Privacy Policy

Artiroom (“we,” “us,” or “our”) is an AI creative studio operated from Colombia and available at artiroom.com. We act as the data controller for the personal data described in this policy. For any privacy question or request, contact privacy@artiroom.com.

• Account data — your email address and authentication identifiers, managed by our identity provider, Clerk.
• Content you provide — the prompts, text, photos, and reference images you upload, and the images, animations, and videos you generate. Reference clips and audio you upload for video generation (which may contain faces or voices) are stored in Cloudflare R2 under an unguessable link until you delete them, and are transmitted to our video provider only for the generations you request. Images you upload into a scene’s “What should happen?” box are stored the same way; removing one from the box deletes it, and deleting your account deletes all of them. Only the images you tag there are sent with that scene’s video: we keep one copy of each tagged image for our video provider to fetch, replace or delete it the next time you make that scene’s video, and delete it with your account. Our video provider’s own retention is described below.
• Voice samples — when you give a story character a voice recording (only after you confirm it is your voice or that you have the speaker’s permission), we keep a short, loudness-matched excerpt of it with that character, record when you confirmed, and send it to our video provider with that character’s clips so the voice stays the same. If you don’t upload one, we save a few seconds of the character’s generated voice from the first clip where it speaks alone (never from a clip with audio or video you attached) for the same purpose. Google’s Gemini API checks each recording (one voice, no music) and compares it with the voice in the clips made with it, to measure that voices stay consistent. You can remove a voice sample in the cast panel at any time: removing it deletes its excerpts (a file you uploaded stays in your reference library until you delete it there); deleting the uploaded file, the project or your account deletes the sample and its excerpts.
• Usage and credit records — the actions you take, credits consumed and refunded, plan and subscription status.
• Payment metadata — order, subscription, and billing details from Polar, our merchant of record (such as your name, email address, billing country and any other address details or tax ID you enter at checkout, the plan, amounts, status, renewal dates, and any cancellation reason you give). We do not receive or store full card numbers.
• Diagnostics and feedback — error reports, performance data, sampled session replays (see Sentry in Section 4), and any feedback you send us.

• to provide, operate, and secure the service;
• to generate your outputs by transmitting your inputs to the AI providers that power each feature, and to run automated quality and safety checks on your generations;
• to process payments, credits, and subscriptions;
• to diagnose and fix problems and to prevent abuse; and
• to communicate with you about your account, transactions, and support requests.

We do not use your prompts, uploads, or generated content to train or fine-tune AI models or to build datasets. Without your written permission, we do not use them for internal testing beyond the automated checks above or in our marketing. Authorized staff access your content only as needed to deliver and support the service, for example to check that generations and notifications are delivered, provide support you request, troubleshoot problems, investigate abuse, or comply with the law. We may compile aggregated statistics about how the service performs (such as generation volumes, failure rates, and quality-check pass rates) that do not include your content, and use them to run, tune, and plan the service, including calibrating our automated checks.

Our legal bases include performance of our contract with you, your consent (where required), our legitimate interests in operating and securing the service, and compliance with legal obligations.

We rely on the following service providers to operate Artiroom. Each receives only the data needed for its function. Most act as our processors and use the data only on our behalf. Polar, our merchant of record, is an independent controller of your payment data, and each AI provider’s own terms apply as described below:

• Clerk — authentication and account management (email, login identifiers, sessions).
• Supabase — primary database storing your profile, projects, and usage records.
• Cloudflare — R2 object storage for generated images, videos, and uploaded reference media, and a Worker that copies finished videos into it from our video providers.
• Cloudflare Turnstile — bot protection on the feedback form for signed-out visitors.
• Vercel — hosting for the Artiroom website, app, and API, which processes requests (including their content and your IP address) as they pass through.
• Google (Gemini API) — image generation and editing, story and scene planning, Brand DNA guideline parsing, automated checks that a generated image matches your reference, and automated checks of voice recordings you give a character and of generated clips (frames, and the sound of clips with dialogue: one speaker, no music, the same voice, the spoken words). We use Google’s paid Gemini API, under which Google does not use prompts or responses to improve its products and keeps them for a limited period only to detect policy violations and meet legal obligations.
• Atlas Cloud (Atlas Cloud AI Inc., New York, USA) — runs Seedance 2.0 video generation. It receives your prompt, the scene image, images of your project’s character (so the clip keeps the same face and hair), any reference images, video, or audio you attach, and the voice samples of the characters in the clip, and returns the clip, which we copy to our own storage. Atlas forwards requests to ByteDance’s BytePlus ModelArk service, whose data centers may be in Malaysia, Indonesia, or the EU/EEA. Atlas states that it keeps image and video files for 14 days and does not use customer content to train or develop the models it hosts. Atlas also saves each file we send to an asset library in our Atlas account; we delete them from that library within a few hours of each render, and Atlas’s 14-day retention still applies to its own copies. BytePlus states that it does not use customer data for model training without its customer’s authorization, and that it keeps inputs and outputs flagged by its safety filter for 180 days in Malaysia.
• fal.ai (Features & Labels, Inc., USA) — upscales clips generated on paid plans to 1080p using ByteDance’s video upscaler, accessed through fal. It receives only the generated clip, never your uploads; we copy the result to our own storage. fal keeps request records for up to 30 days by default, and the upscaled file is set to expire on fal after 24 hours.
• Polar (Polar Software, Inc., USA) — merchant of record for purchases and subscriptions: processes payments, invoices and receipts, and sales tax or VAT, as an independent controller of your payment data under its own privacy policy. Polar collects your payment details directly; we receive the order, subscription, and billing details described in Section 2, never your full card number.
• Firecrawl — extracts listing photos from property URLs you submit to the real-estate tools.
• Resend — delivery of transactional and feedback emails. We keep an internal copy of some notification emails, which can include a preview image of your generation, to check that they are delivered correctly.
• Sentry — error monitoring and performance diagnostics, with tokens, authorization headers, and cookies redacted from error reports. Error reports can include details of the request that failed, which may include its content, such as a prompt. Sentry also records session replays on about 10% of visits and on visits where an error occurs (including up to 60 seconds before the error and the rest of that visit): a reproduction of the page as you see it. Replays can include on-screen text such as scripts, project names, and prompts, including prompts as you type them (our prompt editors are rich-text editors rather than standard form fields, so they are not masked); links to the images and videos shown on the page; your clicks and scrolls; and basic request details (address, method, status, and size). Values typed into standard form fields, such as email and password boxes, are masked, and replays do not record the contents of requests and responses. We use replays only to diagnose problems.
• Google Analytics & Ahrefs Web Analytics — aggregate website usage and traffic measurement.

We may also disclose data when required by law, to enforce our terms, or in connection with a business transfer.

We use a small number of cookies and similar technologies for authentication, analytics (Google Analytics and Ahrefs), and error diagnostics (Sentry, including sampled session replays described in Section 4). You can control cookies through your browser settings; disabling some cookies may affect functionality such as staying signed in.

We retain your data for as long as your account is active and as needed to provide the service; our providers keep the data they receive for the periods described in Section 4. You can delete your account from your settings or request deletion by emailing privacy@artiroom.com. We will delete or anonymize your personal data following a verified request, except where we must retain certain records for legal, accounting, or fraud-prevention purposes.

We use industry-standard measures — including encryption in transit, access controls, and scoped service credentials — to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Artiroom is operated from Colombia and uses providers located in various countries, including the United States and the European Union; video generation may also be processed in BytePlus data centers in Malaysia or Indonesia. When we transfer personal data across borders, we rely on appropriate safeguards such as standard contractual clauses and the providers’ own compliance frameworks.

European Union / EEA & UK (GDPR)

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority.

California (CCPA/CPRA)

You have the right to know what personal information we collect, to request its deletion or correction, and to opt out of the “sale” or sharing of personal information. We do not sell or share your personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

Colombia (Ley 1581 — Habeas Data)

You have the right to know, update, and rectify your personal data, to request proof of the authorization granted, to be informed of how your data is used, to revoke authorization, and to access your data free of charge.

To exercise any of these rights, contact privacy@artiroom.com. We will respond within the timeframes required by applicable law.

Artiroom is not directed to children. You must be at least 18 years old to use the service, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us so we can remove it.

We may update this policy from time to time; material changes will be reflected by updating the “Last updated” date above. Questions or requests can be sent to privacy@artiroom.com.