Privacy Policy

Effective date: [EFFECTIVE DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME], doing business as MANCUSO STUDIOS ("we", "us"), collects, uses and shares personal information when you use MakeFilms at makefilms.art (the "Service"). If you have questions, contact us at [PRIVACY EMAIL].

1. Information we collect

Account information. Your name, email address, password (stored only as a secure hash), account role, and the date you signed up and verified your email.

Google sign-in. If you sign in with Google, Google shares your name, email address, whether your email is verified, and a Google account identifier with us. We use these only to create and sign in to your account. We do not receive your Google password and do not access your Gmail, Drive, contacts or other Google data.

Content you provide. Prompts, scripts, project settings, reference images and other uploads, and the images, video and audio generated for you ("Inputs" and "Outputs").

Billing information. If you buy a plan or credits, Stripe collects your payment details. We receive and keep your Stripe customer ID, plan, subscription status, billing period dates, purchase amounts and history, and the last card details Stripe chooses to share (such as card brand). We never see or store your full card number.

Credits and usage. Your credit balance and a ledger of credits added, used and returned, and records of each generation (model used, status, cost and time).

Technical information. IP address, browser and device type, pages requested, timestamps, error logs, and security events such as sign-in attempts. These are kept in our server logs.

Marketing attribution. If you agree to marketing tracking, we store which campaign or link (for example UTM tags) brought you to the Service.

Messages to us. If you email us, we keep the message and our reply.

2. How we use information

• to provide the Service: run your account, send your Inputs to AI providers, store and show your Outputs, and track credits;
• to process payments, subscriptions and refunds;
• to send service emails, such as verification, password reset, receipts and important changes (you cannot opt out of these while you have an account);
• to keep the Service secure, prevent fraud and abuse, enforce our Terms, and moderate content;
• to fix problems and improve the Service;
• to send marketing only if you have agreed, with an unsubscribe option in every message;
• to comply with the law.

We do not use your Inputs or Outputs to train our own AI models, and we do not sell your personal information.

3. Who we share information with

We share personal information only with service providers that help us run the Service, under contracts or terms that limit their use of it, and as described below:

AI providers process your Inputs and Outputs under their own terms and policies, which may include keeping data for a limited time for safety and abuse monitoring. [OTHER AI PROVIDERS, IF ENABLED FOR CUSTOMERS.]

We may also share information: if required by law or valid legal process; to protect the rights, safety or property of our users, the public or us, including reporting illegal content; and with a buyer or successor if our business is sold or reorganized, in which case this policy continues to apply.

4. Cookies and similar technology

We use only the cookies and browser storage needed to run the Service. We do not use advertising cookies or third-party analytics trackers.

• Session cookie (cineflow_admin): keeps you signed in and protects forms against cross-site attacks. Secure, HTTP-only, deleted when you close your browser or sign out.
• Google sign-in cookies (mf_google_flow, and g_csrf_token set for Google One Tap): short-lived security cookies for completing Google sign-in.
• Browser storage: remembers interface choices, such as a plan you picked before signing up, so we can continue where you left off. It stays on your device.
• Google may set its own cookies when you use Google sign-in, and Stripe sets cookies on its checkout and billing pages, under their own policies.

5. How long we keep information

• Account information: while your account is open, and deleted within [30] days after you ask us to delete your account.
• Projects, uploads and Outputs: until you delete them or your account. Deleted files may remain in backups for up to [30] days.
• Billing and credit records: for as long as required for tax, accounting and legal purposes, usually [7] years, even after account deletion.
• Server and security logs: up to [90] days, unless needed to investigate abuse.

6. Your choices and deleting your account

You can see your account details and sign out in Settings. To get a copy of your information, correct it, or delete your account and its content, email [PRIVACY EMAIL] from your account's email address. We will verify the request and respond within 45 days. Deleting your account permanently removes your projects and unused credits; cancel any active subscription first.

7. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• delete personal information we hold about you, with some exceptions (for example, records we must keep for taxes);
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information. We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the last 12 months;
• limit the use of sensitive personal information. We use your account sign-in details only to provide the Service, as the law allows;
• not be discriminated against for using these rights.

In the last 12 months we collected these categories of personal information: identifiers (name, email, IP address, account IDs); commercial information (plans, purchases, credit history); internet activity (server logs and usage of the Service); and content you provide (Inputs and Outputs, which may include images of people). We collected them from you, from Google when you use Google sign-in, and from Stripe. We use and disclose them for the business purposes in sections 2 and 3.

To make a request, email [PRIVACY EMAIL]. You may use an authorized agent; we may ask for proof of the agent's authority and verify your identity. We respond within 45 days.

8. Security

We use reasonable safeguards, including encrypted connections (HTTPS), hashed passwords, secure cookies and restricted server access. No system is completely secure, so we cannot guarantee security.

9. Children

The Service is not for anyone under 18, and we do not knowingly collect personal information from children under 13. If you think a child has given us information, contact [PRIVACY EMAIL] and we will delete it.

10. International users

We are based in the United States, and our providers may process information in the US and other countries. By using the Service, you understand your information will be processed there.

11. Changes

We may update this policy. If a change is material, we will tell you by email or in the Service before it takes effect. The effective date at the top shows when it was last changed.

12. Contact

[LEGAL ENTITY NAME] (MANCUSO STUDIOS)
[MAILING ADDRESS]
[PRIVACY EMAIL]