Privacy Policy

A call sheet is almost entirely personal data. This page says what we hold, why we hold it, who else touches it, and how to make us stop.

Who we are

Mustyn is a call sheet service built and operated by Kompa, a company registered in France. Everything on this page applies to the website you are reading, mustyn.com,to the application at app.mustyn.com, and to the prospecting emails we send.

Company

Kompa

Legal form

Société par actions simplifiée à associé unique (SASU), a French simplified joint-stock company

Share capital

€1,000

Registered office

11 route de la Faisanderie, 78110 Le Vésinet, France

Registration

RCS Versailles 106 806 268, registered on 26 June 2026

SIREN

106 806 268

VAT number

FR74 106 806 268

Publication director

Benoit Roubaud, President

Contact

our contact form or benoit@getmustyn.com; by post, at the registered office

Legal notices and requests about your data are answered from there.

Three kinds of people are in here

Customers — producers, production managers and coordinators, assistant directors. You opened an account, you build days, you publish them. For your own account data we decide what happens to it, so we are what the law calls the controller, and this page is our promise to you.

People on a call sheet — the crew, the talent, the drivers, the caterer. You never signed up for anything. Your name, your role, your mobile number and your email are in Mustyn because the production you are working for put them there. For that data the production decides, and we only act on its instructions: we are the processor and it is the controller. If you want your details changed or removed, the fastest route is the production. If you cannot reach them, write to us: we will pass your request to the production and help them answer it.

Companies we write to — see If we emailed you first.

What we hold, and why

Because you have an account

• Your email address. It is your identity: signing in means receiving a link at that address. Without it there is no account.
• Your organisation — its name, its logo if you upload one, and who else you invited to work on it.
• What you build — projects, shoot days, schedules, locations, notes, the documents you import, the people you put on a sheet, and your crew book: roles, agencies and the days you worked together.
• What happened to what you sent — which version went to whom, when it was sent, whether the personal link was opened, and whether the call was confirmed. That is the point of the product: it is how you know at 11pm that eleven of thirty people have not looked at tomorrow.
• Technical records — server logs, and a crash report if the application breaks in your browser. The crash report carries an account identifier and a stack trace. It is configured to send no personal data beyond that: not your email, not your crew’s details.

Because you are on somebody’s call sheet

• What the production put on the sheet — typically your name, your role and department, your call time, and a mobile number or an email so the sheet can reach you. Sometimes an agency, sometimes an address.
• Whether your link was opened, when it was first opened, and whether you confirmed your call. Not what you read, not how long for, not where from. A production needs to know that the sheet arrived and that you will be there, and that is all we take.

Because you visited this website

We count visits to mustyn.com with Plausible Analytics: how many people came, which pages they read, which site or campaign sent them, roughly which country they were in. It uses no cookies, builds no profile, follows nobody across sites, stores no personal data and keeps everything in the European Union.

We also keep our own count, and this one does store something on your device. Plausible stops at the edge of this website — it can tell us that someone clicked “Start free”, never what happened next. So these pages also record a short list of events: a page opened, a button clicked, a form started or sent, how far down a page you read. Each one notes which page, which button, the size of your window, the browser you use, and the campaign link that brought you; on the first page of a visit it also notes the site you came from. It records nothing you type — not your name, not your email, not your message.

To join those events into one visit instead of a pile of disconnected clicks, your browser keeps three values in its own local storage: a random number for this browser, a random number for this visit, and the name of the campaign link you followed, which expires after thirty days. They are random, or they come from the link you clicked. None is derived from you, none says anything about you, and none is of any use to anyone who does not also hold our database. Nothing goes to an advertising network, nobody is followed onto other websites, and clearing your browser data erases all three.

These events go to a database we run ourselves, hosted in the European Union by Supabase — named in the table below. We call it local storage rather than cookies because that is technically what it is, but we treat it as the same thing: it is storage placed on your device by us. It exists for one reason, which is to see where people stop.

