The Spotlight Challenge: Fall 2026 — Privacy Notice

PRE-LAUNCH DRAFT — NOT FINAL. Legal review has not occurred. This notice is for planning transparency and is not legal advice. It may be revised before registration opens.

Scope

This notice explains how Spotlight Drive handles information for The Spotlight Challenge: Fall 2026, including registration, payment verification, prompt assignment, participant access, guardian consent, submissions, judging, communications, and administration.

Information collected

• Entrant and contact information, including name and email address.
• Team, credited-participant, role, film, synopsis, poster, and submission information.
• Age-status declarations and, when required, parent or legal-guardian name, email, relationship, and consent record.
• Shopify order identifiers, product and payment status, purchase timestamps, and webhook delivery identifiers. Spotlight Drive does not receive full payment-card numbers through the Challenge backend.
• Entry ID, assigned challenge reference, deadline, private-link status, audit history, and benefit-entitlement status.
• Rights, release, music, generative-AI, viewer-advisory, and withdrawal information.
• Technical and security information reasonably needed to prevent abuse and maintain the service.

How information is used

Information is used to verify qualifying payment; create and administer one entry per paid film; assign and protect the secret challenge; calculate deadlines; provide private access; obtain guardian permission; receive and review submissions; conduct judging and audience-rating processes; communicate operational information; investigate errors or abuse; document decisions; preserve participant benefits; and meet legal, safety, accounting, and rights obligations.

Public and private information

Applications, prompts, private links, payment data, guardian records, and internal audit records are private by default. If a film is accepted for public showcase, Spotlight Drive may display information the entrant submitted for that purpose, such as film title, poster, synopsis, credits, viewer advisories, trailer, rating, or selected excerpts. A private registration does not itself create a public profile or search-indexing consent.

Secret prompts and private links

Prompt assignments and participant payloads are stored in encrypted form. Private access tokens are stored as non-reversible hashes. The public Challenge page and client-side code do not contain the active secret prompt pool. Participants must keep their private links and assigned prompts confidential.

Service providers

Spotlight Drive may use Shopify for commerce and order events; Cloudflare for application hosting, database, security, and encrypted processing; an authorized transactional-email provider for delivery; and Dropbox or another disclosed file service for final masters. These providers process information under their own terms and applicable agreements. The email workflow will not send until an approved provider and sender are authorized.

Minors and guardian consent

The registration workflow asks whether the entrant is under 18. A minor's entry requires parent or legal-guardian contact and affirmative consent before participation or showcase. The guardian workflow records consent status and an audit trail. Spotlight Drive may request additional proof or withdraw an entry when valid permission cannot be confirmed.

Participant benefits

For eligible credited participants, Spotlight Drive may retain an entitlement record for one month free plus the next three months at 50% off, subject to final terms. The initial claim status is not_generated; no redemption code is created at registration.

Sharing

Information may be shared with service providers, judges, reviewers, or contractors only as reasonably needed for the event; with a guardian for a minor's consent; with authorities or other parties when required by law or necessary to protect safety and rights; and in connection with a lawful business reorganization. Spotlight Drive does not intend to sell Challenge participant personal information.

Security

Controls include encrypted sensitive records, private tokenized access, hashed access tokens, signed paid-order webhook verification, idempotent entry creation, audit logging, administrative authentication, least-public-data design, and noindex protections on private participant pages. No system can guarantee absolute security.

Retention

Working retention is limited to what is reasonably needed for event administration, disputes, accounting, rights documentation, safety, and promised participant benefits. Payment and audit records may be retained longer where required. Private submission files may be removed or archived after the event according to the final retention schedule. The final schedule will be set before launch.

Choices and requests

Participants may request access, correction, withdrawal, or deletion subject to legal, payment, fraud-prevention, audit, and rights-retention requirements. Withdrawal before premiere normally forfeits completion benefits. A request cannot force deletion of records Spotlight Drive must preserve to document a transaction, consent, dispute, or legal obligation.

U.S. focus

This first edition is designed for the United States. Information may be processed in the United States and in locations used by approved service providers.

Changes and contact

Material updates will be dated and communicated when practical. Privacy or Challenge questions should be sent to challenge@spotlightdrive.com once that mailbox is active; until then, use the contact method on spotlightdrive.com.