Data Protection

Last updated 2 August 2026

Security controls in place

Row Level Security is designed into every user table so records are only readable by their owner. Admin functionality is gated behind an explicit admin role. Uploaded files are validated for type and size before being accepted.

Payment data

Card details are never collected, stored or visible to administrators. Payment handling is delegated to the payment provider, which returns only a customer and subscription reference.

Retention

Projects, scenes and media are retained while your account is active. Deleting a project removes its scenes and render jobs. Deleting your account removes associated records.

Data subject requests

Requests for access, export or deletion are handled by the app owner. Response targets follow UK GDPR timescales of one calendar month.

Sub-processors

External AI, voice, stock media, rendering and storage providers are not connected in this release. Each will be added here with its purpose and region before it processes any customer data.