Wrap Zero Privacy and Cookies Policy

Wrap Zero is a service of Tolmon Ltd, a company registered in England and Wales (Companies House number 14468414), with its registered office in London. Wrap Zero is a carbon-accounting platform for film, TV and advertising productions.

You can contact us at info@tolmon.com for any privacy-related question. If you want to exercise one of your rights under UK GDPR, the section "How to exercise your rights" below tells you how.

We handle data in two capacities, and your rights run slightly differently under each.

As a controller: when you create an account, sign in, contact us, or visit this website, we decide how that data is used and Tolmon Ltd is the controller.

As a processor: when a production company or studio uses Wrap Zero to capture its production records (invoices, receipts, delivery notes, crew rosters, travel confirmations and similar), that organisation is the controller of the personal data inside those records, and we process it on their instructions under our agreement with them. If you are a crew member or supplier whose details appear in a production's records, the production company is your first point of contact; we will assist them with any request you make.

Account data: name, email address, password hash, role, and sign-in records for people invited to a production or organisation.

Production records: documents sent to a production's Wrap Zero email addresses or uploaded to the platform, and the content we extract from them. These can include personal data such as crew names, travel details, home postcodes used for commute calculations, and supplier contact details.

Automatically collected data: server logs, IP addresses, and security event records needed to run and protect the service.

Contact data: what you send us when you get in touch.

We do not ask for, and you should not send us, special category data. Where a document happens to contain it (for example a dietary note on a catering sheet), we process it only as part of the record it arrived in.

We rely on the following lawful bases under UK GDPR Article 6:

Contract performance. We need account data and production records to provide the service: receiving documents, extracting their contents, calculating carbon figures, and producing exports.

Legitimate interests. We rely on legitimate interests for keeping the service secure (authentication, access control, rate limiting, virus scanning of received files, audit logging) and for improving it using aggregate, non-identifying usage patterns.

Consent. Optional analytics described in the cookies section run only if you accept them, and you can withdraw that consent at any time from the cookie preferences link in the page footer.

Legal obligation. Billing records are kept as long as required by UK tax law.

We do not sell personal data and we do not use production records for advertising.

We use the following processors to run Wrap Zero:

• Vercel (Vercel Inc.) for hosting the application, and for cookieless web analytics and performance measurement.
• Railway (Railway Corp.) for database hosting, with encrypted database backups held in S3-compatible object storage.
• Postmark (ActiveCampaign, LLC) for receiving documents sent to production email addresses.
• Resend (Resend, Inc.) for transactional service emails.
• Anthropic (Anthropic, PBC) for automated document extraction. Extraction output is attached to your production's record and reviewable by your team before it is confirmed.
• Cloudmersive for virus scanning of received files.
• Sentry (Functional Software, Inc.) for error monitoring.
• Google (Google LLC) for Google Analytics, which runs only if you consent through the cookie banner or cookie preferences.
• Microsoft (Microsoft Corporation) for Microsoft Clarity, which measures how pages are used, including session recordings and heatmaps, and runs only if you consent through the cookie banner or cookie preferences.

We share data with these providers only so they can provide their service to us, under contracts that restrict their use of it. We do not sell your personal data and we do not share it with third parties for their own marketing. We may disclose data where the law requires it.

The primary processing region is the United Kingdom and Europe. Some providers may process data in the EU or the US under appropriate safeguards, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses as applicable to each provider.

Production records and extracted content are retained to support audit access for as long as the production's account remains active. Anonymisation of personal data within records, full production export, and account deletion are available on request.

Account data is retained while your account is active.

Audit trail entries are retained with the records they describe. Database backups are retained on a rolling schedule and expire automatically.

Billing records are kept for as long as required by UK tax law.

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access: request a copy of your data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure.
• Right to object or restrict processing for certain purposes.
• Right to data portability: receive your data in a portable format.
• Right to complain to the Information Commissioner's Office at https://ico.org.uk if you believe your rights have not been respected. We would appreciate the chance to resolve any concern first.

Where we act as processor for a production company, your request goes to them and we will assist; where we are controller, email info@tolmon.com with enough detail to identify your account. We respond within 30 days; complex requests may be extended once by a further 60 days, and we will tell you if that applies.

We apply the following controls: TLS for all data in transit; passwords hashed with bcrypt, never stored in plain text; all API routes rate-limited; session tokens with a sliding 30-day expiry; inbound webhooks signed and verified with HMAC-SHA256; no secrets in URLs; role-based access enforced at the query level, with reviewers seeing only productions they are explicitly linked to; and a full audit trail in which every state change is logged with actor, timestamp, and before and after values.

Wrap Zero uses a small set of first-party httpOnly cookies that are essential to sign you in and keep your session secure.

With your consent, given through the cookie banner or the cookie preferences link in the page footer, we also use Google Analytics and Microsoft Clarity to understand how the site is used. These set their own cookies (such as _ga) only after you consent, and Microsoft Clarity includes session recordings and heatmaps. You can withdraw consent at any time from the cookie preferences link and those cookies will no longer be set.

We also use Vercel Web Analytics and Vercel Speed Insights, which are cookieless and collect aggregate page-view and performance data without tracking you across sites.

We do not use advertising cookies and we do not sell your data.

Wrap Zero is a workplace tool and is not directed at people under the age of 18. We do not knowingly collect data about anyone under 18. If you believe someone under 18 has an account, contact info@tolmon.com and we will delete it.