ON THIS PAGE
1. Who we are
Cineptic (“we”, “us”) runs the Cineptic website. We are the controller of the personal data described here, meaning we decide why and how it is processed. This policy applies to everyone who uses Cineptic and sets out the information we must give you under data protection law, including the GDPR and UK GDPR. Privacy requests go to support@cineptic.com. Words like “Service” mean the same as in our Terms & Conditions.
2. Data we collect
- Account data: your email address, name and profile image.
- Google profile data: if you sign in with Google, the name, email and profile image Google shares with us.
- Security data: device identifier, device type and name, IP address, browser user agent, login history and active sessions.
- Location: if you allow your browser to share it, the location of the device you sign in from, stored with that sign-in. It is optional: if you decline, sign-in still works. Your currency is guessed from your time zone on your device, without sending it to us.
- Your content: prompts, uploaded images and assets, generated videos, chats and projects.
- Feedback: the ratings you give to generations.
- Usage and billing records: wallet transactions and charges, and the transaction details we receive from Creem (see “Payments”). We never receive or store your full card details.
- Preferences: for example your preferred model and email notification setting.
- Support correspondence: the messages you send us and our replies.
3. How we use your data
- To provide the Service: run your renders, save your chats and projects, and operate your wallet.
- To personalise your experience: show your name, email and profile image in the app.
- To keep accounts secure and prevent fraud and abuse, including enforcing our Community Guidelines.
- For billing: credit your wallet after a payment and process charges and refunds.
- To screen prompts for prohibited content before a render is generated, to keep the Service safe and enforce our Community Guidelines (our Acceptable Use Policy).
- For support: answer your questions and resolve problems.
- To comply with the law and respond to lawful requests.
4. Legal bases (GDPR and UK GDPR)
If you are in the EEA or the UK, we rely on these legal bases:
- Contract: to provide the Service you signed up for, including crediting your wallet and support.
- Legitimate interests: to secure accounts, prevent fraud and abuse, keep the Service safe and lawful (including prompt moderation), and improve reliability, balanced against your rights.
- Legal obligation: to keep billing records, prevent prohibited content where the law requires it, and meet other legal duties.
- Consent: where we ask for it, such as optional email notifications and optional sign-in location (through your browser permission). You can withdraw consent at any time.
5. AI model providers
To generate an output, your prompts and inputs are sent to third-party AI model providers. They process that data to produce your result, under their own terms and policies. We do not use your content to train AI models, and we only send what the model needs to do the job.
6. Prompt moderation
Before a render is generated, your text prompt is sent to Creem’s content-moderation service to screen it for prohibited content. Flagged prompts are blocked. The purpose is safety and enforcing our Community Guidelines (our Acceptable Use Policy). Our legal basis is our legitimate interests in keeping the Service safe and lawful, and, where the law requires us to prevent such content, legal obligation.
7. Payments
Payments are made through Creem’s hosted checkout. Creem is operated by Armitage Labs OÜ (registry code 16977866, Rotermanni 14, Tallinn 10111, Estonia) and acts as merchant of record and reseller.
- Creem is an independent controller of checkout data. At checkout it collects your name, email, billing address, payment details, order details and transaction data such as device and IP address, for payment, tax, fraud-prevention and anti-financial-crime purposes, under its own Privacy Notice.
- We never receive your full card details.
- We receive transaction details from Creem, such as order and checkout identifiers, amount, currency and payment status, and use them to credit your wallet (contract and legal obligation).
9. Automated decision-making
Prompts may be blocked automatically by moderation. This is not decision-making that produces legal or similarly significant effects on you. Any action on your account follows our enforcement process under the Community Guidelines. You can contact support@cineptic.com about a blocked prompt, and appeal an enforcement action by email within 30 days for human review.
11. Device and session tracking
We record the devices and sessions that sign in to your account strictly to secure access and stop unauthorised access. We do not use this data for advertising or profiling. You can see your active devices in your profile, and changing your password signs out every session.
12. How we protect your data
We use strong safeguards, including encryption in transit (TLS), access controls and hashed passwords. No system is 100% secure, so we cannot guarantee absolute security. Keep your password safe and tell us at once if you suspect misuse. Data breaches: if a breach is likely to put your rights at risk, we will notify you and the relevant authority where the law requires.
13. How long we keep data
- We keep your data while your account is active.
- When you delete your account, we remove your data from active systems within 30 days, and from backups within 90 days.
- Some records are kept longer where the law requires it (such as billing records) or where we need them to handle abuse or legal claims. Creem keeps checkout data under its own Privacy Notice.
- Security, sign-in and moderation records are kept only as long as needed for security, abuse prevention and legal claims.
14. International transfers
Your data may be processed in countries other than your own, including on servers in the Asia region and by providers in other countries. Where the law requires it, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK equivalent) or an adequacy decision, and contractual data-protection commitments with our providers.
15. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you.
- Correct or update it.
- Request deletion of it.
- Restrict or object to our processing of it.
- Data portability: receive it in a usable format.
- Withdraw consent where processing is based on consent.
- Complain to a supervisory authority where you live.
Send requests to support@cineptic.com. We may need to verify your identity first. We respond within 30 days, or sooner if the law requires.
California (CCPA/CPRA)
We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer characteristics about you. You will not be treated differently for exercising your rights. California residents can request to know, delete and correct their personal information, and may use an authorised agent to make the request.
Bangladesh and other countries
We comply with the data protection laws that apply to us, including in Bangladesh, and honour the rights those laws give you.
16. Children
Cineptic is not directed to children under 13 (or the higher minimum age in your country). We do not knowingly collect their data. If we learn we have, we delete it. If you believe a child has given us data, contact support@cineptic.com.
17. Changes to this policy
We will tell you about material changes by email or in the app and update the date at the top of this page.
18. Contact
Privacy questions and requests: support@cineptic.com. Business enquiries: admin@cineptic.com.