Privacy Policy

Datenschutzerklärung (Information regarding data protection)

1. An overview of data protection

General information

The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit this website. The term "personal data" comprises all data that can be used to personally identify you.

The responsible party in a nutshell

The operators of this website and its pages take the protection of your personal data very seriously. We treat your personal data as confidential and in compliance with the statutory data protection regulations and this Data Protection Declaration.

Your rights as a data subject

As a data subject, you have the following rights under the GDPR:

  • Right to access: You have the right to request information about your stored personal data, its origin and recipients and the purpose of the data processing (Art. 15 GDPR).
  • Right to rectification: You have the right to request the correction or completion of your stored data (Art. 16 GDPR).
  • Right to erasure ("right to be forgotten"): You have the right to request the deletion of your personal data (Art. 17 GDPR).
  • Right to restriction of processing: You have the right to request the restriction of the processing (Art. 18 GDPR).
  • Right to data portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format (Art. 20 GDPR).
  • Right to object: You have the right to object to the processing of your personal data at any time where processing is based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

You can exercise these rights at any time by emailing hey@harshil.dev. We respond within one month. You also have the right to lodge a complaint with your local data protection authority (in Berlin: Berlin Commissioner for Data Protection and Freedom of Information).

2. Controller

The data processing controller on this website is:

Harshil Agrawal
Helene-Jacobs-Str.
14199 Berlin
Germany

Email: hey@harshil.dev

3. Hosting, content delivery, and payment processing

Cloudflare (hosting, CDN, storage)

Our website and application are hosted on Cloudflare, provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides web hosting, a content delivery network (CDN), DDoS protection, object storage (R2) for your video files and assets, and database services (D1, Durable Objects). Technically, the information transfer between your browser and our website is routed via Cloudflare's network. Data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in secure, reliable hosting). Transfers to the USA are safeguarded by Cloudflare's certification under the EU-U.S. Data Privacy Framework.

Dodo Payments (payment processing, Merchant of Record)

Payments are processed by Dodo Payments (Gordius Tech Private Limited), which acts as Merchant of Record. Dodo Payments handles the payment transaction, issues invoices, and manages your subscription. When you subscribe to a paid plan, Dodo Payments processes your payment data (e.g., credit card details, billing address). We only receive notice of the transaction, your plan, and a customer identifier. Dodo Payments also maintains your customer record (email, metadata) to manage billing and credits. Processing is based on Art. 6(1)(b) GDPR (performance of a contract). You can manage your payment details and subscription via the customer portal accessible from your account settings.

Sentry (error tracking)

We use Sentry, provided by Functional Software, Inc., 548 Market St., San Francisco, CA 94107, USA, to detect and diagnose technical errors. When an error occurs, technical information (browser type, operating system, error message, URL, and a pseudonymous user ID) is transmitted. We deliberately do not send names or email addresses to Sentry. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in stable, error-free software). Transfers to the USA are safeguarded by Sentry's certification under the EU-U.S. Data Privacy Framework.

4. Data collection on this website

Server log files

The provider of this website and its pages automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:

  • The type and version of browser used
  • The used operating system
  • Referrer URL
  • The time of the server inquiry
  • The IP address

This data is not merged with other data sources. This data is recorded on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error free presentation and the optimization of the operator's website.

Cookies

Our website uses technically necessary cookies only: a session cookie that keeps you logged in after sign-up or login. These cookies are required to provide the service you requested and are set on the basis of § 25 (2) TDDDG and Art. 6(1)(b) GDPR. No analytics or advertising cookies are used. Because only strictly necessary cookies are set, no cookie consent banner is displayed.

Registration and sign-in with Google

You can register and sign in using your Google account (Google OAuth). When you do so, Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) transmits to us the information you have agreed to share — typically your Google account ID, name, and email address. We use this data to create and manage your account. The processing is based on Art. 6(1)(b) GDPR (performance of a contract). Google itself processes data during the sign-in process; this may include your IP address. Details of Google's own processing can be found in Google's privacy policy (https://policies.google.com/privacy).

During registration, we ask you to accept these terms and this privacy policy. The record of your acceptance (timestamp) is stored as proof of consent under Art. 6(1)(a) GDPR.

5. AI model providers (video generation)

PromptMotion is an AI-assisted video composition tool. To generate videos, the text you type into the chat (your prompts), your uploaded assets, and the composition files created by the AI are transmitted to external AI model providers for processing. The model used depends on the model you select in the application:

  • Google (Gemini models) — Google Ireland Ltd. / Google LLC, USA. Your prompts and project content are processed to generate video compositions. Transfers outside the EEA are safeguarded by Google's data protection terms and the EU-U.S. Data Privacy Framework where applicable.
  • OpenAI (GPT models) — OpenAI OpCo, LLC, 548 Market St., San Francisco, CA 94107, USA. Your prompts and project content are processed to generate video compositions. Transfers to the USA are safeguarded by the EU-U.S. Data Privacy Framework.
  • Z.ai (GLM models) — processed via Cloudflare Workers AI. Z.ai processes your prompts and project content to generate video compositions.

Requests to OpenAI and Google are routed through Cloudflare AI Gateway, which logs request metadata (model, token counts, request ID) for billing purposes. Processing of your content by these providers is necessary to provide the service you requested (Art. 6(1)(b) GDPR). Your prompts and project content are retained only as long as needed to provide the service (see Section 7). Please do not enter confidential or sensitive personal information into prompts, as the AI providers may retain data under their own policies.

6. User content and project data

We store the projects you create (composition files, chat history, uploaded assets such as images and audio) so you can access and edit them. Rendered videos are stored in Cloudflare R2 storage. This data is processed for the performance of the contract (Art. 6(1)(b) GDPR). You retain all rights to the content you create. You can delete projects at any time within the application.

7. Data retention

Account data (name, email, auth records) is retained for the duration of your use of the service and deleted when you delete your account, unless we are legally required to retain it longer (e.g., commercial and tax law retention obligations). When you delete your account, your login becomes inaccessible immediately; your projects, chat histories, uploaded assets, and rendered videos are permanently deleted within 14 days of the deletion request (a short grace period that allows recovery in case of accidental deletion — contact us within this window if you wish to restore your data). Billing data (transaction records) is retained for the statutory retention periods. Server log files are deleted after 14 days.