Privacy Policy

Kureitaprovides tools for orchestrating AI video production scene by scene. We respect your privacy and are committed to handling your personal information responsibly and in accordance with applicable laws, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (“CCPA”).

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

We collect the following categories of information:

Information you provide

• Account data — name, email address, and authentication identifiers when you sign up or log in.
• Prompt & project data — text prompts, reference images or videos, scene configurations, and other content you upload or generate through the Services.
• Payment data — if you purchase a paid plan, our payment processor collects card details on our behalf. We do not store full card numbers.
• Communications — messages you send us via email, support forms, or feedback surveys.

Information collected automatically

• Device & log data — IP address, browser type, operating system, device identifiers, referring URLs, and timestamps.
• Usage data — pages viewed, features used, clicks, session duration, and crash reports.
• Cookies & similar technologies — as described in Section 5.

Information from third parties

• SSO providers — if you sign in using Google or a similar provider, we receive basic profile information you authorize them to share.
• Model providers — we receive generated outputs (and, where applicable, moderation signals) from AI model providers listed in Section 7.

We use personal information to:

• Provide, operate, and maintain the Services;
• Process prompts and render videos through our AI model pipeline;
• Authenticate users and secure accounts against unauthorized access;
• Process payments and send billing communications;
• Analyze how the Services are used so we can improve performance and build new features;
• Communicate with you about product updates, security notices, and — with your consent — marketing;
• Detect, prevent, and respond to fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use your prompts or generated content to train our own foundation models.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Contract — to provide the Services you request.
• Legitimate interests — to secure the Services, understand usage, and improve the product, where these interests are not overridden by your rights.
• Consent — for non-essential cookies, marketing emails, and any processing that requires consent. You may withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

We use cookies and similar technologies such as localStorage to remember your preferences, keep you signed in, and understand how the Services are used. Cookies fall into two broad categories:

• Essential — required for core functionality such as authentication, security, and remembering your cookie preferences. These do not require consent.
• Analytics — help us measure usage and improve the Services. We only load analytics after you click Accept on the cookie banner.

You can change your preferences at any time by clearing your browser storage for this site, which will re-display the cookie banner on your next visit. You can also block cookies at the browser level, though doing so may break parts of the Services.

We share personal information only in the circumstances below.

• Subprocessors — vendors we use to run the Services (hosting, authentication, analytics, AI model providers). See Section 7.
• Professional advisors — lawyers, auditors, and accountants bound by confidentiality obligations.
• Business transfers — if we are involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction.
• Legal requirements — to comply with applicable law or valid legal process, or to protect the rights, property, and safety of Kureita, our users, or the public.
• With your consent — in any other case for which we ask and receive your permission.

We rely on a small number of carefully chosen subprocessors to run the Services. Each is bound by written data-protection obligations and processes data only on our instructions. Our current subprocessor categories include:

• Cloud hosting & infrastructure;
• AI model providers (for image, video, audio, and language generation);
• Authentication & identity providers;
• Email delivery & customer support tooling;
• Payment processing;
• Product analytics & error monitoring.

A detailed subprocessor list is available on request by emailing us at the address in Section 14.

We retain personal information only as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Typical retention windows:

• Account data — for the life of your account and up to 90 days after deletion, except where longer retention is required by law.
• Generated content — for the life of the associated project unless you delete it earlier.
• Logs — typically 30–90 days, longer where needed for security investigations.
• Billing records — as required by applicable tax and accounting laws (usually 6–10 years).

Kureitaoperates globally, and personal information may be transferred to and processed in countries other than the one in which you live. Where required, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum.

Depending on where you live, you may have the following rights in relation to your personal information:

• Access a copy of the data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data (subject to legal exceptions);
• Restrict or object to certain processing;
• Port your data to another service;
• Withdraw consent at any time, without affecting the lawfulness of prior processing;
• Opt out of the “sale” or “sharing” of personal information (we do not sell personal information).

To exercise any of these rights, email us at hello@kureita.com. You also have the right to lodge a complaint with your local data protection authority.

We implement administrative, technical, and physical safeguards designed to protect personal information — including encryption in transit, access controls, logging, and regular security reviews. No system is perfectly secure, however, and we cannot guarantee the absolute security of your data.

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through the Services.

If you have any questions or concerns about this Policy or our privacy practices, please reach out at hello@kureita.com.