Privacy policy
Last updated:
1. Data controller
The controller of your data is Jesus Donado, a natural person, from Colombia. Contact for any data request: [email protected]. This policy applies to the Creator Studio website and app, and is designed to comply with Colombia's Law 1581 of 2012, the European Union's General Data Protection Regulation (GDPR, RGPD in Spanish) and its UK version, and the California Consumer Privacy Act (CCPA).
2. What data we process
Account data (email, name and photo if your sign-in provider gives them, user identifier); content you create (texts, ideas, scripts, audio, subtitles, images and videos, and the files you upload); usage data (tokens consumed, projects, activity logs); technical data (IP address, browser type and security logs); payment data (status, amount and date of the transaction; the card is handled by the payment processor); and audit records of your acceptances and purchases. We do not ask for sensitive data; do not include it in your texts.
3. The texts you write
The texts you write (ideas, scripts and image prompts) are stored in your account and sent to the Google Gemini API, and to the OpenAI API if you choose one of its voices, only to generate the script, voice or image you ask for. Those providers process them as processors under their terms for API customers. We do not use them to train models, we do not read them unless you ask us for support or there is a sign of abuse we must review, and we do not publish them. They are deleted when you delete them or when you delete your account.
4. Purposes and legal bases
Providing the service and managing your account and payments (performance of the contract); keeping the service secure and preventing fraud and abuse (legitimate interest); meeting legal, tax and accounting obligations (legal obligation); and keeping a record of your acceptance of these documents. In Colombia, the basis is your prior, express and informed authorization, which you give by accepting this policy. We do not use your data for advertising, and we do not profile you or make automated decisions with legal effects on you.
5. Who we share it with
Only with the providers needed to operate: Google (sign-in with Firebase, reCAPTCHA protection and generation with the Gemini API), OpenAI (voices, only if you choose them), PayPal or another payment processor shown at checkout, Cloudflare (hosting and network), Contabo (servers) and Pixabay (stock clip search; it only receives the search words). If the payment processor is the Merchant of Record of the purchase, it processes the payment data as an independent controller. We may also hand data to an authority when the law requires us to.
6. International transfers
Several of those providers operate outside Colombia and your country, for example in the United States and the European Union. We make these transfers only to provide the service and with providers that offer adequate safeguards, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. By accepting the policy you authorize those transfers, under article 26 of Law 1581 of 2012.
7. How long we keep it
Your account and your content, while the account is active; when you delete it from your profile they are erased immediately. Payment and audit records are kept for 5 years for accounting and evidence obligations, without content and linked to your account only by an irreversible fingerprint. Backups, up to 90 days.
8. Your rights in Colombia
You can access, update, correct and delete your data, revoke your authorization, request proof of it and file complaints (article 8 of Law 1581 of 2012). We answer inquiries within 10 business days and claims within 15 business days.
9. Your rights in the European Union and the United Kingdom
Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and to withdraw your consent when it is the basis of the processing, without affecting what was done before. We answer within one month at most. You can complain to the data protection authority of your country.
10. Your rights in California and other US states
You can know what data we hold about you and why, ask us to correct or delete it, and not be treated differently for exercising these rights. The categories we collect are those in section 2, for the purposes in section 4. We do not sell or share your personal data for advertising, and we do not use sensitive data to infer characteristics about you. An authorized agent can make the request on your behalf if they prove their authorization.
11. How to exercise them
From your profile (Your data) you can download a copy of your data and delete your account. For any other request, write to [email protected] from your account email, so we can verify it is you.
12. Minors
The service is only for people 18 and older and we do not knowingly collect data from minors. If we detect a minor's account, we delete it.
13. Security
We use encrypted connections, per-user access controls and verification of payment notifications. No system is infallible; if an incident affects your data, we will tell you and notify the authority when the law requires it.
14. Cookies and storage
What we store in your browser is detailed in the cookie policy.
15. Authority and complaints
In Colombia, the data protection authority is the Superintendence of Industry and Commerce (SIC). You can turn to it if we do not resolve your request.
16. Changes
If we change this policy in a relevant way, we will let you know and ask you to accept it again.