Privacy Policy

Who is responsible for your data

Prosely LTD is the controller of personal data processed to operate NextUp. Our address is 71-75 Shelton Street Covent Garden, London WC2H 9JQ, United Kingdom. Contact privacy@nextup.film about privacy, this policy or your rights.

Information we use and why

• Account and profile information: email, account identifier, username, display name, biography, country and preferences, to provide sign-in and your chosen profile.
• Viewing information you provide: watchlist, ratings, diary, episode progress, favourites and notes, to provide tracking and personalised recommendations.
• Community information: reviews, replies, lists, follows, blocks, Circle membership, invitations, votes and movie-night responses, to provide the social features you choose.
• Consent choices, notifications, reports and moderation records, to honour your choices and protect the service.
• Technical information needed to deliver and secure requests, such as IP addresses, browser information and service logs. Hosting providers may process this information when you use NextUp.

Our intended lawful bases are performance of the service contract for account and requested features; legitimate interests in service security, abuse prevention and moderation; compliance with applicable legal obligations; and consent for optional AI processing, optional cloud conversation saving and any non-essential advertising storage. We do not treat use of the site as consent to optional processing. You may object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing.

What other people can see

Your display name and username identify you on community features. Unless you make your profile private, your biography, country and follower counts may be public. Published reviews and replies are shared; marked spoilers are concealed until deliberately revealed. Public lists are public; unlisted lists can be viewed by anyone with their link.

Your watchlist, diary, individual ratings, episode progress, private notes, review drafts, settings, blocks and notifications are not public. Aggregate rating counts and averages may be shown without individual ratings. Taste Match requires both members to opt in. Circle content is shared with that Circle’s members, not the general public. Members can copy or share content they can see; visibility controls cannot recall those copies.

Monty and optional AI

Monty requires an account. Model processing is off unless you enable the separate AI consent. With it enabled, your message and bounded recent conversation and title context are sent through Lovable AI to its model provider. The configured model is Google Gemini. This information leaves NextUp; do not include sensitive information or somebody else’s private data.

Your viewing history can inform recommendations within NextUp. Sending a bounded taste summary and selected non-spoiler excerpts of your own reviews to a model requires the separate personal-context opt-in. Lost Reels does not send private viewing history for identification.

Saving Monty conversations to your account requires a separate, default-off history consent. Storage itself does not send a conversation to AI; sending a new message may include recent turns under the AI consent. Without cloud saving, bounded recovery stays in your current browser tab. You can delete saved conversations or stop future saving; switching saving off does not delete existing saved chats. Provider-side prompt, log and backup retention is governed by the applicable provider arrangements, not by deleting a chat in NextUp.

Browser storage and communications

NextUp uses browser storage for sign-in, essential application state and same-tab conversation recovery. Optional cloud-history and model permissions remain separate. Authentication messages such as password resets may be sent. Marketing email, push notifications and private direct messaging are not currently enabled.

Google AdSense advertising

We use Google AdSense to support the free service. Ads may appear to anyone using NextUp, whether signed out or signed in, at most one per page, and only on Discover and title pages. Our planned premium plan will be ad-free; it is not available yet, so everyone is currently treated as a free user. Ads may not yet be showing while our site awaits Google approval.

Google and its advertising partners may use cookies, web beacons, IP addresses, device/browser identifiers and information about visits to this and other sites to deliver, measure and personalise advertising, depending on your choices and applicable law. Google may act as an independent controller for advertising processing, rather than solely as our subprocessor. We do not send private watchlists, ratings, diary entries or Monty transcripts as ad targeting inputs.

In the UK, European Economic Area, Switzerland and applicable US states, Google’s certified consent message asks for your choice before personalised advertising. If you decline, you may still see non-personalised or limited ads that do not use your information to profile you. You can change or withdraw your choice at any time through the privacy and cookie settings link Google displays on the page.

Learn how Google uses information at Google’s partner-sites disclosure, manage personalisation at My Ad Center, and review Google’s advertising policies. These settings work alongside the consent choice shown on NextUp.

Service providers and subprocessor information

This list distinguishes services used by NextUp from downstream suppliers and advertising. Not every organisation listed is a contracted subprocessor of Prosely LTD.

• Lovable Cloud — hosting, database and authentication. Processes account, profile, tracking, community and saved-conversation data needed to run the service, along with technical requests. Lovable’s current downstream subprocessor information is available through its subprocessor directory and Trust Center. The applicable deployment, regions and contractual safeguards need confirmation before public launch; we do not present an unverified vendor list as our contracts.
• Lovable AI — optional model gateway. Receives opted-in messages and bounded context for Monty, including separately opted-in personal context. Its downstream model configuration uses Google Gemini; this does not establish a direct processing contract between Prosely LTD and Google for AI. Consult Lovable’s privacy information and its subprocessor directory.
• Catalogue and artwork suppliers. Our servers request title, person, search and regional availability information and proxy official images. These are content suppliers, not providers of account storage. Queries can contain title or person search terms; do not include personal information. Supplier attribution and details are on our Credits page.
• Google AdSense — advertising. On pages with an ad, processing may include consent signals, technical identifiers and ad interactions. Google’s privacy policy describes its role and processing.

Authentication email delivery and hosting/AI downstream vendors are covered by the applicable service-provider arrangements; their exact list, retention and locations have not yet been confirmed for this deployment. We will update this information when arrangements change.

International processing and security

Service providers may process data outside the UK or your country. Where applicable law requires safeguards, these must be supported by the relevant adequacy decision or approved contractual safeguards and transfer assessment. Actual processing regions and transfer arrangements are still being verified before public launch; we do not claim data stays in the UK.

NextUp uses account-scoped access controls to protect private records. No service can guarantee absolute security. Moderators can review reported content and associated safety evidence; they do not receive blanket access to private viewing history or conversations.

How long information is kept

Our retention policy is to keep personal information only for as long as reasonably necessary for the purpose it was collected, including providing your account and handling proportionate security, disputes and legal obligations. We do not adopt one universal retention period.

Account and viewing records are currently retained while the account remains stored. Saved Monty chats remain until you delete them; browser-tab recovery is temporary. Moderation evidence must be assessed separately so deleting an account does not automatically remove necessary evidence or other members’ independent contributions.

Automated inactive-account erasure, fixed moderation/log periods and backup expiry schedules are not yet implemented or verified. We do not promise automatic deletion after an invented number of days. Provider backups and logs may follow separate schedules. Contact us for a retention or erasure request.

Your rights and complaints

Depending on applicable law, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw optional consent. You can export your data from My NextUp and manage profile and consent settings there. Self-service account deletion is not available; email privacy@nextup.film to request erasure or exercise other rights. We may need proportionate identity verification and will explain any lawful limitation. We aim to respond within applicable statutory deadlines, normally one month under UK data-protection law, subject to permitted extensions.

You can complain to the UK Information Commissioner’s Office or your applicable local supervisory authority.

Children and availability

We intend NextUp to be available internationally where lawful and do not currently impose a blanket minimum account age. This does not remove local age or parental-authorisation requirements. Children may need a parent or guardian’s involvement for optional consent-based features. Age assurance, parental-consent handling and child-appropriate privacy protections require review before an unrestricted public launch; they are not currently verified. Do not enable optional AI or advertising for a child on the assumption that consent alone is sufficient.

Changes and contact

We will update this policy when features or processing change, including before activating advertising. Material changes will be brought to your attention as appropriate. Questions: privacy@nextup.film. See also our Terms of Service.