Privacy Policy

Who we are

Mustyn is a call sheet service built and operated by Kompa, a company registered in France. Everything on this page applies to the website you are reading, mustyn.com, and to the application at app.mustyn.com.

Company

Kompa

Legal form

Société par actions simplifiée à associé unique (SASU), a French simplified joint-stock company

Share capital

€1,000

Registered office

11 route de la Faisanderie, 78110 Le Vésinet, France

Registration

RCS Versailles 106 806 268, registered on 26 June 2026

SIREN

106 806 268

VAT number

FR74 106 806 268

Publication director

Benoit Roubaud, President

Contact

our contact form

That address is read, and it is the one the product sends its email from. Legal notices and requests about your data are answered from there.

Two kinds of people are in here

Customers — producers, coordinators, studios. You opened an account, you build days, you publish them. For your own account data we decide what happens to it, so we are what the law calls the controller, and this page is our promise to you.

People on a call sheet — the crew, the talent, the drivers, the caterer. You never signed up for anything. Your name, your role, your mobile number and your email are in Mustyn because the production you are working for put them there. For that data the production decides, and we only act on its instructions: we are the processor and it is the controller. If you want your details changed or removed, the fastest route is the production — and if you cannot reach them, write to us through our contact form and we will get it done.

What we hold, and why

Because you have an account

• Your email address. It is your identity: signing in means receiving a link at that address. Without it there is no account.
• Your organisation — its name, its logo if you upload one, and who else you invited to work on it.
• What you build — projects, shoot days, schedules, locations, notes, the documents you import, and the people you put on a sheet.
• What happened to what you sent — which version went to whom, when it was sent, and whether the personal link was opened. That last one is the point of the product: it is how you know at 11pm that eleven of thirty people have not looked at tomorrow.
• Technical records — server logs, and a crash report if the application breaks in your browser. The crash report carries an account identifier and a stack trace. It is configured to send no personal data beyond that: not your email, not your crew’s details.

Because you are on somebody’s call sheet

• What the production put on the sheet — typically your name, your role and department, your call time, and a mobile number or an email so the sheet can reach you. Sometimes an agency, sometimes an address.
• Whether your link was opened, and when it was first opened. Not what you read, not how long for, not where from. A production needs one fact — did it arrive — and that is the only one we take.

Because you visited this website

We count visits to mustyn.com with Plausible Analytics: how many people came, which pages they read, which site or campaign sent them, roughly which country they were in. It uses no cookies, builds no profile, follows nobody across sites, stores no personal data and keeps everything in the European Union.

We also keep our own count, and this one does store something on your device. Plausible stops at the edge of this website — it can tell us that someone clicked “Start free”, never what happened next. So these pages also record a short list of events: a page opened, a button clicked, a form started or sent, how far down a page you read. Each one notes which page, which button, the size of your window, the browser you use, and the campaign link that brought you; on the first page of a visit it also notes the site you came from. It records nothing you type — not your name, not your email, not your message.

To join those events into one visit instead of a pile of disconnected clicks, your browser keeps three values in its own local storage: a random number for this browser, a random number for this visit, and the name of the campaign link you followed, which expires after thirty days. They are random, or they come from the link you clicked. None is derived from you, none says anything about you, and none is of any use to anyone who does not also hold our database. Nothing goes to an advertising network, nobody is followed onto other websites, and clearing your browser data erases all three.

These events go to a database we run ourselves, hosted in the European Union by Supabase — already named in the table below. We call it local storage rather than cookies because that is technically what it is, but we treat it as the same thing: it is storage placed on your device by us. It exists for one reason, which is to see where people stop.

The documents you import, and the model that reads them

When you import an existing call sheet, the file is stored in your organisation’s space and its contents are sent to a language model, which returns them as structured data you then review. The providers we use for this are named in the table below.

Two things we can state plainly. The document is sent to be read for that import and nothing else. And it is not used to train anybody’s model — not ours, and not the provider’s: we use their paid APIs, where training on submitted content is off. If that ever changes, this page changes with it, and we will tell you before it does.

Why we are allowed to hold it

• To perform our contract with you — your account, your sheets, sending them. Without this there is no service.
• Our legitimate interests — keeping the service up, stopping abuse, understanding which page of this website works, and contacting professionals about a product made for their job. Each of these is balanced against your interests, and you can object to any of them.
• Legal obligations — accounting records once we start invoicing.
• Your consent, where we ask for it. We ask rarely, and never buried in a longer agreement.

For the personal data of the people on a call sheet, the legal basis is the production’s to establish, not ours. Our Terms of Service put that obligation on the customer in writing.

