Privacy Policy

• Account data — managed through Supabase Auth: your email address, hashed credentials, handle, display name, and any avatar or bio you add. If you sign in with Google, Google shares your name, email address and profile picture with us. We also keep your language, the country your connection comes from (country only, derived from your IP address by our hosting provider) and when you were last active.
• What you create and publish — titles, videos, posters, synopses, AI-provenance manifests, comments and reports; and, in the Studio, your ideas, screenplays, prompts, reference images and takes. Drafts are private until they premiere (a finished production premieres in the catalog by itself; the Terms of Service explain when), and published content is public by design.
• Reference photo (optional) — one photo you can attach to an idea in the Studio. We re-encode it on upload, which strips its metadata (such as where it was taken), and keep it private: it is never shown on the public listing of your work. See "Who processes your data" (Anthropic) and "Retention".
• Wallet and payments — your balance and its movements (top-ups, spending, refunds and gifts). Payments are processed by Stripe: your card details go directly to Stripe and never reach us; we receive the confirmation, the amount and a payment reference.
• Verified identity (optional) — facial images, a liveness check and, if you choose, a short voice recording; see "Verified identity" below.
• Engagement — likes, watchlist entries and follows, tied to your account so your library works.
• View telemetry — which title or episode was played, how many seconds were watched and when. Signed in, it is linked to your account for "continue watching"; signed out, it is stored without a persistent identifier. With each view we also record where the visit came from: the referring site's domain only (never the full address of the page you came from) and any campaign tags (UTM parameters) in the link you arrived through. This adds no cookie.
• Welcome-gift protection — to give the welcome gift once per person, we keep your email address in canonical form (lowercase, without "+tags" and, for Gmail, without dots); a hash, computed with a secret key, of the IP address from which the gift is given to you (for IPv6, one of its /64 network and another of its /48); and a hash of the random identifier in the aimovies_device cookie of the browser you used (see Cookies). We don't store the IP address itself, and we delete the hashes of the IP address and the browser around 30 days later, and the /48 one around 7 days later: the deletion runs with the first sign-up or sign-in on AIMovies once they are that old. We use this only to give one gift per person: an account doesn't get the gift if another account already got it with the same email address or, within 30 days, from the same browser; and one network can receive one gift every 30 days (a /48, four every 24 hours), so a second account from the same network gets it later, when it signs in from another one. If we don't give you the gift because another account already got it, we keep a note saying so, without your network or browser, while your account exists. None of this ever stops you from signing up.
• Email — whether the emails we send are delivered and opened and which links are clicked; and, if you subscribe to the newsletter without an account, your email address, language and confirmation.
• Messages and technical data — what you send us through the in-product feedback form, with the context attached automatically (page, production and browser); error reports (page address and browser type); and IP addresses, used transiently for rate limiting and abuse prevention, not to build viewing profiles.
• Quality log — when a generation fails or comes out wrong (a blocked shot, a provider error, a mispronounced line, a face on the wrong character), we record what happened: the provider and model, the kind of error, how it was detected, how it was fixed and what it cost, with counts about the shot (such as whether it has dialogue or a verified identity) but never its text, what was said or its images. It helps us choose which model to use for what. If you mark a take as an AI mistake, we keep the reason you write, and we count how many takes an account marks to prevent abuse of our guarantee: we may pause the free redos of an account that marks most of what it pays for. We don’t use the log for anything else. Deleting your account deletes the reasons you wrote and unlinks the rest of the log from you.

Starring in your productions is optional. If you do it, we process biometric data: a live verification (liveness check) run by our identity provider, facial photos from several angles and, if you choose, a short voice recording.

• Only two purposes: verifying that you are really you, and generating the content you ask for starring you — including productions by creators you have allowed to cast you, by accepting their invitation or by switching on "Public actor", while that permission lasts. If you switch "Public actor" off, no new scene with you can be generated through it.
• Private storage under our control. Your materials are kept in private storage that is not publicly accessible; only our servers can read them, and they hand them out only through short-lived links.
• Sent only to generate. To produce a scene you appear in, your materials are sent to the generation provider used for that scene — today, BytePlus; if that changes, we will tell you before it happens — solely for that purpose. We don't train general AI models with them, and we don't allow our providers to train with them. Any other use — for example, a model adjusted to you personally — would first need your express consent.
• The videos you appear in are processed like any other production: for example by fal, if the 4K upgrade is ordered or when we automatically check the dialogue, and by ElevenLabs, if a dub is ordered (it receives the video and recreates the voices; we delete the dubbing project from ElevenLabs as soon as the dub is finished).
• Legal basis and control. We rely on your explicit consent, recorded with its date and the version of the notice you accepted. You can withdraw it at any time by deleting your verified identity in Settings: we then delete your reference group at BytePlus and erase from our storage your original photos and voice recording — including any upload that failed along the way — and no new scene can feature you. Works already made with your permission follow the Terms of Service.