The documents you import, and the model that reads them

When you import an existing call sheet, the file is stored in your organisation’s space and its contents are sent to a language model, which returns them as structured data you then review. The providers we use for this are named in the table below.

Two things we can state plainly. The document is sent to be read for that import and nothing else. And it is not used to train anybody’s model — not ours, and not the provider’s: we use their paid APIs, where training on submitted content is off. If that ever changes, this page changes with it, and we will tell you before it does.

Why we are allowed to hold it

• To perform our contract with you — your account, your sheets, sending them. Without this there is no service.
• Our legitimate interests — keeping the service up, stopping abuse, understanding which page of this website works, and contacting production companies about a product made for their job. Each of these is balanced against your interests, and you can object to any of them.
• Legal obligations — accounting records once we start invoicing.
• Your consent, where we ask for it. We ask rarely, and never buried in a longer agreement.

For the personal data of the people on a call sheet, the legal basis is the production’s to establish, not ours. Our Terms of Service put that obligation on the customer in writing.

Who else touches it

We do not sell personal data, and we do not share it for anybody else’s advertising. Data goes to the companies that run parts of the service for us, each bound by a data processing contract, except Vercel, which hosts the application and our prospecting tracker under its standard terms.

We will also hand data over when the law requires it, and we would tell you unless we are forbidden from doing so. If Mustyn is ever sold or merged, your data goes with the service, and you will be told before anything moves.

Leaving the European Union

Your account and your call sheets are stored in the European Union. Some of the companies above are established outside it, so some processing happens there — email delivery, the model that reads an imported document, crash reports, sending our prospecting emails. Those transfers are covered by the European Commission’s standard contractual clauses or, where the provider is a US company certified under the EU–US Data Privacy Framework, by that framework. Ask us and we will send you a copy of those safeguards.

How long we keep it

• Your account and your content — while your account is open. After you close it, readable and exportable for twelve months, then deleted. Ask for it sooner and we do it sooner.
• The delivery log — ninety days on the free plan, for as long as your account is open on a paid plan.
• Imported documents — kept with the day they were imported into, so you can go back to the original. Delete the day and the document goes with it.
• Crash reports and server logs — kept for a short operational period, then dropped. They are for fixing what broke, not for building a history of you.
• Accounting records — ten years, as French law requires, once we invoice.
• Prospecting contacts — see If we emailed you first.

Keeping it safe

Everything travels encrypted and is stored encrypted. Access to your data inside the application is enforced at the database itself, per organisation, so one customer’s query cannot reach another customer’s rows. A call sheet link is a long unguessable token; anyone holding it can read that one sheet, which is what makes it work without an account for the crew — treat it as you would treat the sheet itself.

If a breach ever puts your data at risk, we will tell you and the supervisory authority within the deadlines the law sets, and we will tell you what we actually know rather than wait for a complete story. For the data on a call sheet, we tell the production without delay and help it do the same.

Cookies

This website sets no cookies at all. It does use your browser’s local storage: for the measurement described above, and — once you sign in — to keep your session so you are not asked to sign in on every page. Clearing your browser data erases both, and signs you out. There is nothing here for an advertiser.

Your rights in Europe and the UK

If you are in the European Union or the United Kingdom you can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to receive it in a portable format, and to object to processing we base on our legitimate interests — including any email we send you about the product. Where you gave consent, you can withdraw it at any time.

Write to us through our contact form or atbenoit@getmustyn.com. We answer within a month, usually far sooner, and we ask for nothing beyond what we need to find you. If you are on a call sheet rather than a customer, say which production sent it — that is how we find you.

If we handle it badly, you can complain to your data protection authority. In France that is the CNIL (cnil.fr). We would rather you told us first, but you do not have to.

Your rights in the United States

Some of the productions we work with are in the United States, and your data sits under European rules because that is where our company and our servers are. That is a floor, not a ceiling — the rights below are yours on top of it, whichever state you are in.

