1. Who controls the information
Wajang is the data controller for account, subscription, security, service-administration and support information processed through the service. For personal information entered into a production by a production owner or organisation, such as cast, crew, contributor, supplier, scheduling, contract or logistical information, the production owner or organisation will often determine why that information is used. In those circumstances it may be the data controller and Wajang acts as a service provider or processor.
Users must have an appropriate reason and authority to enter information about other people and must configure production permissions so that information is visible only to those who require it.
2. Information Wajang may collect
Account and identity
Name, email address, account ID, role, organisation, profile information, authentication state, password hashes, two-factor settings and approved-device records.
Billing and plans
Plan, subscription state, seat assignments, payment-provider references, invoice and transaction status. Wajang does not need to store complete payment-card details where payment is handled by the payment provider.
Communications
Support tickets, contact enquiries, messages, announcements, notifications, email-delivery status and replies sent through the service.
Usage and security
Login events, permissions, audit records, IP address, browser and device information, requested URLs, timestamps, rate-limit records and security events.
3. Production information and potentially sensitive records
A production may contain scripts, notes, budgets, cost records, schedules, call sheets, attendance, timecards, contracts, releases, supplier details, location information, risks, travel, accommodation, emergency contacts, dietary or accessibility information, identity or right-to-work documents, bank or payroll details, photographs, video, audio and other uploaded material.
Some of this information may be confidential, commercially sensitive, legally protected or classed as special-category personal data. Wajang uses role-based access and restricted workflows, but the production owner remains responsible for deciding what should be collected, setting appropriate permissions, responding to people represented in the records and deleting information that is no longer required.
4. Files, diagnostics, cookies and local storage
Wajang may store uploaded file metadata, access history, versions, distribution records and technical information needed to deliver or protect a file. Browser storage, cookies, service-worker caches and device identifiers may be used to maintain sessions, remember preferences, support Progressive Web App and offline functionality, prevent abuse and synchronise selected field workflows.
Where a user deliberately saves a supported field workflow for offline use, a limited production field pack may be stored locally in the browser's IndexedDB storage. Those private field packs are encrypted using the local offline-vault controls rather than being placed in the ordinary service-worker cache. Wajang does not treat the general PWA cache as a store for authenticated production pages or API responses.
When a user reports an error, content concern or AI output, Wajang may receive the relevant page or object reference, account ID, browser description, report category and text deliberately submitted by the user. Passwords, API keys, payment-card data and private encryption keys should never be included in a report.
5. How information is used and the lawful bases
| Purpose | Typical basis |
|---|---|
| Creating and operating accounts, projects and production features | Performance of the service contract |
| Authentication, permissions, fraud prevention, audit and service security | Contract and legitimate interests in protecting users and the service |
| Billing, tax, financial records and legal compliance | Contract and legal obligation |
| Support, diagnostics, incident resolution and reliability improvement | Contract and legitimate interests |
| Optional product communications or marketing | Consent or legitimate interests where permitted, with an opt-out |
| Information entered by a production about its personnel and contributors | Determined by the relevant production controller |
6. AI-assisted processing
Where a user actively invokes an AI-assisted feature, relevant user-provided text, images, PDFs or structured production context may be sent to the configured AI service to generate suggestions, extraction drafts or analysis. Results are intended for human review and may be incorrect. Wajang does not use an AI response as an automatic legal, employment, financial, safety or eligibility decision.
Users should not submit information to an AI feature unless they are authorised to process it for that purpose. Production owners can control access to premium or AI-assisted functions through plans, production settings and permissions. Logged-in users can use the in-product content-reporting tool to flag AI output that appears unsafe, misleading or otherwise inappropriate for administrator review.
8. Retention and deletion
Active production records remain available while needed for the production. The production default schedules encrypted welfare, emergency and other high-risk personnel fields 90 days after close-out, with a 30-day encrypted restore window. Contact data defaults to 365 days. Production owners can select safer longer periods within configured limits, and a documented legal hold pauses disposal. Financial and legal evidence follows a separate policy, normally seven years where required for tax, contract or claims purposes.
Account deletion requires reauthentication, checks production-ownership blockers, schedules known subscriptions to end, provides a 14-day cooling-off period and then anonymises the account and revokes sessions. Deletion may not immediately remove disaster-recovery copies or records Wajang must retain. Production owners should export and close out first and should not rely on Wajang as the only legal archive.
9. Security
Wajang uses measures such as authenticated access, password hashing, transport encryption, role and production permissions, audit trails, rate limiting, controlled file delivery, device and session controls, backups and administrative access restrictions. No internet service can guarantee absolute security. Users must protect credentials, use appropriate account security, revoke access promptly and report suspected compromise.
10. Your rights
UK data-protection law may provide rights of access, correction, erasure, restriction, objection, portability and withdrawal of consent. Where information was entered by a production organisation, the request may need to be directed to that production as controller. Wajang will assist where legally required.
You may complain to the UK Information Commissioner’s Office if you believe a data-protection concern has not been resolved.
11. Children and education use
Wajang is not designed for unsupervised use by young children. Education organisations are responsible for determining the lawful basis, notices, supervision and account arrangements required for their learners.
12. Contact and privacy requests
Use the public contact form for a privacy enquiry. Logged-in users can also use Contact & Report an Issue, which attaches the correct Wajang Account ID. Provide enough information for the account and relevant production record to be located and the requester’s identity to be verified.