Privacy Policy

• Account data — email address, username, display name, optional profile picture, optional bio, country, password hash (or the identifier from Apple/Google sign-in), account settings and preferences.
• Public profile data — your username, display name, profile picture, bio, country and any videos you choose to make public are visible to others.
• Uploaded media — the video, audio, image and music files you upload (including podcast episodes and product photos), plus prompts, scripts and captions you write or edit.
• Ideas and dictation — every idea you type or dictate in the Create box is stored, together with the engine it was matched to, so we can improve engine matching and see which niches are requested. Voice dictation is sent to a speech-to-text provider to transcribe it; we keep the text, not the recording.
• Brand profile and goals — the brand name, audience, tone, style, colours, fonts, hooks, topics, logo, call-to-action and monthly content goal you enter, used to personalise recommendations and videos.
• Generated content — the videos, clips, voiceovers, captions, transcripts and thumbnails produced for you, and the storyboard data behind them.
• Cancellation feedback — if you cancel, the reason and optional comment you give, and which retention offers were shown or accepted.
• Usage and technical data — pages viewed, features used, credits spent, render events, error logs, IP address, browser and device type, approximate location from IP, and cookies or local storage needed to keep you signed in.
• Billing data — plan, currency, invoices, subscription status and the last four digits and expiry of your card. We never see or store full card numbers; those go directly to our payment provider.
• Publishing data — access tokens for social accounts you connect, the posts we made on your instruction, and their public metrics (views, likes, comments).
• Affiliate data — your referral link, clicks, referred sign-ups, commissions and payout details, where you take part in the affiliate programme. If you take part, your earnings figures (income per month, income in total and your rank) may be shown publicly on your profile and the leaderboard, together with your name and profile picture. You can ask us at any time to remove your earnings from public display, and closing your account removes them.
• Support correspondence — the messages you send us and our replies.

We do not intentionally collect special-category data. Please do not upload media containing sensitive personal data about others without a lawful basis to do so.

Every visit to Filmotion — whether or not you have an account — is logged with your IP address, the page visited, the time, and an approximate country derived from your IP address. If you are signed in, the visit is linked to your account. We use this to understand where our visitors come from (shown to our team as aggregated country statistics), to keep the service secure, and to detect fraud and abuse.

To protect the free plan, we also compare IP addresses and a browser/device identifier between accounts. If several accounts appear to belong to the same person, the duplicate accounts do not receive free credits. This check is automated and limited to abuse prevention; we do not use it for advertising or profiling.

The legal basis for this processing is our legitimate interest in security, fraud prevention and aggregate product analytics (Art. 6(1)(f) GDPR). You can object to it at any time — see section 6 — though this may mean we cannot offer you a free plan.

• Performance of a contract (Art. 6(1)(b)) — creating and running your account, generating and storing videos, metering credits, taking payment, posting to the accounts you connect, and providing support.
• Legal obligation (Art. 6(1)(c)) — keeping invoices and tax records, handling VAT, and responding to lawful requests.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing fraud and abuse, debugging, aggregate product analytics, and protecting our legal position. We balance these against your rights and use the least intrusive data we can.
• Consent (Art. 6(1)(a)) — marketing emails, connecting a social account for publishing, and making your profile details or videos public. You can withdraw consent at any time, without affecting past processing. We do not use advertising or third-party tracking cookies; we only use the cookies and local storage needed to keep you signed in and to protect the free plan.

We do not use your uploaded media or generated videos to train our own models, and we do not sell personal data. We do not make decisions with legal effect about you by automated means.

We use a small number of vetted providers, each under a data processing agreement that limits them to acting on our instructions:

• Payment provider — Stripe Payments Europe, Ltd. (Ireland), for checkout, subscriptions, invoices, tax and affiliate payouts. Stripe acts as an independent controller for fraud prevention and regulatory purposes under its own policy.
• Hosting, database, authentication and storage — our cloud platform and its managed database, authentication and file storage services, which hold your account data and media.
• AI model providers — providers of the language, image, video and text-to-speech models used to generate your content. Your prompts and the media needed for a generation are sent to them for the time it takes to produce the result. Where the provider offers it, we use zero-retention or no-training terms.
• Email delivery — for transactional email such as sign-in, receipts and service notices.
• Analytics and error monitoring — our own first-party visit logging (see section 1a) and error logging on our hosting platform, used to understand feature use and fix faults. We do not share visit data with advertising networks.
• Social platforms — where you connect an account, we send the video and caption you approve to that platform (for example YouTube, TikTok, Instagram, Facebook), which then processes it as its own controller.

We may also disclose data to professional advisers, or to authorities where legally required, and to a buyer if the business is sold — in which case this policy continues to apply until you are told otherwise.

• Account data — for as long as your account exists, then deleted or anonymised within 30 days of closure.
• Uploaded media and generated videos — until you delete them, or within 30 days of account closure. Deleting a video in the app removes it and its derived files.
• Billing and tax records — retained for the statutory period, typically 7 years, even after account closure.
• Usage and error logs — normally up to 12 months.
• Visitor logs (IP address and derived country) — up to 12 months, then deleted or anonymised; only aggregated country statistics are kept longer.
• Social access tokens — until you disconnect the account or revoke access at the platform, then deleted promptly.
• Affiliate and payout records — retained as long as needed for the programme and applicable tax rules, including EU DAC7 reporting.

Backups may hold copies for a short additional period before rotating out.

We prefer EU or EEA hosting. Some processors — particularly AI model providers and analytics — are established in, or use infrastructure in, the United States or other third countries. Where data leaves the EEA we rely on an adequacy decision (such as the EU–US Data Privacy Framework where the provider is certified), or on the European Commission's Standard Contractual Clauses together with a transfer risk assessment and technical measures such as encryption in transit and at rest. You can ask us for a copy of the safeguards used for a specific transfer.

Under the GDPR you have the right to:

• Access — get confirmation of what we hold about you and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where we no longer need it, including by closing your account. Records we must keep by law (such as invoices) are the exception.
• Data portability — receive the data you provided to us, and the content you created, in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible.
• Objection — object to processing based on our legitimate interests, including profiling, and to direct marketing at any time.
• Restriction — ask us to pause processing while a dispute is resolved.
• Withdraw consent — for anything you consented to, at any time.

Email filmotionhelp@gmail.com with the subject "GDPR request" from the address on your account, and tell us which right you want to exercise. We may ask a question to confirm your identity. We reply within one month, and will tell you if we need up to two further months for a complex request. Exercising your rights is free; we only charge for repeated, excessive requests.

Much of this is also self-service: you can edit your profile, download your videos, delete individual videos, disconnect social accounts and close your account from your account page.

If you are unhappy with how we handled your request you can complain to your national data protection authority, or to our lead authority in the Netherlands. We would appreciate the chance to fix it first — see our contact page.

We use encryption in transit and at rest, row-level access controls so users can only reach their own data, scoped signed URLs for media, hashed passwords and least-privilege access for staff. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as required.

Filmotion is not intended for children. We do not knowingly collect data from anyone under 18, and will delete such an account if we learn of it.