We do not sell personal information, and we have never sold any. We do not share it for cross-context behavioural advertising either. There is no advertising network anywhere in this product or on this website, so there is nothing to opt out of — but if that ever changed, you would be told before it did, not after.

If you are in California, or in one of the states with a comparable law — Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the others that keep being added — you can ask us to tell you what we hold about you and where it came from, to correct it, to delete it, and to give you a copy. Write to us through our contact form or atbenoit@getmustyn.com. We answer within 45 days, usually within a few, and we will never treat you differently for asking: no worse price, no reduced service.

One thing worth being precise about, because it decides who you should write to. When your details are on somebody else's call sheet, the production is the business that decided to collect them and we are its service provider — the same split as controller and processor in Europe. We will act on your request, and we will tell the production, because they are the ones who can stop your details going onto the next sheet.

If we emailed you first

We write to production companies about Mustyn, at the address they publish to be contacted, about a tool made for the job that address does. That is business-to-business prospecting, and we do it on the basis of our legitimate interest in making our product known.

• Where we got your address. From the page of your company’s website where it publishes the address to be contacted. The company’s name comes from public lists — film-fund awards, trade-body member lists, film-commission and label directories, advertising credits published by Packshotmag. We do not buy lists.
• What we hold. The company’s name, that address, its website, the link to the page where we read it, and the date we wrote. For a company address (contact@, office@…), we collect no person’s name; if you reply, we keep your reply, with your name and signature.
• If we wrote to you by name, at an address like firstname@yourcompany.com: your company publishes it on its website, under your name and role (a team, contact or about page). That is where we read it, and nowhere else: no LinkedIn, no directory, no bought list, no guessed address. We noted your first name, last name, role as published, that address, the link to the page and the date we read it; nothing else, no phone number, no photo. We write to one person per company: whoever coordinates or runs production, failing that a producer. People we noted but do not write to are deleted 30 days later, by 24 October 2026 at the latest. Everything else in this section applies to you too.
• Three messages at most: a first one and two follow-ups, then nothing more. No open or click tracking.
• How long. If you do not reply, everything is deleted when the campaign closes — for these messages, by 23 November 2026 at the latest. If you reply (other than “stop”), we keep the exchange for three years after your last message.
• How to make it stop. Reply “stop”, or write to benoit@getmustyn.com. We will not write to you again, and you owe us no reason. Once the campaign closes, we keep only the address and the date of your request, so as never to write to you again, for as long as we prospect by email (at least three years).
• Who else touches it. Our processors: Smartlead, which sends the messages; Google Workspace, where replies arrive; Supabase and Vercel, which host our tracker; Anthropic, whose language model helps us prepare the list (it does not read your replies); and Bouncer (Poland, data processed in the European Union), to which we give, once and before sending, some company addresses of our first campaign (contact@, prod@…) to check that they still exist, and which deletes them the same day; an address in your own name is never sent to it. Smartlead, Google, Supabase and Bouncer are bound to us by a data processing contract; Vercel hosts the tracker under its standard terms. Smartlead processes it in Australia and, through its own providers, in the United States; Supabase (a Singapore company, with the database in the EU), Google, Vercel and Anthropic may access it outside the EU, including in the United States. Those transfers are covered by the European Commission’s standard contractual clauses or, for certified US companies, by the EU–US Data Privacy Framework. Copy on request.

We never use crew details found inside a customer’s call sheet to prospect. Content you put into Mustyn is yours; it is not a source of leads, and it never will be.

Children

Mustyn is a professional tool and is not for children. We do not knowingly hold data about anyone under 16 in an account. Minors do appear on call sheets — child actors are part of this industry — and that data is the production’s to justify and to protect, under the rules that apply to working with minors where the shoot takes place.

Changes to this page

When what we do changes, this page changes first — before the new processing starts, not after. The date at the top is the version you are reading. If a change matters to you, we will email you about it rather than hope you come back and check.

Reaching us

Use our contact form or write to benoit@getmustyn.com. A person reads every message, and questions about your data are answered from there.