Your data, and what we do with it

1. Can I get my data back?

Yes. Also yes to deleting it, whenever you like, without giving a reason. Account settings let you look at what we hold, correct it, export it and delete it; if you would rather we did it, say so and we will. Where the law gives you more — objecting to a particular use, asking us to pause one, taking back a consent you gave earlier — that is yours too, and taking back a consent never unpicks what was done while it stood.

Deleting your account takes your projects, your uploaded and generated media, and your personal details with it. The one exception is the paperwork behind money already paid, which we have to keep for the periods in question seven. We come back on every request within 30 days, and the first one is free. If our answer does not satisfy you, you can complain to a data protection supervisory authority — in the EEA, the one for the country you live in.

2. Who am I actually dealing with?

YourWise AI, as the controller.

This policy covers the YourWise AI website, the application itself, and the billing and support that sit behind them. It applies to anyone who visits, anyone who signs up, and the billing contact of a business customer. Accounts are for adults: you have to be 18, or older where your country draws the line higher, and we delete accounts we discover belong to children.

Anything you want to ask about privacy goes through the contact form. That route is always there — it does not depend on any other detail on this page being filled in, and a person reads what arrives.

3. What do you actually collect?

Here is the whole of it, in plain words:

• Your account — your name, your email address, a hashed version of your password, the two-factor secrets and the recovery codes that go with them, and whichever teams you are in or were invited to.
• What you make — your prompts, the scripts, storyboards and scenes built from them, anything you upload, your brand kits, and the images, voiceovers, subtitles and rendered videos that come out.
• What you have used — credit movements, generations and renders, and project history, which is what quotas and support questions get answered from.
• Your payments — the name on the bill, how much each payment was and in what currency, the invoices, what the gateway answered, and the few card identifiers described in the next question.
• Technical traces — the address you connected from, which browser and device, when, and any error the app threw. That is there for security, for spotting fraud, and for finding out why something failed.
• Whatever you write to us — anything you write to us, through the form or by email, along with what we wrote back.

4. Where do my card details end up?

Past us, not into us. Card payments are handled by Mastercard Payment Gateway Services. Whatever you enter on the payment page goes over an encrypted TLS connection and is handed to the gateway to authorise.

We never store your full card number or your security code (CVV/CVC) on our servers. The number exists inside that one request and is gone once the payment is authorised. Against your account we keep only what is needed to show you which card paid and to satisfy our record-keeping duties: which brand of card it is, the six digits at the front, the four at the end, and when it expires. If you asked us to keep the card for next time, we also hold a token issued by the gateway, usable only to charge that card through our own merchant account, and never exposed to your browser or to anybody else.

The Payment Card Industry Data Security Standard applies to us, and so do the operating rules Visa and Mastercard set for merchants. We keep the gateway’s answer; the parts of that answer which could be used to authenticate a card again are not kept at all. Where your issuer asks for it, the payment is additionally checked with 3-D Secure, which happens between you, your bank and the gateway without passing through us.

5. Why do you need any of it?

To run your account. Opening it, making the scripts and the renders, keeping every project exactly where you left it, and helping when you ask. This is us performing the contract you entered into, and there is no version of it that works without the data.

To take payment. Top-ups, subscription charges, renewals, the invoices, and the occasional refund or card dispute. Contractual as well, and tax law then obliges us to keep the records afterwards whether we want them or not.

To keep the service usable. Moderating prompts automatically, preventing fraud and abuse, rate limiting, and watching for intrusions. We have a legitimate interest in this, and in places a legal duty.

To tell you things. Service notices and billing or renewal messages, which come with the contract; product news, which comes only if you asked for it and stops the moment you unsubscribe.

And here, in plain words, is what we will not do with any of it. We will not train a model of ours on your work. We will not sell your personal data. We will not hand it to an advertiser, and we will not build a profile of you to sell to one.

6. Who else gets to see it?

A short list of suppliers, each under a written data processing agreement, and nobody beyond it:

• The AI model providers, Anthropic among them, which receive your prompt and the script, the storyboard and the scene write-ups built out of it, in order to generate the work. Their contracts with us forbid them from training on what you send, and every prompt passes automated moderation before it goes.
• The hosting and object storage providers that run the application and keep your media.
• The email provider that delivers transactional messages.
• The payment gateway, which authorises your card, holds it if you asked us to keep it, and runs the 3-D Secure check.
• Our accountants and auditors, our legal advisers, and — where the law leaves us no choice — a regulator or the bank that acquires our card payments, which in practice means a dispute.

We operate from the country of our operating entity, and those suppliers operate in the European Economic Area, the United Arab Emirates, the United States and the United Kingdom. When personal data leaves the EEA or the UK, either an adequacy decision covers it or the European Commission’s Standard Contractual Clauses do, and you can ask us through the contact form for a copy of whichever one applies.

7. How long do you hang on to it?

Different things for different periods, and no longer than we can justify to you:

• Projects and the media in them — for as long as you keep them, and no longer than the account itself.
• Account details — while the account exists, then deleted or emptied of anything that points back to you.
• Security and access logs — around 12 months, and longer only while an investigation is open.
• Payments, invoices and tax records — for as long as accounting and tax law require, and for as long as a card dispute could still be raised over them.

Everything travels over TLS. Passwords are hashed and salted rather than stored in a form anyone could read, two-factor authentication is offered to everyone and required of administrators, production access is limited to the people who need it, secrets are encrypted, and the payment endpoints are rate limited. Nothing is ever completely safe. If a breach does get at your personal data, you hear about it from us, and so does the regulator, inside the deadlines the law gives us.

8. Are you tracking me?

No. Three cookies, and every one of them is needed: one keeps you signed in, one remembers your interface preferences, and one carries the token that stops a form being submitted from another site. There are no advertising cookies, no cross-site trackers and no third-party analytics tags on these pages, which is why you are not being asked to consent to anything and why nothing follows you after you leave. Blocking the three we do set will stop you signing in.