Privacy Policy
Effective July 16, 2026
This policy explains how Kinema handles information connected to accounts, workspaces, uploaded media, generated video projects, billing, emails, and support requests, and the rights you have over that information.
Who we are
Kinema is a video production service operated by Kinema Studios ("Kinema", "we", "us"), based in the United States at 306 W Redwood St, Ste 8076, Baltimore, MD 21201, USA. For users in the European Economic Area and the United Kingdom, Kinema Studios is the data controller of the personal data described in this policy. This policy explains what information we collect when you visit our website, create an account, build projects, upload media, receive our emails, or contact support, and how we use, share, retain, and protect that information. It applies to the Kinema website, the workspace app, the editor, and our emails.
Information we collect
We collect: (1) account information such as your name, email address, profile image, and the authentication identifiers issued by our sign-in provider; (2) workspace content such as project briefs, scripts, prompts, voiceovers, uploaded media (which may include your face or voice if you upload talking-head footage or recordings), reference notes, sourced and generated assets, edits, and rendered videos ("Content"); (3) brand profile information you choose to save, such as your channel name and public channel details, preset preferences, and any third-party API key you connect (stored encrypted and write-only, as described under Security); (4) billing information such as your plan, credit ledger, transaction history, and the limited payment metadata returned by our payment processor (we never see or store full card numbers); (5) usage and device data such as feature events, log data, IP address, browser type, and timestamps; (6) email engagement data such as whether a message was delivered, and your marketing preferences; and (7) support communications you send to us.
How we collect information
We collect information directly from you (when you register, buy a plan, create projects, upload media, adjust settings, or write to us), automatically (through server logs, cookies that keep you signed in, and privacy-focused product analytics), and from a small number of third parties: our sign-in provider (Clerk) passes us the name, email, and profile image from the identity you sign in with (for example, your Google account), and our payment processor (Stripe) passes us the payment status and metadata needed to grant credits and maintain your subscription.
How we use information
We use information to: provide and operate the service, including creating and managing projects, processing uploads, planning timelines, sourcing assets, generating voiceover and music, and rendering videos; authenticate you and secure your account; process payments, maintain the credit ledger, and prevent billing abuse; provide support and respond to requests; monitor reliability, debug issues, prevent fraud and abuse, and enforce our Terms of Service; understand aggregate product usage so we can improve features; send transactional emails about your account, such as waitlist and access notifications and billing notices; and, unless you opt out, send occasional product and marketing emails. We do not sell your personal information and we do not use your Content to train AI models.
Your content and AI processing
Producing a video requires processing your Content through third-party AI and media providers: for example, a planning model reads your brief and script to design the timeline, sourcing systems query stock and web media, a voice provider synthesizes narration, a music provider generates score, and rendering infrastructure assembles the final video. We send each provider only what it needs for its step, under agreements that restrict use of your data to providing the service to us. We do not use your Content to train our own or anyone else's AI models, and we do not permit our providers to use it for training where such controls are available. Your projects and media are stored in your account's isolated storage space and are not visible to other users.
Legal bases (GDPR / UK GDPR)
For users in the EEA and UK, we process personal data under the following legal bases: performance of a contract (to deliver the service you sign up for, including account management, project production, and billing); legitimate interests (to secure, improve, and protect the service and to send existing customers relevant product news, balanced against your rights); consent (for optional marketing where required and for any non-essential cookies, which you may withdraw at any time); and legal obligation (to meet accounting, tax, and compliance requirements).
Marketing and email preferences
We send two kinds of email. Transactional email covers your account and purchases: waitlist confirmation, access grants, billing and receipt notices, security notices, and similar messages you cannot opt out of while you hold an account, because they are part of operating it. Marketing email covers product news, tips, and offers; you can opt out at any time using the unsubscribe link in any marketing email (which works without signing in), from your workspace settings, or by writing to hello@kinema.cc. We honor opt-outs promptly and keep your address on a suppression list so you are not emailed again by mistake.
Who we share information with
We share personal data only with: service providers who process it on our behalf under data-processing agreements, listed below; professional advisers such as lawyers, auditors, and insurers where necessary; authorities, where we are legally required to respond to lawful requests, or where disclosure is necessary to protect the rights, safety, or property of Kinema, our users, or the public; and a successor entity in the event of a merger, acquisition, financing, or sale of assets, in which case this policy will continue to apply to your data until amended. We do not sell personal information and we do not share it with third parties for their own advertising.
