Privacy Policy

01What we collect

• Account: your name, email address, password (stored only as a secure hash), two-step sign-in settings, plan and role.
• Your work: projects, prompts, reference images and audio you upload, generated images, video and sound, character DNA, storyboards and edits.
• Billing: your Stripe customer and subscription records, invoices, and your credit ledger. Card details go directly to Stripe; we never receive your full card number.
• Review links: the name and comment a reviewer types on a link you share.
• Technical: IP address (to limit sign-in attempts and stop abuse), server logs of requests and job errors, and, if you turn on notifications, your browser's push subscription.
• Safety: reports you send us, and records of what our safety checks blocked (the prompt, or a fingerprint of the image). Generated media and the references you upload are checked by an automated model (Google Gemini) before they are shown or used.

02Why we use it

• To run the service you asked for: generating takes, storing projects, billing and support (performing our contract with you).
• To keep Studio·876 secure and stop fraud and misuse, including enforcing the Acceptable Use Policy (our legitimate interests, and legal obligations).
• To keep tax and accounting records (legal obligation).
• To send service messages such as receipts, security alerts and notices of changes. We do not send marketing email without your consent, and we do not sell your data or use it for advertising.
• We do not use your uploads or generations to train AI models.

03Who processes it for us

We share personal data only with service providers that help us run Studio·876, under contracts that limit their use of it:

• Google (Gemini, Veo, Lyria models): prompts, reference media and character details for the generations you run with them.
• OpenRouter, which routes requests to model providers such as OpenAI, Black Forest Labs, Kuaishou (Kling) and MiniMax (Hailuo): prompts and reference media for those generations.
• ElevenLabs: text and settings for sound and voice generations.
• Stripe: payments, subscriptions, invoices and tax.
• Cloudflare: network delivery and protection for our websites, and encrypted off-site backups (R2).
• Our cloud hosting provider and Resend (email delivery): the servers that store your account, projects and files, and the service that sends sign-in and account emails.
• Browser push services (Google, Mozilla, Apple, Microsoft), only if you turn on notifications.

Some of these providers are outside Jamaica, including in the United States, so your data may be processed there. We choose providers that protect it to a standard comparable to Jamaica's law. We may also disclose data when the law requires it, or to protect people from harm.

04How long we keep it

• Account data and your work: for as long as your account is open.
• When you delete your account (Settings → Your data), your profile, projects, files and credit history are deleted straight away. Copies in our encrypted off-site backups are removed within about 30 days.
• Payment and invoice records are kept by Stripe and by us for as long as tax and accounting law requires, even after you delete your account.
• Download links for data exports expire after 7 days.
• Server logs and safety records are kept only as long as needed for security and to deal with misuse. An upload blocked as suspected child sexual abuse material is set aside, out of your account, and kept for law enforcement as the law requires; it is not deleted with your account.

05Your rights and choices

• Access and portability: download everything your account holds, as a zip with your files and a data file, from Settings → Your data.
• Correction: change your name in Settings, and your email address once (after that, ask us), or ask us to correct anything else.
• Deletion: delete your account yourself in Settings → Your data, or ask us to.
• Objection: you can object to processing based on our legitimate interests, and to any direct marketing.
• Email [email protected] for any request. We reply within 30 days. If you are not satisfied, you can complain to the Office of the Information Commissioner in Jamaica, or to the data protection authority where you live.

06Cookies and browser storage

We use only what the service needs: a sign-in session cookie, a cookie that remembers light or dark mode, and browser storage for preferences such as your currency, sounds and layout. We do not use advertising or third-party analytics cookies, so there is no cookie banner to accept.

07Security

Data is encrypted in transit. Access to each account's data is restricted at the database level, payment details stay with Stripe, admin accounts must use two-step sign-in, and sign-in attempts are rate-limited. No system is perfect: if a breach affects your data, we will tell you and the regulator as the law requires.

08Children

Studio·876 is not for anyone under 18. If we learn an account belongs to someone under 18, we close it and delete its data.

09Changes

If we change this policy in a way that matters, we will tell account holders by email or in the app before the change applies.