Privacy policy

1. Controller

Biedrība "Eurika", reg. no. 40008113485, VAT no. LV40008113485, Ēvalda Valtera iela 5-1, Rīga, LV-1021, Latvija, [support e-mail, set at launch]

2. What we store and why

• Account: e-mail address, a hash of your password (never the password itself), language, log-in times. Legal basis: the contract (Art. 6(1)(b) GDPR).
• Your files: the song (re-encoded on upload), pictures (re-encoded, so photo metadata such as GPS is removed), your optional description of the video, and the finished videos. Basis: the contract.
• Payments: what you bought, amounts, dates and the Stripe customer id. Card data goes only to Stripe; we never see card numbers. Basis: the contract (Art. 6(1)(b) GDPR) and our accounting duties (Art. 6(1)(c) GDPR).
• API: a hash of each API key, its name, the time and IP address of its last use, and callback addresses you give. Basis: the contract.
• Security: short-lived counters per IP address and account to stop abuse, and server logs. Basis: our legitimate interest in a safe service (Art. 6(1)(f) GDPR).
• Sign-in with Google or Facebook (optional): the e-mail address and the account id that the service gives us. We ask Google only for "openid" and "email" and Facebook only for "email". The sign-in buttons load nothing from Google or Facebook before you press them. Basis: the contract.
• Free video, one per person: so that the same person cannot take it twice, we keep one-way codes (keyed hashes) of your e-mail address, of your Google or Facebook account id, of a device cookie set when you sign up, of your browser type and language, and of your IP address range. For this purpose the IP range is kept only as such a code. Sign-ups that look like a repeat are held for a person to check, and you may ask for a person to review the decision. Basis: our legitimate interest in preventing abuse of a free offer (Art. 6(1)(f) GDPR).
• News and bonuses by e-mail (optional): only if you tick the box and confirm with the link we send. We store when and where you agreed, the version of the wording, and when you stopped. Every news e-mail has a link to stop them with one click, and you can switch them off on your account page. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

3. How your files are processed

Your song is transcribed and analysed, and your pictures are checked by automated classifiers (unsafe content, faces) on our own servers in the EU. Your description is read only by a scene-planning model on our own server, which may only choose scene details from a fixed list. Nothing you upload is used to train AI models, and nothing is sent to outside AI services.

To keep the service safe and lawful, uploads and finished videos are checked automatically: content classifiers, face detection that does not recognise who a person is, reading of visible text, and an audio fingerprint that is compared only with songs we refused before. The results and reasons are stored with the video and seen only by our administrators for 30 days after the video is finished or stopped; fingerprints of refused songs (no audio, no lyrics) are kept as long as needed to stop repeat uploads. A person decides on held videos, and you may ask for a person to review any automatic decision. Basis: our legal duties and our legitimate interest in a safe service (Art. 6(1)(c) and (f) GDPR).

If you report a video, we keep the report and your optional e-mail address for 180 days to handle it.

4. Who else receives data

• Stripe Payments Europe Ltd. (Ireland): payments, invoices, the customer portal.
• Our hosting provider for the web server in the EU.
• YouTube (Google): only if you press play on an example video; before that nothing loads from YouTube.
• Google Ireland Ltd. or Meta Platforms Ireland Ltd. (Facebook): only if you choose to sign in with them. They handle the sign-in under their own privacy policies.

5. How long we keep data

Unfinished projects: 7 days. The song and pictures: 2 days after the video is finished or fails. Finished videos: 30 days. Account data: until you delete the account. Payment records: as long as accounting law requires (in Latvia 5 years).

Free video codes: 12 months, even after the account is deleted. Notes about blocked sign-ups: 180 days. The record of your news consent and of stopping it: as long as the account exists, as proof of consent.

6. Cookies

We use only cookies that the site needs to work: a session cookie to keep you logged in, a cookie that remembers your language, and, when you sign up or sign in, a device cookie (kept 13 months) that shows us whether a free video was already given on this device. No analytics or advertising cookies are set.

7. Your rights

You may ask for access to your data and for its correction, deletion or restriction, ask for a copy in a portable format, and object to processing based on legitimate interest. Write to [support e-mail, set at launch]. You may also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv) or the data protection authority of your country.