Service providers and sub-processors
We rely on a limited set of vetted providers, bound by data-processing agreements, organized by category: authentication and identity (Clerk); payments and billing (Stripe); transactional and marketing email delivery; cloud hosting, infrastructure, and object storage for project media; AI and media production providers used to plan, source, voice, score, generate presenter avatars for, and render projects (including ElevenLabs for narration and HeyGen for avatars); public platform APIs used at your request (for example, the YouTube Data API when you link a channel to a brand profile — we fetch only the channel's public name, avatar, and subscriber count); stock media libraries queried during production; and privacy-focused, cookieless product analytics. Each provider receives only the data needed to perform its function, and providers in the AI and media category are restricted from using your data for anything other than delivering the service to us. Further information about our sub-processors is available on request at hello@kinema.cc.
Cookies and analytics
We use strictly necessary cookies to keep you signed in, to secure the service, and to remember your cookie choice itself; these cannot be switched off without breaking sign-in. Our product analytics (page-level usage measurement) are cookieless, aggregate, and never used to track you across other websites, and we do not use advertising cookies or third-party ad trackers. Where you are in a region that requires prior consent (for example the EEA, UK, or Switzerland), analytics stay off until you accept them in the cookie banner; elsewhere they run on an opt-out basis. You can change your choice at any time via the "Cookie preferences" link in the footer, and your decision is stored for up to 12 months in a first-party cookie.
Data retention
We retain account records and project Content while your account is active and for as long as needed to provide the service. If you delete a project, its content is removed from active systems promptly and from backups on a rolling schedule. If you close your account, we delete or anonymize your personal data within a commercially reasonable period, generally within 90 days, except where retention is required for legal, tax, billing, security, or dispute-resolution purposes (for example, transaction records are kept for the period tax law requires). Email suppression lists are kept indefinitely so opt-outs stick.
International data transfers
Kinema is based in the United States and our providers process data in the United States and other countries. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions where applicable, and supplementary measures where needed, so that your data receives an essentially equivalent level of protection.
Your rights (EEA and UK)
If you are in the EEA or UK, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased; restrict or object to processing, including an absolute right to object to direct marketing; receive a portable copy of data you provided; withdraw consent at any time where processing is based on consent; and not be subject to automated decision-making that produces legal or similarly significant effects, which we do not carry out. You also have the right to lodge a complaint with your local supervisory authority, such as the UK Information Commissioner's Office (ico.org.uk) or the data protection authority of your EU member state, although we would welcome the chance to address your concern first.
Your California rights (CCPA / CPRA)
If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to access it; to correct it; to delete it; to limit the use of sensitive personal information; and not to be discriminated against for exercising any of these rights. We do not sell personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CPRA, so there is nothing to opt out of; we also honor Global Privacy Control signals where applicable. We collected the categories of personal information described in "Information we collect" in the preceding 12 months, for the purposes described in "How we use information".
Other US state rights
Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, and Oregon) have similar rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising, sales, and significant profiling. We do not engage in targeted advertising, sales of personal data, or profiling with legal effects, and we extend the access, correction, and deletion rights described in this policy to all users regardless of location.
How to exercise your rights
To exercise any privacy right, email hello@kinema.cc from the address associated with your account, or use the in-product account controls where available. We will verify your identity before acting on a request and respond within the timeframe required by applicable law (generally within 30 days for GDPR requests and 45 days for CCPA requests, extendable where the law allows). You may use an authorized agent where the law permits, subject to verification. If we decline a request, we will explain why and how to appeal.
Security
We protect data with encryption in transit, access controls scoped to least privilege, per-user isolated project storage, signature verification on payment and authentication webhooks, and monitoring. We do not store full payment card details; those are handled by Stripe. Third-party API keys you connect to a brand profile are encrypted at rest, are never displayed to anyone (including our staff) after you save them, are never written to logs, and are decrypted only transiently in memory to make the API calls you request; you can replace or remove them at any time. No system is perfectly secure, but we work to reduce risk and to respond quickly to incidents. You are responsible for keeping your sign-in credentials confidential and for the security of any third-party accounts whose keys you choose to connect.
Breach notification
If a data breach affects your personal information, we will investigate, contain, and assess the impact, and notify affected users and the relevant supervisory authorities without undue delay and in accordance with applicable law, including the 72-hour notification timeline under the GDPR where it applies and applicable US state breach notification laws.
Children's data
Kinema is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact hello@kinema.cc and we will delete it.
Changes to this policy
We may update this policy as the product and our legal obligations evolve. When we make material changes, we will update the effective date below and notify you in the product or by email where appropriate. Continued use of Kinema after an update means you accept the revised policy.
Contact us
For privacy questions or to exercise your rights, contact us at hello@kinema.cc, or by mail at Kinema Studios, 306 W Redwood St, Ste 8076, Baltimore, MD 21201, USA. We will do our best to resolve your concern, and you retain the right to contact your local data protection authority at any time.