AI FILMS Studio is run by AI FILMS LLC, a company based in Wyoming, USA. This policy explains in plain language what personal data we collect about you, why we collect it, who we share it with, how long we keep it, how we protect it and what rights you have. We collect account details, billing details, information about how you use the service and the creative content you make (such as prompts, uploads and results) so that we can run our subscription and influencer platform. We only use your data when we have a lawful reason: because we need it to provide the service you asked for (contract), because we have a genuine business reason that does not override your rights (legitimate interest) or because you agreed (consent).
We serve customers all over the world. Section 2 lists the laws that apply to us and Section 11 lists your rights by region. If you live in the European Union you have the rights given by the GDPR. If you live in the United States you have the rights listed in Section 11. Your card details are handled only by Stripe, a payment company that is certified at the highest level (Level 1) of the Payment Card Industry Data Security Standard (PCI DSS). Our service is not directed to children under 13. All the data we store is kept on servers in the United States of America. You can cancel a subscription yourself at any time in your account under Profile, Subscription, Cancel Subscription.
1. Who We Are
• Controller: AI FILMS LLC (Wyoming, USA). The controller is the company that decides why and how your personal data is used.
Email: help@studio.aifilms.ai
2. Scope
This policy applies to:
Our public website and the Studio web-app
All subscription tiers and influencer accounts
Marketing emails, referral links and support tickets
Not covered: other websites that we only link to. Those websites have their own privacy policies.
Laws that apply to us as a U.S. company: AI FILMS LLC is a Wyoming company. Our Terms and Conditions are governed by Wyoming and United States federal law. The following laws apply to us whichever country a customer lives in:
• United States federal law. Section 5 of the Federal Trade Commission Act (15 U.S.C. 45) forbids unfair or deceptive practices, which includes not doing what a privacy policy promises. The Children's Online Privacy Protection Act (COPPA, 15 U.S.C. 6501 to 6506, with its rule at 16 CFR Part 312) protects children under 13. The CAN-SPAM Act (15 U.S.C. 7701 to 7713) sets the rules for commercial email.
• Wyoming law. Wyoming does not have a general consumer privacy law at the date of this policy. Two Wyoming laws apply to us: the data breach notification law (Wyoming Statutes 40-12-501 to 40-12-511) and the Wyoming Consumer Protection Act (Wyoming Statutes 40-12-101 to 40-12-114), which forbids deceptive trade practices.
• Other U.S. state privacy laws. These include the California Consumer Privacy Act as amended by the California Privacy Rights Act (California Civil Code 1798.100 and following) and the privacy acts of Colorado (Colorado Revised Statutes 6-1-1301 and following), Virginia (Virginia Code 59.1-575 and following) and Connecticut (Connecticut General Statutes 42-515 and following). Some of these laws apply only to businesses above a certain size. We give the rights in Section 11 to all U.S. users.
Laws of other countries. We serve customers worldwide. A U.S. company cannot be bound by every country's law, but some countries apply their privacy law to companies abroad that offer services to people in that country. Where the text of the law itself says so, we list it here. Where such a law applies to us we respect it in the way Section 10 and Section 11 describe:
• European Union: the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Article 3(2) applies it to a company outside the EU that offers goods or services to people in the EU.
• Switzerland: the Federal Act on Data Protection (FADP, SR 235.1). Article 3 applies it to circumstances that have an effect in Switzerland even if they started abroad.
• Japan: the Act on the Protection of Personal Information (APPI). Article 171 applies it to a business outside Japan that handles personal information of a person in Japan in relation to supplying a good or service to that person.
• Brazil: the General Data Protection Law (Lei 13.709/2018, LGPD). Article 3 applies it wherever the company is located when the processing aims to offer or supply goods or services to people in Brazil.
• India: the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). Section 3(b) applies it outside India to processing connected with offering goods or services to people in India. Its main provisions are being brought into force in phases.
• China: the Personal Information Protection Law. Article 3 applies it outside China when the purpose is to provide products or services to people in China.
• Other countries: for example Canada (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5), Australia (Privacy Act 1988, section 5B) and South Korea (Personal Information Protection Act) can also reach companies abroad in some cases.
3. Definitions
• Personal Data: any information that identifies you or can be linked to you (for example your name or your email address).