Who else touches it

We do not sell personal data, and we do not share it for anybody else’s advertising. Data goes to the companies that run parts of the service for us, each bound by a contract to process it only on our instructions:

We will also hand data over when the law requires it, and we would tell you unless we are forbidden from doing so. If Mustyn is ever sold or merged, your data goes with the service, and you will be told before anything moves.

Leaving the European Union

Your account and your call sheets are stored in the European Union. Some of the companies above are established in the United States, so some processing happens there — email delivery, the model that reads an imported document, crash reports. Those transfers are covered by the European Commission’s standard contractual clauses, and where the provider is certified under the EU–US Data Privacy Framework, by that framework as well.

How long we keep it

• Your account and your content — while your account is open. After you close it, readable and exportable for twelve months, then deleted. Ask for it sooner and we do it sooner.
• The delivery log — ninety days on the free plan, for as long as your account is open on a paid plan.
• Imported documents — kept with the day they were imported into, so you can go back to the original. Delete the day and the document goes with it.
• Crash reports and server logs — kept for a short operational period, then dropped. They are for fixing what broke, not for building a history of you.
• Prospecting contacts — see the section below.

Keeping it safe

Everything travels encrypted and is stored encrypted. Access to your data inside the application is enforced at the database itself, per organisation, so one customer’s query cannot reach another customer’s rows. A call sheet link is a long unguessable token; anyone holding it can read that one sheet, which is what makes it work without an account for the crew — treat it as you would treat the sheet itself.

If a breach ever puts your data at risk, we will tell you and the supervisory authority within the deadlines the law sets, and we will tell you what we actually know rather than wait for a complete story.

Cookies

This website sets no cookies at all. It does use your browser’s local storage: for the measurement described above, and — once you sign in — to keep your session so you are not asked to sign in on every page. Clearing your browser data erases both, and signs you out. There is nothing here for an advertiser.

Your rights in Europe and the UK

If you are in the European Union or the United Kingdom you can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to receive it in a portable format, and to object to processing we base on our legitimate interests — including any email we send you about the product. Where you gave consent, you can withdraw it at any time.

Write to us through our contact form. We answer within a month, usually far sooner, and we ask for nothing beyond what the form shows. If you are on a call sheet rather than a customer, say which production sent it — that is how we find you.

If we handle it badly, you can complain to your data protection authority. In France that is the CNIL (cnil.fr). We would rather you told us first, but you do not have to.

Your rights in the United States

Most of the productions we build this for are in the United States, and your data sits under European rules because that is where our company and our servers are. That is a floor, not a ceiling — the rights below are yours on top of it, whichever state you are in.

We do not sell personal information, and we have never sold any. We do not share it for cross-context behavioural advertising either. There is no advertising network anywhere in this product or on this website, so there is nothing to opt out of — but if that ever changed, you would be told before it did, not after.

If you are in California, or in one of the states with a comparable law — Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the others that keep being added — you can ask us to tell you what we hold about you and where it came from, to correct it, to delete it, and to give you a copy. Write to us through our contact form. We answer within 45 days, usually within a few, and we will never treat you differently for asking: no worse price, no reduced service.

One thing worth being precise about, because it decides who you should write to. When your details are on somebody else's call sheet, the production is the business that decided to collect them and we are its service provider — the same split as controller and processor in Europe. We will act on your request, and we will tell the production, because they are the ones who can stop your details going onto the next sheet.

If we emailed you first

We contact production companies, studios and agencies about Mustyn, at professional addresses, about a tool made for the job that address does. That is business-to-business prospecting, and we do it on the basis of our legitimate interest.

• Where we got your address. From a public professional source — your company website, a public directory, a production credit, or a professional network — or because you gave it to us. We do not buy lists.
• What we hold. Your name, your professional email address, your role and your company, and whether we have written to you before.
• How to make it stop. Reply with the word “stop”, use the unsubscribe link, or write to us through our contact form. We remove you from the sequence immediately, and we keep the minimum needed to make sure nobody writes to you again.
• How long we keep it if you never reply — three years from our last contact, then it is deleted.

We never use crew details found inside a customer’s call sheet to prospect. Content you put into Mustyn is yours; it is not a source of leads, and it never will be.

Children

Mustyn is a professional tool and is not for children. We do not knowingly hold data about anyone under 16 in an account. Minors do appear on call sheets — child actors are part of this industry — and that data is the production’s to justify and to protect, under the rules that apply to working with minors where the shoot takes place.

Changes to this page

When what we do changes, this page changes first — before the new processing starts, not after. The date at the top is the version you are reading. If a change matters to you, we will email you about it rather than hope you come back and check.

Reaching us

Use our contact form. A person reads every message, and questions about your data are answered from it.