Privacy

This document has not been reviewed by a lawyer. It is an accurate description of what the software does, written from the source. The identity of the data controller, the lawful basis for each purpose, the international transfer mechanism and the supervisory authority are left blank on purpose — those are legal determinations, not facts about the code, and inventing them would be worse than leaving them visible.

What is held about a person

An account row holds an email address, a display name, an optional avatar URL, a locale, and a password hash where a password was set. Sessions record the user agent and IP address they were created from. Signing in through Google additionally stores the identifier that provider returns.

What is held about work

Prompts, uploaded audio and video, generated audio, timelines, workflows and compiled banks belong to an organization rather than to a person. Every credit movement is an immutable row recording what was spent, on which capability, through which vendor, and the balance afterwards.

Where it goes

Prompts and audio are sent to the AI vendor configured for that capability, and only at the moment a job runs. Which vendors are enabled is an operator setting, visible per capability in the admin panel; a deployment that has enabled none sends nothing anywhere. Prompts may also be sent to a content screener before generation.

The operator of this deployment must list the vendors they have enabled here, as sub-processors, with their locations.

How long it is kept

Inputs to the isolator and splitter are deleted automatically after a configurable retention window. Other assets are kept until deleted. Sessions expire. Credit ledger rows are kept permanently and cannot be altered or deleted — they are the financial record, and the database refuses to modify them.

Erasure

An account can be erased. Doing so deletes sessions, connected sign-in accounts, organization memberships, hire-board profiles and messages, and blanks every identifying field on the account itself — email, name and avatar. What remains is a row that identifies nobody, retained because the immutable financial record points at it. An organization must be closed or transferred first, because it can hold work that is not yours to delete.

Closing an organization deletes its projects, assets, workflows, timelines and banks, and the files behind them. Its credit history is retained for the same reason.

Contact

The operator must give a contact address for data-protection requests here, and name the controller.