Privacy policy

1. Who is responsible

The controller of your personal data is Olga Fedoseeva, tax ID (NIF) Z3674297Y, Carrer de Fuencaliente 9, 46023 València, Spain, email hello@atriskstudio.space, phone +34 675 192 680. Write to that email about anything in this policy.

2. What we collect

• Account: your email address and, if you give them, your name or channel name, your handle, where you post and the formats you picked.
• Your content: the ideas and twists you type, the scripts written for them, and the films, covers, titles and captions we make.
• Purchases: which pack, the amount and currency, the payment status and the checkout reference. We never receive your full card number.
• Technical data: your IP address (held in memory for up to a day to stop abuse of the sign-in form), error logs, and the cookies listed in the Cookie policy.
• Waitlist (only while sign-ups are closed): your email, where you post, the plan you're interested in and your idea if you add one.
• Messages you send us.

3. Why we use it and on what legal basis

• To run your account, make your films and handle your purchases: performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the studio safe and working (rate limits, abuse and fraud prevention, fixing errors): our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
• To keep accounting and tax records and to answer lawful requests from authorities: legal obligation (Art. 6(1)(c) GDPR).
• To email you about the launch if you joined the waitlist: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

You need to give an email address to have an account; everything else is optional.

We only send emails the service needs (sign-in codes and essential notices): no marketing unless you ask for it, no ads and no profiling. No decision with legal or similar effects is made about you by a machine alone; the automatic quality check only decides whether a take is re-shot.

4. Who processes it for us

Each provider gets only what it needs, under data processing terms. The AI providers get the idea and the script, never your email or name.

• Hostinger (VPS in Germany), which runs the server that holds your account and films.
• OpenAI, which writes scripts and idea suggestions from what you type. Through its API it does not use this data to train its models; it may keep it for up to 30 days to watch for abuse.
• fal.ai (Features & Labels, Inc., USA), which runs the video model (Alibaba's Wan) on its platform or through Alibaba Cloud. It gets the script, keeps the request for up to 30 days and deletes the finished file from its storage within a day.
• Google (Gmail), which delivers our sign-in emails. It gets your email address and the message.
• Link, Stripe's merchant of record for card payments. On its checkout page you give your payment details, email, name and billing address to Link, which uses them as an independent controller under its own privacy policy (link.com/privacy) for the payment, tax, receipts and fraud prevention. It tells us the payment status, the pack, the amount and your email.

5. Transfers outside the EU

Some of these providers process data outside the European Economic Area, mainly in the United States, and Alibaba Cloud may run the Wan model in Asia. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses (fal.ai's data processing addendum includes them). Write to us for a copy of the safeguards.

6. How long we keep it

• Account, ideas and films: while your account exists. When you delete a film or your account, it is removed from the server at once and from our backups within 14 days, as they rotate.
• Sign-in codes and links: valid for 15 minutes, deleted within a day.
• Sign-in sessions: up to 7 days, or 30 days if you tick "Keep me signed in"; deleted when they expire or when you sign out.
• IP addresses for rate limits: in memory only, for up to 24 hours.
• Error logs: up to 30 days.
• Purchases: the record in your account is deleted with the account. Link (Stripe) and our accounting keep payment records for as long as tax law requires (generally 4 to 6 years in Spain).
• Waitlist: until we email you about the launch, or until you ask us to remove you.
• Messages to us: as long as we need to deal with them, and then up to 2 years in case the matter comes back.

7. Your rights

You can ask us to access, correct, delete or export your data, to restrict its use or to stop using it, and you can withdraw a consent at any time. Write to hello@atriskstudio.space; we answer within one month. You can delete your account yourself in Settings.

You can also complain to the Spanish data protection authority (Agencia Española de Protección de Datos, www.aepd.es) or to the authority where you live.

8. Security

The site works only over an encrypted connection (https). Sign-in codes, links and session tokens are stored only as one-way hashes, and the server and its backups are reachable only by us.

9. Cookies

We use only cookies the studio needs to work, so there is nothing to accept. The full list is in the Cookie policy.

10. Age

The studio is for people aged 18 and over. We don't knowingly collect data from children.

11. Changes

If we change this policy in a way that matters, we tell you by email before the change takes effect.