Privacy Policy

Controller

[TO CONFIRM: registered company name, number and address] is the data controller for the processing described here. Privacy enquiries: [TO CONFIRM: privacy contact address].

[TO CONFIRM: whether a Data Protection Officer and/or an EU/UK representative under art. 27 GDPR is required.]

What we collect

We do not collect payment card numbers. Card details are entered on Stripe and never reach our systems.

Why we process it, and on what basis

• To provide the service you asked for — performance of a contract. This covers account management, generation, storage and billing.
• To keep the service safe and lawful — legitimate interests and legal obligation. This covers content moderation, abuse and fraud prevention, and audit logging.
• To meet accounting and tax obligations — legal obligation. This is why billing records survive account deletion.
• Non-essential cookies and any marketing communications — consent, which you may withdraw at any time.

Prompts and uploads go to AI providers

This is the most important thing to understand about the service. To generate anything, we send your prompt, and any image, video or audio you supply as an input, to the AI provider you selected. Prompts are free text and can contain personal data; input images can contain identifiable people.

Content is also sent to a moderation provider to check it against the Content Policy before generation begins.

When an audio-enabled generated video is ready, we extract its audio and send that audio to OpenAI to create editable timed captions. This also applies when a different AI provider generated the video.

Do not upload images of other people without their consent, and avoid putting personal data in prompts unless it is necessary.

Product analytics

If you accept analytics cookies, we measure how the service is used so we can improve it. Our analytics provider is PostHog, on their European infrastructure in Frankfurt, so this data does not leave the EEA.

We deliberately limit what is sent. We record which pages you open and which features you use, associated with your account identifier — never your email address. We do not send the text of your prompts, the files you upload, or the media you generate. We do not record your screen or your keystrokes.

This runs only after you accept, it never runs before, and you can withdraw at any time from "Cookie preferences" in the footer. Declining changes nothing about how the service works for you.

One point of detail, because it is the only thing we hold before you have answered the banner: when you arrive, the campaign parameters in your link and the domain that referred you are kept in your browser for the duration of the visit, so that the information still exists if you then accept. It is held in session storage, cleared when you close the tab, and it is sent nowhere unless you accept. If you decline, it is never read and disappears with the tab.

Who we share it with

International transfers

Some providers are outside the European Economic Area. Transfers to the United States rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

Two video providers — ByteDance/Volcengine and Kling/Kuaishou — are established in China, for which no adequacy decision exists. Where these providers are used, transfers rely on Standard Contractual Clauses together with a transfer impact assessment. If you would rather your content not be sent to them, choose a different model; the provider behind each model is shown in the model catalogue.

[TO CONFIRM: signed DPAs and completed transfer impact assessments for each provider listed above.]

How long we keep it

• Account data: for as long as your account exists.
• Story conversations and their compacted memory: kept while your account exists so that you can reopen your writing history; deleted when your account is permanently closed.
• Media in your library: kept until you delete it or close your account. We do not remove your work on a timer.
• [TO CONFIRM: enable RETENTION_PURGE_ENABLED before publishing this line] Prompts and generation records: scrubbed 30 days after the generation completes. The media itself is unaffected.
• Billing records: retained after account closure to meet accounting and tax obligations.
• Audit logs of administrative actions: retained for security and accountability.
• Sessions: until expiry or sign-out.
• [TO CONFIRM: set the retention window on the PostHog project to match this figure] Product analytics: kept for 12 months, then deleted.

Your rights

You can exercise the following at any time. Two of them are built into the product and take effect immediately:

• Access and portability — download everything we hold about you as a JSON file from your profile.
• Erasure — close your account from your profile. Access ends and your published media leaves the gallery straight away; the permanent purge of your media and prompts runs after a 30-day window during which you can change your mind. Billing records are kept in anonymised form.
• Rectification — correct your account details from your profile.
• Objection and restriction — contact us to object to processing based on legitimate interests.
• Withdraw consent — change your cookie preferences at any time from the footer.
• Complain — you may lodge a complaint with your local supervisory authority. Contact us first if you can: [TO CONFIRM: privacy contact address].

Security

• Provider credentials are encrypted at rest with AES-256-GCM.
• Passwords are stored hashed; sessions use secure, HTTP-only cookies.
• Access to your private media is checked on every request.
• Uploaded files are verified by content, not by their declared type.

Automated decision-making

Generation requests are screened automatically against the Content Policy, and a request may be refused without a human reviewing it. This has no legal effect on you, and you can contact us to have a refusal reviewed by a person.

Children

The service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.