Privacy policy

Account and identification: name, e-mail, password (in hashed form), billing details, account settings, versions of accepted terms and consents with timestamps.

Payments: payment details are processed by Stripe as an independent controller/processor; we retain transaction identifiers, payment history and subscription status, not card numbers.

Service consumption (metering): records of Credit consumption — account, type of operation, number of Credits, time. These records form the basis of billing (Article 6.5 of the Terms of Service).

Your Content: Inputs, Outputs, Scripts, projects and Brand Documents, including any personal data contained in them. You are responsible for the legal basis for the data of third parties in Your Content (Article 8.2 of the Terms of Service).

Likeness and voice (custom AI Actors): if you upload your likeness or voice to create a custom AI Actor, we process these recordings and data derived from them solely to provide that feature, on the basis of your express separate consent (see Article 5.3).

Technical and operational data: IP address, device and browser type, access, error and operational event logs, performance data. We keep operational logs to the extent necessary to ensure operation, security and incident resolution.

Communication: the content of communication with support and records of it.

Cookies and similar technologies: governed by the separate Cookie Policy.

Website usage data (only with your consent): pages you visit on kinemalab.ai and app.kinemalab.ai, the sections you scroll to and how long you stay, buttons you click, how you use videos (play, sound on, how far you watch), which plan cards you look at, the steps you take in the video brief and sign-up forms, device type, approximate location derived from your IP address, and the campaign or website that brought you. From the video brief we measure only its length and the options you pick, never the text you type.

“Continue on desktop” link: when you ask us to e-mail you a link from your phone, we store your e-mail address (for sending), a random link identifier, the page and role you came from and the brief you started, so that the link can open your sign-up where you left off. If you allowed analytics, we also store your analytics identifier so we can tell that the visit on your computer continues the one on your phone.

We do not train on your content. We do not use Your Content (Inputs, Outputs, Scripts, Brand Documents) to train or fine-tune our AI models. From the model providers through which we generate Outputs, we contractually require the same and select providers who commit to no training (details in Article 6.2).

We do not sell personal data to third parties.

We do not carry out automated decision-making with legal or similarly significant effects on you.

We do not use recordings of likeness and voice to identify, verify or authenticate persons; they serve solely to provide the feature you have requested.

Creating a custom AI Actor requires the processing of recordings of your likeness and/or voice and of data derived from them, which may constitute biometric data.

We carry out this processing solely on the basis of your express consent, granted in the product in a separate step before the first use of the feature, separately from the acceptance of the Terms of Service.

You may withdraw the consent at any time in your account settings or by request to support@kinemalab.ai; upon withdrawal, the custom AI Actor and the source recordings will be deleted without undue delay. Withdrawal does not affect the lawfulness of processing before the withdrawal.

If you upload the likeness or voice of another person, you are obliged to ensure their consent and information in accordance with legal regulations; this is your responsibility under Article 9.2 of the Terms of Service.

Processors: infrastructure and AI model providers, our payment processor (Stripe), support and e-mailing tools. The current list of sub-processors is available upon request at support@kinemalab.ai. We have data processing agreements in place with our processors; subcontractors with access to Brand Documents are bound by confidentiality (Article 10 of the Terms of Service).

AI model providers: to generate an Output, we transfer the necessary parts of your Inputs to the relevant model provider. We select providers with professional care so that their terms commit them not to use the transferred data to train their models, and we contractually require this commitment; we are not technically able to control the actual compliance of third parties with their commitments.

Public authorities: to the extent of legal obligations or under Article 14.4 of the Terms of Service.

Workspace members: content in a Workspace is visible to all its members and administrators (Article 4.2 of the Terms of Service).

Transfers outside the EU/EEA take place only with safeguards under Chapter V of the GDPR (adequacy decisions, standard contractual clauses).

Analytics and advertising providers, only if you allowed them: Google Ireland Limited (Google Analytics 4), Meta Platforms Ireland Limited (Meta Pixel) and LinkedIn Ireland Unlimited Company (Insight Tag). Their parent companies in the United States may process the data; these transfers rely on the EU–US Data Privacy Framework and standard contractual clauses. For the Meta Pixel and the LinkedIn Insight Tag we are joint controllers with the provider for the collection and transmission of the data (Art. 26 GDPR).

Kinema uses YouTube API Services. When you choose to connect a YouTube channel, Google asks you to grant Kinema permission to upload videos to your YouTube channel (the youtube.upload scope). We use that permission for one purpose only: publishing the videos, titles, descriptions, tags, thumbnails, scheduled publish times and the altered-or-synthetic-content disclosure that you approve in the app. We do not read your channel's videos, subscribers, comments or analytics, and we never upload without your explicit action.

We store an OAuth refresh token for each connected channel, encrypted at rest and never shown in the browser, together with the YouTube video IDs of uploads made through Kinema so the app can link to them. Google user data is not shared with third parties, not used for advertising, and not used to train AI models. People you invite to a channel can publish through its connection but cannot see or export the token.

You can revoke access at any time in Channel Settings using Disconnect, which also revokes the token with Google, or from your Google account permissions page at https://myaccount.google.com/permissions. Deleting the channel or your account deletes the stored token. Use of YouTube features is also subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy).