Legal
Privacy policy
Last updated 27 August 2026
This policy explains what Musevate collects, why, and what you can do about it. It describes how the service actually works today.
The controller of your data is [company name], [registered address], contact [privacy@your-domain]. These details must be completed before commercial launch.
What we collect
- Account data — your email address and password hash, held by our authentication provider. We never see your password.
- Content you submit — prompts, uploaded images and the videos generated from them.
- Usage records — generations, credit transactions and the model and provider used, so billing is accurate and auditable.
- Invoice details — the name or company, address, tax or VAT number and billing email you enter, used solely to issue invoices. Card details are handled by Stripe and never reach our servers.
- Technical data — IP address and request metadata, used for security and rate limiting.
- Optional analytics — only if you consent. See the cookie policy.
Why we use it
- To provide the service you asked for — performance of a contract.
- To bill correctly and prevent abuse — legitimate interests.
- To keep the platform secure — legitimate interests.
- To measure and advertise — only on your consent.
Your content and AI providers
To generate a video we send your prompt, and your image when you upload one, to the AI provider that will render it — currently fal.ai. We send only what the generation needs; your email and account details are never included.
We do not use your prompts, images or videos to train models, and we do not publish your content. A clip only ever appears publicly if the rights holder explicitly chooses to feature it.
Who processes data for us
- Supabase — accounts, authentication and application database
- Cloudflare — DNS, security, delivery, and R2 storage of your files
- fal.ai — AI video generation
- Stripe — payment processing, once billing is enabled
- Google — tag management and analytics, only with your consent
Some of these operate outside the EEA. Transfers rely on the appropriate safeguards each provider offers, such as standard contractual clauses. Confirm each provider's transfer mechanism and add a data processing agreement before launch.
How long we keep it
- Account data — while your account exists.
- Generated videos and uploads — until you delete them or close your account.
- Credit and billing records — retained after account closure where accounting law requires it.
Your rights
You can request access, correction, deletion, restriction, portability of your data, and object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time without affecting what happened before.
Contact [privacy@your-domain]. You also have the right to complain to your local data protection authority.
Security
Traffic is encrypted in transit. Access to your generations, uploads and transactions is restricted to your own account at the database level, and stored files are private and served through short-lived signed links.
Children
The service is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes materially we will update the date above and, where the change affects consent, ask you again.