Privacy policy
Template last updated · 2026-09-04
Template document — to be completed and reviewed by the merchant before publication. This text is not legal advice and guarantees no compliance.
1. Who processes your data, and which data
The data controller is the publisher named in the legal notice. We process: account data (email, name, password — stored hashed, never in clear —, role in a workspace, two-factor authentication factor if you enable it); usage data (generation requests, parameters, quotes, token ledger, imported media and Generations, API keys, audit log of administration actions); technical data (IP address, browser, timestamps, security logs); billing data (packs bought, receipts, transaction identifier). Bank card data is entered and kept exclusively by our payment provider. We collect no sensitive data within the meaning of the GDPR; if content you import contains any (a voice, a face), you are responsible for it and must have the consent of the persons concerned.
2. Why, and on what basis
We use your data to: provide the service and fulfil your orders (performance of the contract); keep the token ledger, issue receipts and meet accounting and tax obligations (legal obligation); secure the service, prevent fraud and abuse, moderate content and respond to reports (legitimate interest and legal obligation); inform you of changes to the service and the Terms (legitimate interest); improve the service through aggregated usage measurements (legitimate interest); send you, with your consent, commercial information, which you may withdraw at any time. We do not use your content or your requests to train AI models, and we sell no data.
3. For how long
Account data: for the life of the account, then three (3) years from its closure or last activity, unless a longer legal obligation applies. Token ledger, receipts and billing records: ten (10) years (accounting obligation). Imported media and Generations: for the life of the account; an item placed in the trash is purged after the period shown in your workspace; on account closure, deletion within thirty (30) days unless a retention obligation applies. Technical and security logs: twelve (12) months. Audit log of administration actions: five (5) years. Mediation or dispute data: until all remedies are exhausted.
4. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to withdraw your consent at any time and to give instructions on the fate of your data after your death. You may exercise these rights from your workspace (profile, sessions, API keys, media, account closure) or by writing to the contact address in the legal notice, proving your identity. We reply within one (1) month, extendable by two (2) months for complex requests. You may lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) or the supervisory authority of your country of residence.
5. Cookies and security
The site uses only strictly necessary cookies (session, re-authentication, language), described in the cookie policy. No advertising cookie is set. Your data is protected by encryption in transit (TLS), password hashing, per-workspace data isolation down to the database, optional two-factor authentication, audit logs and encrypted backups. No system is infallible: in the event of a data breach likely to create a high risk to your rights, we will inform you within the periods provided by law.
6. Recipients, processors and transfers
Your data is accessible to our authorised staff and to our processors, to the extent necessary for their task: the host named in the legal notice; our payment provider (Stripe); the AI model providers that receive, for the duration of processing, the requests and media needed for each Generation — in particular deAPI, OpenAI, Google, ElevenLabs, MiniMax, Kling, Runway, Luma, Replicate, Black Forest Labs, fal.ai, kie.ai, MuAPI, Higgsfield, OpusClip, Vizard and Creatomate, depending on the requested capability and the routing in force, a list that may change; any email and audience measurement providers. Some of these providers are established outside the European Union, notably in the United States. Transfers are governed by the European Commission's standard contractual clauses or by an adequacy decision, and limited to the data necessary for the requested Generation. We disclose your data to authorities only on a legally founded request.