• Processing: anything we do with personal data (collect, store, use, share or delete it).
• Controller: the company that decides why and how personal data is used. For this service it is AI FILMS LLC.
• User: a person who has an account.
• Visitor: a person who looks at our website without an account.
These terms follow the definitions in Article 4 of the GDPR.
4. What Data We Collect
| Category | Examples | Source |
|---|
| Account | name, email, username and a password hash (a scrambled one-way version of your password: we cannot read your actual password) | you |
| Payment | the last 4 digits of your card, the card type (for example Visa) and your Stripe customer ID (a reference number that Stripe gives us). Your full card number is handled only by Stripe. | Stripe (sent to us automatically after a payment) |
| Usage / Telemetry | your IP address, information about your device, what you click and a log of the generations you run | collected automatically when you use the service |
| AI Creations | the text prompts you type, the files you upload and the images, videos and audio that are created for you | you |
| Cookies / Pixels | a session ID (keeps you signed in) and an analytics ID (lets our analytics tools recognise the same browser) | your browser |
We do not intentionally collect special-category data (sensitive data such as health, religion or biometric data, see Article 9 of the GDPR). If you upload it you do so voluntarily.
5. Legal Bases & Purposes
The GDPR (Article 6) says we need a lawful reason, called a legal basis, for every use of your data. This table shows the reason for each purpose.
| Purpose | Legal Basis (GDPR Article 6) | What this means |
|---|
| Provide and bill the service | Contract (Article 6(1)(b)) | We need your data to create your account and process subscriptions. |
| Fraud and security logging | Legitimate interest (Article 6(1)(f)) | We protect users and the platform. |
| Marketing newsletters | Consent (Article 6(1)(a)) | You opt in and you can unsubscribe at any time. |
| Analytics and product improvement | Legitimate interest (Article 6(1)(f)) | We use combined statistics to improve and develop features. |
6. Model-Specific Disclosures
Midjourney Prompt Parameters – Prompts that contain disallowed flags (listed in the generator) are rejected. A generation that fails for that reason is not refunded.
7. Cookies & Similar Tech
Cookies are small files that a website stores in your browser. We use functional cookies (needed for the site to work, for example to keep you signed in) and analytics cookies (Google Analytics and PostHog) that show us how the site is used. All visitors see a consent banner that blocks these analytics tools in the browser until opt-in.
You can also disable cookies in your browser settings. Some features may stop working if you do.
8. Marketing
We may send product updates and referral promotions, for example as announcements inside the app or by email. Opt out with the unsubscribe link in any product update email. We do not sell personal data to third-party advertisers.
The U.S. CAN-SPAM Act (15 U.S.C. 7701 to 7713) requires a commercial email to offer a way to opt out and requires the sender to honor an opt-out request within 10 business days.
9. Sharing & Processors
We share personal data only with the companies that help us run the service. They are called processors:
• Stripe – processes card payments. Stripe is certified at Level 1 of the Payment Card Industry Data Security Standard (PCI DSS), the highest level, which is checked every year by an independent assessor.
• Cloud hosting and storage providers – run our servers and store your files. Their servers are located in the United States of America.
• AI inference providers – third-party AI model providers that generate your outputs from your prompts and uploads. These providers change from time to time.
• Analytics – Google Analytics (US servers only) and PostHog Analytics (US servers only) show us how the site is used.
Each vendor works under its own written terms and receives only data essential to its function.
10. International Transfers
All data we store is saved on servers located in the United States of America and nowhere else. This applies to every user wherever they use the service from. Our analytics tools also use U.S. servers only.
Data you send to us yourself. When you create an account or use the service from outside the United States you send your data directly to us. The European Data Protection Board takes the view that data a person sends directly and on their own initiative to a company outside the EU is not a "transfer" under Chapter V of the GDPR (Guidelines 05/2021, version 2.0 of 24 February 2023). The GDPR can still apply to us in that case under Article 3(2), as Section 2 explains.
Data we pass on to our processors. When we pass personal data on to the processors in Section 9 each processor handles it under its own written terms, and we are bound by those terms. For EU personal data the GDPR asks for a legal safeguard when data is passed to a company outside the EU (Articles 44 to 46).
Other countries have their own rules for data that is sent abroad. Where such a rule applies to us we follow it.
