Privacy Policy

Motion Studio ('we', 'us', or 'our') is committed to protecting the privacy, confidentiality, and security of individuals who visit our website, register for an account, or utilize our AI-powered video generation services.

This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard your personal information in compliance with global data protection frameworks, including the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable privacy regulations.

We collect information in three primary ways: information you directly provide to us, information collected automatically through your interaction with the platform, and information received from authorized third-party integrations.

• Account & Identity Data: Your email address, encrypted password hash (salted using industry-standard hashing algorithms), display name, user avatar image, and language preference.
• Federated OAuth Data: If you authenticate using Google Sign-In, we receive your verified Google email address, account name, profile photo URL, and OAuth provider identifier.
• User Content & Project Assets: Product photographs, brand kit logos, brand colors, custom voice recordings (for TTS voice cloning/customization), storyboard scripts, prompts, shot specifications, and generated video/frame media.
• Payment & Transaction Identifiers: When you purchase credits or subscribe to plans via Creem (creem.io), Creem shares transactional metadata with us, including your Creem Customer ID, Subscription ID, Order ID, plan type, transaction timestamp, and fulfillment status. We do NOT store or process your complete credit card numbers, CVVs, or bank account credentials.
• Technical, Usage & Telemetry Data: IP address, device model, operating system, browser type and version, referral source, page interaction timestamps, render duration, error logs, and platform performance diagnostics.

Under the GDPR and international data protection standards, we process your personal information only when a valid lawful basis exists under Article 6 of the GDPR:

• Performance of a Contract (Art. 6(1)(b)): Processing is necessary to deliver the AI script writing, frame rendering, video compilation, and account management services requested by you.
• Legitimate Interests (Art. 6(1)(f)): Processing is necessary for our legitimate interests in safeguarding platform security, preventing bot abuse and fraudulent payments, monitoring system performance, and optimizing user workflows, provided such interests are not overridden by your fundamental rights.
• Compliance with Legal Obligations (Art. 6(1)(c)): Processing required to satisfy tax reporting, financial accounting, and legal audit regulations.
• Explicit Consent (Art. 6(1)(a)): Where required by law, we obtain your clear, affirmative consent (e.g., for optional marketing communications or non-essential cookies). You may withdraw consent at any time.

Motion Studio uses your information strictly for legitimate commercial and operational purposes, including:

• Synthesizing customized AI UGC video clips, reference frames, and multi-lingual voiceovers based on your creative instructions.
• Allocating, tracking, reserving, and consuming credit balances and recurring subscription periods in synchronization with Creem billing records.
• Maintaining account security, authenticating login sessions, and sending critical transactional notices (e.g., email verification codes, password resets, render failure notifications).
• Investigating, detecting, and preventing fraud, unauthorized system scraping, automated abuse, and violations of our Acceptable Use Policy.
• Providing technical customer support and resolving inquiries submitted via our in-app feedback modal or email.

We engage vetted third-party vendors and subprocessors to provide critical infrastructure and operational services. All subprocessors are bound by stringent data processing agreements (DPAs) and confidentiality obligations:

• Payment & Checkout Processor: Creem (creem.io) — processes payments, calculates sales tax/VAT, manages recurring billing, and facilitates subscription invoices.
• Cloud Storage & Hosting: Tier-1 enterprise cloud hosting and S3-compatible object storage providers — securely host uploaded product media, rendered videos, and application databases with encryption at rest.
• AI Inference Clusters: Specialized, enterprise-grade machine learning model providers and private GPU inference clusters used to process scripts, images, audio, and video synthesis. Customer media sent to inference pipelines is processed transiently and isolated from public training sets.
• Transactional Email Delivery: Secure email delivery services used exclusively to transmit verification codes and critical account notifications.

We retain your personal data and project media for as long as your account remains active or as needed to provide you with platform services.

When you choose to delete a project, storyboard, product, or your entire account via Studio Settings, our systems schedule the associated files and personal identifiers for permanent deletion from our active databases and cloud storage within thirty (30) days, except where retention is required by applicable law (e.g., financial audit records of Creem transactions).

Depending on your jurisdiction, you may exercise the following statutory rights regarding your personal information:

• Right to Access / Know: You have the right to request confirmation of whether we process your data and receive an itemized copy of your personal data.
• Right to Rectification: You have the right to correct inaccurate or incomplete profile details via Studio Settings.
• Right to Erasure ('Right to be Forgotten'): You may request that we permanently delete your personal information and uploaded media.
• Right to Data Portability: You may request an export of your account data and project files in a structured, machine-readable format.
• Right to Restriction & Objection: You may object to or request restriction of our processing of your personal data in certain circumstances.
• Non-Discrimination: We will never discriminate, charge different rates, or deny service quality based on your exercise of statutory privacy rights.

We use cookies and browser local storage strictly for functional and security purposes:

Essential Security Cookies: Session tokens and CSRF protection headers necessary to keep your login state authenticated and prevent cross-site scripting attacks.

Functional Preferences: Local storage keys used to remember your selected locale (e.g., en, zh-CN, es), interface theme, and UI workbench preferences.

We do not employ invasive third-party cross-site behavioral tracking cookies.

Motion Studio enforces industry-leading technical and organizational security controls to protect your data against accidental loss, unauthorized access, destruction, or alteration. Safeguards include:

• TLS 1.3 end-to-end encryption for all web traffic and API endpoints.
• AES-256 encryption at rest for all cloud-stored media and database backups.
• Zero-trust credential hashing (Argon2 / bcrypt) for user passwords.
• Automated rate limiting and DDoS mitigation across all public endpoints.
• Strict least-privilege role-based access control (RBAC) restricted to authorized engineers.

Motion Studio operates globally. If you access the platform from the European Economic Area (EEA), United Kingdom, or other regions with specific data protection laws, your information may be transferred to and processed in secure data centers located in the United States and other international cloud hubs.

Where cross-border transfers occur, we implement European Commission Standard Contractual Clauses (SCCs) and equivalent international adequacy safeguards to ensure an adequate level of data protection.

Our website and services are intended solely for commercial professionals and individuals eighteen (18) years of age or older. We do not knowingly solicit or collect personal information from children under 18. If we become aware that personal data of a minor has been submitted without verified parental consent, we will promptly delete the data.

If you have questions about this Privacy Policy, wish to exercise your statutory rights (such as data access or erasure), or have a privacy-related complaint, please contact our Data Protection Team:

Email: [email protected]

You may also submit a request directly through the in-app Contact & Feedback modal in your Studio Settings.