Privacy Policy Draft

01Who we are

This Privacy Policy explains how [LEGAL ENTITY NAME] ("CineKit", "we", "us"), [ADDRESS], handles personal information when you use the CineKit website, web app, API and command-line tools (the "Service"). For personal information in your account and the Service we are the controller. For privacy questions and requests, email hassan.uriostegui@gmail.com.

[EU / UK REPRESENTATIVE]

02What we collect

We collect only what we need to run the Service:

• Account information. Your sign-in identifiers, such as your email address and name, handled through our authentication provider, Clerk. We do not receive the password you use with Clerk or with a third-party sign-in provider.
• Team information. The teams you belong to and your role in them.
• Your content. Scripts, story text, prompts, images, Canon kits and other uploads, and the output generated for your projects. Your content may contain personal information, for example images of people.
• Usage and billing records. Projects, runs, estimates, token reservations and settlements, and the API keys we issue to your team.
• Technical data. Logs such as IP address, browser or client type, request identifiers, timestamps and errors, used to operate and secure the Service.
• Messages. What you send us when you contact us.

Payment details. Payments are not live yet and we do not collect payment details today. When paid plans launch, payments will be handled by a third-party payment processor (we plan to use Stripe), and we will update this policy first.

03How we use it

We use personal information to:

• provide the Service: sign you in, store your projects and run the generation steps you request;
• estimate, reserve and settle tokens, and keep accurate usage records;
• keep the Service and our users safe, prevent abuse and enforce our Terms of Service;
• answer your questions and send you service messages, such as security or policy notices;
• understand and improve how the Service works;
• meet legal obligations.

Use of your content to train or improve AI models: [USE OF CONTENT FOR MODEL TRAINING]

Marketing messages: [MARKETING COMMUNICATIONS AND OPT-OUT]

04Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain and improve the Service), balanced against your rights; your consent where we ask for it, which you can withdraw at any time; and legal obligations.

05Who we share it with

Your projects are private to your team. We do not show your content to other teams. We share personal information only with the service providers that help us run the Service, under contracts that limit their use of it to providing services to us:

Full and current list of subprocessors, with locations: [SUBPROCESSOR LIST LINK]

We may also disclose information if the law requires it, to protect the rights and safety of our users, the public or CineKit, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.

[SALE / SHARING DISCLOSURE (US STATE LAW)]

06How your content is stored

Uploads (scripts, images, Canon kits) and generated media are stored per team. Everyone on your team can access them; other teams cannot. Our staff access content only when needed to operate, secure or support the Service, or when the law requires it.

Test mode runs are simulated and return placeholder artifacts.

07Images of people

If your Canon kit or uploads include images of real people, we use them only to generate and keep those characters consistent within your project, which includes sending them to the generation providers listed above. Upload a person's likeness only with their permission. [BIOMETRIC DATA STATEMENT]

08How long we keep it

We keep personal information for as long as your account is active and as needed to provide the Service. After an account is closed, or when you delete content, we keep it only for a limited period (provisional: [DATA RETENTION PERIOD]) and then delete it, unless we must keep it longer by law (for example, records of transactions) or to resolve disputes. Copies in backups are removed on the normal backup cycle.

09Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on it;
• not be treated differently for exercising these rights.

To use these rights, including to ask us to delete your account and data, email hassan.uriostegui@gmail.com. We may need to confirm your identity first. We respond within the time the law requires. If you are in the EEA or UK, you can also complain to your local data protection authority. Residents of California and other US states with privacy laws may use an authorized agent and may appeal our decision by replying to it.

10Cookies

Signing in to the Service uses cookies and similar storage set by our authentication provider, Clerk. They are needed to keep you signed in and to protect your account. At the time of writing, our marketing pages load no analytics or advertising scripts. If we add any non-essential cookies, we will update this section and ask for consent where the law requires it. [COOKIE LIST / CONSENT TOOL]

11Children

The Service is not intended for anyone under [MINIMUM AGE], and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

12International transfers

Our providers may process information in the United States and other countries whose data protection laws may differ from those where you live. Where the law requires it, we protect these transfers with appropriate safeguards: [TRANSFER SAFEGUARDS]

13Security

We scope every project to its team and limit access to the people and systems that need it. API keys can be revoked at any time. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If you think your account or a key has been compromised, revoke the key and contact us.

14Changes to this policy

We will update this policy as the Service changes, in particular before paid plans launch. We will post the new version here with a new effective date and, for material changes, tell you in advance by email or in the Service.

15Contact

[LEGAL ENTITY NAME]
[ADDRESS]
Privacy, deletion and legal requests: hassan.uriostegui@gmail.com