Privacy Policy

We collect the following categories of information:

• Account information — your email address, used to sign you in (we use passwordless magic-link sign-in) and to send service-related messages.
• Input Content — the footage, images, audio, and text prompts you upload or enter to generate output.
• Generated output — the video clips the Service produces for you.
• Billing metadata — your credit balance and purchase history. Payments are processed by Stripe; we receive transaction metadata but do not collect or store your full card number.
• Technical & usage data — basic logs (such as IP address, device/browser info, timestamps, and generation status) used to operate, secure, and debug the Service.

We use the information above to:

• provide, operate, and maintain the Service and your account;
• process your Input Content and prompts to generate the output you request;
• process purchases and manage your credit balance via Stripe;
• secure the Service, prevent abuse, enforce our Terms, and comply with legal obligations;
• communicate with you about your account and respond to support requests.

We do not sell your personal information, and we do not use your Input Content or output to advertise to you.

Legal bases (EEA/UK). Where the GDPR or UK GDPR applies, we rely on the following lawful bases:

• Performance of our contract with you — providing the Service, processing generations, and managing billing;
• Our legitimate interests — securing the Service, preventing abuse, and debugging, balanced against your rights;
• Compliance with legal obligations — tax, accounting, and record-keeping requirements;
• Consent — where required, which you may withdraw at any time.

We keep your media only as long as needed to operate the Service, then delete it on a rolling schedule enforced by an automated process that runs at least daily:

• Input plates (uploaded footage, images, and audio) are deleted within 30 days of upload.
• Output clips (generated video) are deleted within 90 days of generation, so you have time to review and download them.

Account and billing records are retained for as long as your account is active and thereafter as needed to comply with legal, tax, and accounting obligations. Residual copies may persist briefly in routine backups after deletion.

We share data with the following processors strictly to operate the Service, under their respective terms and safeguards:

• Third-party AI generation provider — performs AI generation and content moderation. Your Input Content and prompts are transmitted to this provider to produce output.
• Cloudflare R2 — object storage for your Input Content and generated output.
• Stripe — payment processing for credit-pack purchases; handles card data directly.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety, and security of vfxmagia, our users, and the public.

We use a strictly-necessary session cookie (or equivalent browser storage) to keep you signed in after you click your magic link and to protect your session. We do not use advertising or cross-site tracking cookies. Because the session cookie is essential to authentication, the Service will not function if you block it.

You can delete your generated clips and uploads from within the Service, and you may exercise the rights below by emailing us at contact@vfxmagia.com. After we verify your identity, we aim to respond within 30 days (or 45 days for California requests where permitted).

EEA & UK (GDPR). You have the right to access, rectify, erase, restrict, and port your personal information, to object to certain processing, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority (for the UK, the Information Commissioner’s Office).

California (CCPA/CPRA). You have the right to know about and access the personal information we collect, to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. As noted above, we do not sell or share your personal information.

We use reasonable technical and organizational measures — including encryption in transit, access controls, and scoped credentials — to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities where and as required by applicable law.

Our processors may store and process data in countries other than your own. Where we transfer personal information across borders, we rely on appropriate safeguards as required by applicable law.

The Service is not directed to children, and you must be at least 18 to use it (see the Terms of Service). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

The data controller responsible for your personal information is vfxmagia, an independent project operated by an individual in the United States (consistent with the governing law of our Terms of Service). We do not have an establishment in the EU or UK, so an EU/UK representative and a dedicated Data Protection Officer are not applicable; you can reach us with any data request at the address below.

Questions about this Privacy Policy or your data? Contact us at contact@vfxmagia.com.