1. Who is responsible for your data

The data controller is Outerframe Studio, SAS with a share capital of €5,000, 91 route des Romains, 67200 Strasbourg, France, RCS Strasbourg 101 716 447. For any question about your data or to exercise your rights, write to contact@screenweaver.ai (subject: "Personal data").

This policy covers the website screenweaver.ai, the application app.screenweaver.ai and the API (the Service). It complements our Terms of Service and Sale.

2. The data we collect

Account: name or username, email address, sign-in method (Google, Apple or email and password, managed by Google Firebase; we never see your Google or Apple password), profile answers you choose to give (for example the type of creator you are), language.
Billing: plan, subscription status, invoices, Credit balance and movements. Card details are entered and stored by Stripe only; we never receive your full card number.
Projects and content (Inputs and Outputs): scripts, outlines, moodboards, prompts, reference images, videos, sounds, voices, and everything the Service generates for you.
Usage and technical data: generation logs (model, settings, cost, status, date), connection logs, IP address, browser and device, error reports.
Website: pages viewed and how you arrived, if you accept analytics cookies; messages you send through the chat or by email.

Your content may contain personal data about other people (for example photos of actors or names in a script). See section 9.

3. Why we use it, and on what legal basis

Providing the Service (account, projects, generations, Credits, collaboration, support): performance of the contract.
Billing and accounting: performance of the contract and legal obligation.
Security, fraud and abuse prevention (multiple accounts, chargebacks, attempts to get around filters, unlawful content): our legitimate interest in protecting the Service and its users, and legal obligations.
Service emails (receipts, security, changes to the Terms or prices): performance of the contract.
Product news and offers by email: your consent, or our legitimate interest for customers about similar services; you can unsubscribe in one click.
Website analytics and advertising measurement (Google Analytics, Meta Pixel): your consent, given through the cookie banner.
Improving the Service with aggregated statistics (for example which models fail most often): our legitimate interest.
Responding to authorities and defending our rights: legal obligation and legitimate interest.

We make no decision producing legal effects about you based solely on automated processing.

4. Your content and AI models

We do not use your Inputs or Outputs to train our own AI models, and we do not sell or license them to anyone for training.

When you launch a Generation, the necessary Inputs (prompt, references, settings) are sent to the AI model you selected, directly or through the Vercel AI Gateway, so that it can produce the Output. These providers act on our behalf or under their own business terms. We use their business APIs, whose terms generally exclude using submitted data to train their models; some keep data for a short period to detect abuse.

Your content is not reviewed by humans, except when needed for support you request, security, abuse prevention or a legal obligation.

Some providers add marks or metadata to Outputs identifying them as AI-generated.

5. Who receives your data

Only our team, on a need-to-know basis, and the following service providers, for the purposes above:

Hosting and infrastructure: Vercel Inc. (website, API, AI Gateway), Google Cloud and Firebase (sign-in, database, file storage).
AI model providers: Google, ByteDance (Seedream, Seedance), OpenAI, xAI, MiniMax, Kuaishou (Kling), and fal.ai, depending on the model you choose.
Payment: Stripe, which also acts as an independent controller for fraud prevention and its legal obligations.
Email: Brevo (service and marketing emails).
Support chat: Crisp (website chat).
Error monitoring: Sentry.
Analytics and advertising, only with your consent: Google (Google Analytics) and Meta (Meta Pixel).

We may also disclose data to the competent authorities, or to a person holding a court decision, when the law requires it.

Collaborators you invite to a project can see that project's content.

6. Transfers outside the European Union

Several of these providers are located, or process data, outside the European Union, in particular in the United States and in Asia. These transfers rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses, with additional measures where needed. You can ask us for a copy of the safeguards.

7. How long we keep it

Account and projects: as long as your account is open. When you ask us to delete your account, we erase your account data, projects and files within one month, except for what we must keep by law. Copies in backups and at providers disappear within their normal rotation cycles.
Inactive free accounts: they may be deleted after 24 months without use, after an email warning at least 30 days in advance.
Invoices and accounting records: 10 years (French Commercial Code).
Connection and security logs: 12 months.
Generation logs and Credit movements: as long as the account is open, then up to 3 years as evidence in case of dispute.
Prospects (emails, chat) without an account: 3 years from the last contact.
Cookies: 13 months at most. Your cookie choice is stored in your browser until you clear the site's data.

8. Your rights

You can access your data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, withdraw your consent at any time, and give instructions about what happens to your data after your death. Write to contact@screenweaver.ai; we answer within one month. We may ask for proof of identity if we have a reasonable doubt.

You can export your scripts and projects at any time from the application.

You can lodge a complaint with the CNIL (www.cnil.fr), 3 place de Fontenoy, 75007 Paris, or with the data protection authority of your country.

9. Personal data in your content

When your Inputs contain personal data about other people (faces, voices, names, photos), you decide what to upload and why: for that data, you act as the controller and we process it only on your instructions, to provide the Service. You must have a legal basis, obtain consent where needed, in particular for the image and voice of real people, and inform the persons concerned. Do not upload sensitive data about other people (health, sexual orientation, political or religious opinions, etc.).

10. Cookies and trackers

Necessary: sign-in, security, storage of your cookie choice, and the support chat (Crisp). They do not require consent.
Analytics (Google Analytics): loaded in a mode that sets no cookie until you accept; with your consent, measures how the site is used.
Advertising (Meta Pixel): loaded only after you accept, to measure our campaigns.

You can change your choice at any time by clearing the site's data in your browser; the banner then appears again.

11. Security

We use encryption in transit, access control on projects (only the owner and invited collaborators can open them), restricted internal access, and providers that apply recognized security standards. No system is perfectly secure: in the event of a data breach that presents a risk to you, we notify the CNIL and, where required, you, under the conditions of the GDPR.

12. Minors

The Service is reserved for people aged 18 and over. We do not knowingly collect data about minors. If you believe a minor has created an account, tell us and we will delete it.

13. Changes to this policy

We may update this policy. We inform users with an account by email or in the Service before any important change applies. The date at the top of the page shows the latest version. In case of discrepancy between the language versions, the French version prevails.

Privacy Policy

The essentials, in plain words