No ad tracking today. AIMovies sets no third-party advertising cookies, embeds no cross-site trackers, and does not sell or rent personal data. We don't train general AI models with your identity materials, and we don't allow our providers to train with them. If any of this ever changes we will update this policy and notify you before the change takes effect.

• to operate the service: accounts, playback, publishing and the Studio;
• to run your wallet: charge generations, refund failed ones automatically and keep a record of payments;
• to power your library — watchlist, likes and continue watching;
• to compute aggregate statistics such as view counts and 7-day trending, and to learn which sites and campaigns bring visitors (aggregates only, never individual viewing histories);
• for moderation, security and abuse prevention — including handling reports, enforcing rate limits and giving the welcome gift once per person;
• to translate listings automatically (title, synopsis, character names and the creator's “How it was made” notes) so they read in both catalog languages;
• to send email: account and activity notices (for example, when your production is ready) and, if you have an account, the Friday email with the week's premieres — you can turn it off in Settings or with the one-click link in every email. Visitors without an account only receive it after subscribing and confirming their address. We measure deliveries, opens and clicks to know whether our emails work.

Where the GDPR or UK GDPR applies, we rely on:

• performance of a contract — providing the service you signed up for, including the Studio and your wallet;
• legal obligations — for example, keeping payment records as accounting and tax law requires;
• legitimate interests — security, abuse prevention (including welcome-gift protection), moderation, aggregate analytics and visit origin, and the Friday email to account holders about our own service, balanced against your rights; you can object at any time;
• consent — the newsletter for visitors without an account and other optional communications, and explicit consent for verified identity; you can withdraw it at any time.

We work with these providers, each acting on our behalf and under our instructions:

• Supabase — authentication, database and file storage, including the private storage for identity materials.
• Vercel — hosts and serves the site; processes your IP address and technical request data, and tells us the country a connection comes from.
• PostHog — product analytics: the pages you visit and how you use the interface, under a random identifier that only lasts while the page is open. No cookies, no browser storage and no session recordings.
• Stripe — payments: the card and billing details you enter at checkout; we only send it your internal user identifier and the amount. For some purposes, such as fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
• Resend — sends our email: your address, the name we greet you with and the content of the message; it reports deliveries, opens and clicks back to us.
• BytePlus (BytePlus Pte. Ltd.) — our main AI provider: video and image generation, the live identity check, the library of verified-identity references, and backup text generation for the screenwriter and translations. It receives prompts, screenplays and reference images, the sample voice of invented characters in the Studio (which also goes through its audio filter) and — only if you use verified identity — your facial images and voice.
• fal — backup video generation when the main provider fails (today it receives no verified-identity materials); image generation in the Studio with OpenAI's model (see OpenAI below); the 4K upgrade of works it is ordered for (the video may show your face if you appear in it); automatic transcription to check the dialogue of takes and dubs; and the music of premieres, generated from a written description of the style and of the mood of each part of the film (never its dialogue, the names of its characters or other personal data).
• OpenAI — image generation in the Studio, through fal: character reference sheets and the frames of each shot. It receives the text of the image prompt and, as references, only character sheets that we generated ourselves. It does not receive verified-identity materials, photos you upload or the reference photo of an idea.
• ElevenLabs — dubbing into another language when one is ordered: it receives the video of the published work (image and sound), separates the voices and recreates them in the target language. We delete the dubbing project from ElevenLabs as soon as the dub is finished. It also prepares the fixed voice of invented characters in the Studio, in one of two ways: from the sound (never the image) of their first take in which they speak alone, which it transcribes to find their lines and cleans of background sound; or, if we design it, from a written description of the voice (age, tone and accent, taken from the screenplay and never from a real person) and a sample sentence, returning sample voices. The voice we keep is stored in our storage while the production exists. Never for characters played by a verified identity, for takes that carry a verified voice, or for children's characters. If you use “Fix the line”, it receives the sound of that take and the character's sample voice (when their voice comes from a take, their lines from the takes recorded with that voice, cleaned of background sound), creates a temporary voice to read the corrected line, and we delete that voice as soon as it has been read. Never for characters played by a verified identity, for takes that carry a verified voice, or for children's characters.
• Anthropic — the Studio screenwriter (the idea you write, the drafts it produces and genre suggestions); the automatic translation of listings (title, synopsis, character names and the creator's “How it was made” notes); the voice brief of invented characters (their description and some of their lines); the music plan of a multi-shot premiere (its style, its title and what happens in each shot, without the dialogue); and the reference photo you attach to an idea, which it looks at once to describe the place, era, wardrobe, colors and light for the screenwriter, with the instruction never to describe faces. Today that photo is not sent to any image or video generation provider.

