Privacy Policy

• Account data — email address, username, display name, optional profile picture, password hash (or the identifier from Apple/Google sign-in), account settings and preferences.
• Uploaded media — the video, audio and image files you upload, plus prompts, scripts and captions you write or edit.
• Generated content — the videos, clips, voiceovers, captions and thumbnails produced for you, and the storyboard data behind them.
• Usage and technical data — pages viewed, features used, credits spent, render events, error logs, IP address, browser and device type, approximate location from IP, and cookies or local storage needed to keep you signed in.
• Billing data — plan, currency, invoices, subscription status and the last four digits and expiry of your card. We never see or store full card numbers; those go directly to our payment provider.
• Publishing data — access tokens for social accounts you connect, the posts we made on your instruction, and their public metrics (views, likes, comments).
• Affiliate data — your referral link, clicks, referred sign-ups, commissions and payout details, where you take part in the affiliate programme. If you take part, your earnings figures (income per month, income in total and your rank) may be shown publicly on your profile and the leaderboard, together with your name and profile picture. You can ask us at any time to remove your earnings from public display, and closing your account removes them.
• Support correspondence — the messages you send us and our replies.

We do not intentionally collect special-category data. Please do not upload media containing sensitive personal data about others without a lawful basis to do so.

• Performance of a contract (Art. 6(1)(b)) — creating and running your account, generating and storing videos, metering credits, taking payment, posting to the accounts you connect, and providing support.
• Legal obligation (Art. 6(1)(c)) — keeping invoices and tax records, handling VAT, and responding to lawful requests.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing fraud and abuse, debugging, aggregate product analytics, and protecting our legal position. We balance these against your rights and use the least intrusive data we can.
• Consent (Art. 6(1)(a)) — optional analytics or marketing cookies, marketing emails, and connecting a social account for publishing. You can withdraw consent at any time, without affecting past processing.

We do not use your uploaded media or generated videos to train our own models, and we do not sell personal data. We do not make decisions with legal effect about you by automated means.

We use a small number of vetted providers, each under a data processing agreement that limits them to acting on our instructions:

• Payment provider — Stripe Payments Europe, Ltd. (Ireland), for checkout, subscriptions, invoices, tax and affiliate payouts. Stripe acts as an independent controller for fraud prevention and regulatory purposes under its own policy.
• Hosting, database, authentication and storage — our cloud platform and its managed database, authentication and file storage services, which hold your account data and media.
• AI model providers — providers of the language, image, video and text-to-speech models used to generate your content. Your prompts and the media needed for a generation are sent to them for the time it takes to produce the result. Where the provider offers it, we use zero-retention or no-training terms.
• Email delivery — for transactional email such as sign-in, receipts and service notices.
• Analytics and error monitoring — privacy-conscious product analytics and error logging, used in aggregate to understand feature use and fix faults.
• Social platforms — where you connect an account, we send the video and caption you approve to that platform (for example YouTube, TikTok, Instagram, Facebook), which then processes it as its own controller.

We may also disclose data to professional advisers, or to authorities where legally required, and to a buyer if the business is sold — in which case this policy continues to apply until you are told otherwise.

• Account data — for as long as your account exists, then deleted or anonymised within 30 days of closure.
• Uploaded media and generated videos — until you delete them, or within 30 days of account closure. Deleting a video in the app removes it and its derived files.
• Billing and tax records — retained for the statutory period, typically 7 years, even after account closure.
• Usage and error logs — normally up to 12 months.
• Social access tokens — until you disconnect the account or revoke access at the platform, then deleted promptly.
• Affiliate and payout records — retained as long as needed for the programme and applicable tax rules, including EU DAC7 reporting.

Backups may hold copies for a short additional period before rotating out.

We prefer EU or EEA hosting. Some processors — particularly AI model providers and analytics — are established in, or use infrastructure in, the United States or other third countries. Where data leaves the EEA we rely on an adequacy decision (such as the EU–US Data Privacy Framework where the provider is certified), or on the European Commission's Standard Contractual Clauses together with a transfer risk assessment and technical measures such as encryption in transit and at rest. You can ask us for a copy of the safeguards used for a specific transfer.

Under the GDPR you have the right to:

• Access — get confirmation of what we hold about you and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where we no longer need it, including by closing your account. Records we must keep by law (such as invoices) are the exception.
• Data portability — receive the data you provided to us, and the content you created, in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible.
• Objection — object to processing based on our legitimate interests, including profiling, and to direct marketing at any time.
• Restriction — ask us to pause processing while a dispute is resolved.
• Withdraw consent — for anything you consented to, at any time.

Email veslate@gmail.com with the subject "GDPR request" from the address on your account, and tell us which right you want to exercise. We may ask a question to confirm your identity. We reply within one month, and will tell you if we need up to two further months for a complex request. Exercising your rights is free; we only charge for repeated, excessive requests.

Much of this is also self-service: you can edit your profile, download your videos, delete individual videos, disconnect social accounts and close your account from your account page.

If you are unhappy with how we handled your request you can complain to your national data protection authority, or to our lead authority in the Netherlands. We would appreciate the chance to fix it first — see our contact page.

We use encryption in transit and at rest, row-level access controls so users can only reach their own data, scoped signed URLs for media, hashed passwords and least-privilege access for staff. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as required.

Filmotion is not intended for children. We do not knowingly collect data from anyone under 18, and will delete such an account if we learn of it.