Privacy Policy

1. What we collect

• Account data: email address, name (optional), and — for Founder's Pass — payment records (order and payment IDs; we never see or store your full card or UPI credentials).
• Waitlist & community data: the email and optional referral source you submit, and your Telegram handle if you choose to share it.
• Generation data: the prompts you type and the videos we render for you, stored so they appear in your dashboard history.
• Technical data: minimal server logs (IP, user-agent, timestamps) used for security, abuse prevention and reliability.

We do not use third-party advertising trackers or sell your data.

2. How we use it

To operate the Service (auth, generation queue, billing), to email you transactional messages (magic links, receipt, waitlist position, launch announcements you opted into), to provide support, and to improve model quality in aggregate. Legal basis: consent, contract performance, and legitimate interest in securing the Service.

3. How we store it & who processes it

Application data lives in a Supabase Postgres database with row-level security — your rows are readable only by you. Generated media is stored in object storage. Payments are processed by Razorpay; transactional email is delivered by our email provider. These are our only sub-processors, and each is bound to protect data. Servers are located in India and Singapore; by using the Service you consent to transfers under India's Digital Personal Data Protection Act, 2023.

4. Cookies

We use strictly-necessary cookies for authentication sessions and CSRF protection. Analytics, where used, are aggregate and privacy-respecting. There are no advertising or cross-site tracking cookies.

5. Retention

We keep account and generation data for as long as your account is active. When you delete your account, personal data and generated files are removed within 30 days, except records we must retain by law (e.g., financial records for tax compliance). Publicly-published gallery videos remain until you remove them.

6. Your rights

You may request access to, correction of, or deletion of your personal data, export a copy, withdraw consent, or nominate another person to exercise your rights in the event of death or incapacity. To exercise any right, email us below — we respond within 30 days. You may also opt out of non-essential marketing emails at any time via the unsubscribe link.

7. Security

We apply encryption in transit (TLS), row-level security, passwordless magic-link sign-in (so no passwords are ever stored), and principle-of-least-privilege access. No system is perfectly secure; if a breach affects your data in a way that poses risk, we will notify affected users and the relevant authority as required by law.

8. Children

The Service is not directed at children under 18 without verifiable parental consent. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes & contact

If we make material changes we'll update the date above and, where appropriate, notify you by email. Questions, requests, or complaints about privacy: support@cinevaults.in. Related: our Terms of Service.