services may support this analysis. People review the output and decide how feedback informs the standard.

If you express interest in the working group, we use your contact details to contact you about possible participation. Expressing interest in the working group does not by itself subscribe you to email updates. We add you to the mailing list if you also ask to receive them. Taking part in the consultation does not imply endorsement of HPF.

Please do not include personal information about other people in free-text responses.

Contacting HPF

When you email contact@humanprovenance.film, we process your name, email address, message and related correspondence so that we can respond and maintain an appropriate record of the exchange.

Reporting a tool result

The AI Use Checker and Policy Mapper let you report a result you think is wrong. Reporting is optional. A report includes the tool, the problem type, any comment, a broad description of your browser and operating system, the tool, rules and standard versions, and the time it was received. Your input and the result are included only if you tick the box allowing this, which is unticked by default.

Reports pass through Cloudflare to a Google Sheet and HPF email inbox held by MSC. Access is restricted to people working on the tools. We use reports to investigate problems and improve the tools. Any input and result you include are removed from the reports sheet after 30 days, as explained under How long we keep your data. The rest of the report is kept to identify recurring problems. Reports are not linked to an account, declaration or HPF record.

Please describe productions in general terms and do not include confidential material or information about other people.

If a tool fails, it may send a technical error report with the same browser and version details. It does not include what you entered.

Disclosure form and PDFs

Entries in the online disclosure form, which may include production details and the name and role of the person signing, are saved in your browser so that they can be restored if you return to the page. They are not sent to HPF and stay in your browser until you select Clear form or clear the site data for humanprovenance.film. On a shared device, clear the form after saving your copy.

Saving the form as a PDF with your browser’s print function, or completing the blank fillable PDF, also sends nothing to HPF.

Usage-count preference

If you turn off aggregate usage counts with the control below, a first-party cookie named hpf_analytics records that choice for one year. If your browser sends a Global Privacy Control signal, the counts are turned off and no cookie is set. This is the only cookie set by the site’s own code.

The AI Use Checker and Policy Mapper run in your browser. When a check is completed, a short message is sent so that it can be added to a daily aggregate count. The count records the tool, the broad result state, whether a built-in example was used and the tool version. Technical failures and submitted result reports are also counted.

These counts do not contain your prompt, policy text, production information, excerpts or detailed result. MSC does not retain IP addresses, location, browser details or user, device or session identifiers as analytics data. No individual event history or user profile is created.

We use the totals to understand whether the tools are functioning and being used, identify broad result patterns and improve the tools. Daily aggregate counts are kept for up to 13 months.

Your choice applies to both tools and does not affect how they work.

Reporting a result is separate. If you report a result, your input is sent only if you expressly choose to include it.

Cloudflare serves the site. To deliver pages and protect the site from abuse, including limiting automated traffic to the form and reporting services, it processes the technical information sent with each request, such as IP address, requested address, browser type and time. MSC does not use this information to build visitor profiles.

The website uses no advertising cookies, cross-site tracking, tracking pixels, behavioural profiling or third-party analytics scripts. HPF email updates are different: MailerLite records opens and link clicks, as described under Who we share data with.

We rely on the following lawful bases under UK GDPR and EU GDPR:

• Consent to send email updates. You can withdraw consent at any time by unsubscribing or contacting us.
• Legitimate interests to run the consultation and develop the standard, record interest in HPF, contact people about working-group participation, respond to correspondence, operate and secure the website, count aggregate tool use, and investigate result and error reports. We limit the information collected and apply the safeguards described in this notice.

The survey’s mailing-list question is a separate, optional request for consent to send email updates.

You can withdraw consent or object to processing based on legitimate interests at any time. See Your rights below.

We share personal data with the following providers:

• Cloudflare, Inc. (privacy policy) serves and protects the website and processes the register-interest form, tool reports and aggregate usage counts.
• Google Cloud EMEA Limited (privacy notice) provides Google Workspace, including Google Forms, Google Sheets and Apps Script, which we use for register-interest records, consultation responses, tool reports and related notifications.
• MailerLite (privacy policy) sends HPF email updates. We add people who ask to receive them, through the register-interest form or in consultation or working-group correspondence. MailerLite processes subscribers’ email addresses and, where we add them, names, together with subscription status, delivery information, email opens and link clicks. Opens are recorded through a small image in each email.
• OpenAI (ChatGPT) and Anthropic (Claude) provide AI services we use to support analysis of consultation feedback. We make every effort to anonymise information where possible. Identifying information may be included where needed to check relevant practitioner experience or understand the feedback’s context. Each provider handles shared information under its own terms and privacy policy.

We do not sell or rent personal data or disclose it to third parties for their own marketing.

Registered-interest details: We keep your name, organisation, role and email address while your interest is registered or you remain subscribed, and delete them within two years after you unsubscribe or withdraw.

Mailing-list records: Unsubscribing removes you from the active mailing list. A minimal record of your email address may be retained to ensure that you are not contacted again.

Consultation responses: We keep identifiable responses for up to two years after the consultation closes. Anonymised or aggregated findings may be retained after that period.

Working-group contact details: We keep these for up to two years, unless they are still needed for an active working-group process or you ask us to delete them sooner.

Correspondence: We keep correspondence for as long as needed to deal with the matter and maintain an appropriate record.

Result reports: Input and result details you choose to include are removed from the reports sheet after 30 days. Copies may also be held in report notification emails and service logs, which are not covered by that 30-day period. The remaining report information is kept while the tools are maintained so that recurring problems can be identified.

Aggregate tool counts: Daily aggregate counts are kept for up to 13 months.

Disclosure-form drafts: These remain on your device until you select Clear form or clear your browser’s site data. HPF does not hold them.

These periods apply to records MSC controls, including records stored with its service providers. OpenAI and Anthropic may retain shared information separately under their own privacy policies.

If responsibility for HPF passes to another organisation, your personal data will not be transferred under this notice without first telling you what is proposed and giving you an opportunity to object or request deletion.

The providers listed above may process personal data outside the UK, including in the European Economic Area and the United States. Transfers to the EEA are covered by UK adequacy regulations. Cloudflare’s US transfers are covered by its certification under the UK Extension to the EU–US Data Privacy Framework.

Consultation information shared with OpenAI and Anthropic may be processed in the US. OpenAI’s privacy policy and Anthropic’s privacy policy explain their international processing and transfer safeguards.

Depending on the circumstances, you may have the right to:

• ask for a copy of personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data, subject to applicable legal exceptions;
• ask us to restrict how your data is used;
• receive certain data you provided in a machine-readable format; and
• object to processing based on legitimate interests.

To exercise your rights, email contact@humanprovenance.film. We normally respond within one month. We may ask for information needed to confirm your identity or understand your request.

If you are in the UK, you can complain to the Information Commissioner’s Office. If you are in the EU, you can complain to your national data protection supervisory authority, listed in the EDPB directory. If you are elsewhere, you may have the right to complain to your local data protection authority.

The site is served over HTTPS. Within MSC, access to register-interest, consultation and report records is restricted to people who need it for their work. We review access when personnel change.

If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you as required by law.

We will update this notice if our data practices change. The date at the top of the page shows when it was last revised.

If we make a material change to how we use personal data, we will explain it on this page and, where appropriate, in an email update.

The Mise En Scène Company
Registered in England and Wales as The Mis En Scene Company Ltd
Company number 12536378
Registered office: The Old Workshop, 1 Ecclesall Road South, Sheffield, England, S11 9PA