11. User Rights
| Region | Your rights |
|---|
| EU (GDPR, Articles 15 to 22) | see the data we hold about you (access), correct it (rectification), have it deleted (erasure), limit how we use it (restriction), receive a copy you can move elsewhere (portability), object to our use of it, and ask for a person to review an automated decision. You can also withdraw a consent you gave at any time (Article 7(3)) and complain to a data protection authority (Article 77). |
| Switzerland (FADP, SR 235.1) | the rights the FADP gives you over your personal data, for example to get access to it and to have it corrected |
| Japan (APPI, Articles 33 to 35) | ask us to disclose the personal data we hold about you (Article 33), to correct it (Article 34) and to stop using it or delete it in the cases the law lists (Article 35) |
| Brazil (LGPD, Article 18) | the rights listed in Article 18, including to confirm that we process your data, to access and correct it, to have data processed with your consent erased, to know with whom we shared it and to know the consequences of refusing consent |
| India (Digital Personal Data Protection Act, 2023) | once the main provisions of the Act are in force: the rights the Act gives you, including to use a grievance process and to nominate a person to act for you if you die or cannot act |
| China (Personal Information Protection Law) | the rights that the law gives you over your personal information |
| California (CCPA/CPRA, California Civil Code 1798.100 to 1798.199.100) | know what we collect about you, delete it, correct it, opt out of the "sharing" of your data for advertising, and limit the use of sensitive data |
| Other U.S. States (CO, VA, CT etc.) | similar rights to opt out, plus the right to appeal if we refuse your request |
| Everywhere else | the rights that the law of your country gives you, where that law applies to us |
To use a right, email help@studio.aifilms.ai or use the in-app form. We respond within 30 days (extendable to 60 days for complex cases). This is faster than the legal limits: one month extendable by two further months under Article 12(3) of the GDPR, and 45 days extendable once by another 45 days under California Civil Code 1798.130 and Colorado Revised Statutes 6-1-1306. If we need more time we tell you why. Where the law of your country sets a different deadline we follow that deadline.
If you are not satisfied with our answer you can complain to a data protection authority. Examples are the data protection authority of your EU Member State, the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland and the Personal Information Protection Commission in Japan.
12. Data Retention
Account data: kept while your account is active and for 6 years afterwards for tax and audit purposes
Usage logs: kept for 24 months and then kept only in combined (aggregated) form
AI creations: kept until you delete them or for 180 days after your account is closed
Purchase and billing records (credit pack purchases, subscription invoices and payment references): kept for 10 years for tax, accounting and legal purposes. We keep these records after an account is deleted. The GDPR lets us keep data that we need to meet a legal obligation or to defend legal claims (Article 17(3)(b) and (e)), so a deletion request does not remove them.
13. Children's Privacy
Our service is not directed to children under 13 and we do not collect personal information from them. This follows the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. 6501 to 6506, and 16 CFR Part 312). For users under 18 we block age-restricted features. If you believe a child under 13 has given us personal information, email help@studio.aifilms.ai so that we can delete it.
14. Security
We protect your data with these measures:
• Encryption in transit: information sent between your browser and our servers is encrypted with TLS 1.3, the current standard for secure connections (the padlock in your browser address bar).
• Role-based access control (RBAC): each staff member can open only the data that their job requires.
• Annual penetration tests: once a year we run controlled, simulated attacks on our systems to find weaknesses so that we can fix them before a real attacker finds them.
• 24/7 monitoring: our systems are monitored 24 hours a day and 7 days a week for suspicious activity.
If a data breach affects your personal data we will tell you and the regulators. Under Wyoming law (Wyoming Statutes 40-12-502) we notify affected Wyoming residents in the most expedient time possible and without unreasonable delay. Under the GDPR we notify the competent supervisory authority within 72 hours of becoming aware of a breach (Article 33) and we tell the affected people without undue delay when the breach is likely to put them at high risk (Article 34). If the law of another country requires a different notice we give that notice.
15. Changes
We may update this policy. We announce material changes by email or by a banner. If you keep using the service after a change you accept the updated policy.
16. Contact
Email: help@studio.aifilms.ai
EU Representative: to be appointed (GDPR Article 27). This policy will be updated when one is appointed.
Data-Protection Officer: not required at our current size. We will appoint one if the conditions in GDPR Article 37 are met.