If you sign in with Google, Google authenticates you under its own privacy policy. Beyond these providers we share personal data with no one, except where the law requires it or to protect the safety of the service and its users. Content you publish is public by design.

Some of these providers are established, or process data, outside the EU/EEA — mainly in the United States and, in BytePlus's case, in Southeast Asia. When that happens we rely on the safeguards the GDPR provides, such as the European Commission's Standard Contractual Clauses or, where one exists, an adequacy decision for the destination country.

Account and content data are kept while your account is active. View events (including where the visit came from) feed rolling aggregates such as 7-day trending and lose relevance quickly; we keep them no longer than needed for statistics and abuse prevention. Verified-identity materials are kept until you delete your verified identity or your account, and are then erased as described above. The IP address and browser hashes used for welcome-gift protection are deleted around 30 days later (the /48 one, around 7 days later), as explained above; the canonical email address, and the note that an account didn't get the gift, are kept while your account exists, so the gift can't be claimed twice. A reference photo is kept while the production that uses it exists and is deleted with it, when you remove it or with your account; a photo you upload but never use in a production is deleted when you upload another one, when you discard the draft or with your account. The voices of invented characters are kept while the production exists and are deleted when the production or your account is deleted. The quality log is kept for statistics about the models; when your account is deleted, the reasons you wrote are deleted and the rest is no longer linked to you. A dubbing project stays at ElevenLabs only until the dub is finished. Wallet movements and payment records are kept for as long as accounting and tax law requires. When you delete content or your account, associated personal data is deleted or anonymized within a reasonable period, allowing for transient backups and anything we must retain to comply with law or resolve open moderation or legal matters. Deleting your account removes your profile, productions, files, verified identity and dubbing projects; we keep only a copy of your wallet movements and payments, in restricted storage, for the accounting and tax periods above.

Depending on where you live, you may have the right to access, rectify, erase, restrict or object to the processing of your personal data, to receive a portable copy, and to withdraw any consent you gave. Exercise them — or ask us to delete your account — at legal@aimovies.com; we answer within the statutory deadline. If you are in the EU/EEA or UK you can also lodge a complaint with your local supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).

• Strictly necessary — the Supabase session cookie that keeps you signed in, and one that remembers the language you chose.
• Welcome gift — a technical cookie, aimovies_welcome, that we set when you sign up or sign in, and when we retry the gift automatically in your first 30 days. It holds your account's internal identifier and remembers that we have already tried to give you the welcome gift, so that the retry runs at most once an hour: it lasts 1 hour while the gift is pending (for example, because your network had reached its limit) and 30 days otherwise. Only our server reads it.
• One gift per browser — a technical cookie, aimovies_device, that we set at the same moments. It holds a random identifier, not derived from your device or from you, so that the welcome gift is given once per browser; we keep only a hash of it, as explained above. It lasts 30 days from the last time we set it. Only our server reads it.
• Referral — only if you arrive through a user's invitation link, a cookie that lets us credit that invitation when you sign up; it lasts 30 days.
• Product analytics — PostHog sets no cookie and stores nothing in your browser: the identifier it uses to count visits lives in the page's memory and disappears when you close or reload it. If an earlier visit left a PostHog cookie or local-storage entry, we delete it.
• Local storage — for conveniences such as keeping the prompt you were writing while you sign in, or remembering a preference.

No advertising cookies, no analytics cookies, no cross-site tracking, and analytics data is never sold or shared for marketing. Recording where a visit comes from adds no cookie.

Accounts are for people aged at least 16 (or the age of digital consent where they live). Watching requires no account, and some titles are suitable for all ages. We do not knowingly collect data from children; if you believe a child is using an account, contact us and we will act. Our Community Guidelines apply zero tolerance to any sexualized depiction of minors.

We will update this policy as the service evolves and note the date above; material changes get advance notice. Data controller and contact: legal@aimovies.com.