Privacy Policy
CineStudio AI is operated by Headkey Software Technologies Private Limited (CIN U72900KA2019PTC130529) ("we", "us", "our"). Effective date: 9 October 2026 · Version: 2026-10-09
1. Who we are and how to contact us
Headkey Software Technologies Private Limited is the "Data Fiduciary" (under India's Digital Personal Data Protection Act, 2023, "DPDP Act") and the "controller" (under the EU/UK GDPR, where it applies) for the personal data described here.
- Privacy and grievance contact: info@headkeysoftwaresolution.com
- Grievance Officer: Suhas Raju, info@headkeysoftwaresolution.com, #3, 3rd Floor, RR Block, 4th A Main, Santrupthi Nagar, J P Nagar 7th Phase, Bengaluru, Karnataka 560078, India
- Postal address: #3, 3rd Floor, RR Block, 4th A Main, Santrupthi Nagar, J P Nagar 7th Phase, Bengaluru, Karnataka 560078, India
2. What this policy covers
This policy explains what personal data CineStudio AI (an AI filmmaking studio that turns a written idea into scripts, storyboards, voice, music and finished short films) collects, why, who we share it with, how long we keep it, and the rights and choices you have. It applies to the CineStudio AI website and web app, the share, reel and watch-party pages it creates, and the emails it sends.
3. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, password (stored hashed), profile photo, role; Google account ID, email and photo if you use Google sign-in | You, or Google |
| Projects and media | Concepts, scripts, characters, brand kits, uploaded files, and the images, audio and video you generate | You and the AI features |
| Collaboration | Crew invites, comments, reactions and the names viewers enter on share and watch-party pages | You, your crew and viewers |
| Billing | Plan, credit balance and history, payment references and amounts (we never see your full card number) | You, Razorpay, Stripe |
| Security and usage | Sign-in sessions (device, IP address, approximate city), last seen time, feature usage | Your device, ip-api.com |
| Consent records | Which Terms and Privacy versions you accepted, when, your IP address and browser | Your device |
We do not intentionally collect sensitive categories of data (such as health, financial account numbers, biometric data, religious or political beliefs) unless listed above. Please do not upload such data unless a feature specifically asks for it.
Payment card details are entered on the payment provider's own page or SDK. CineStudio AI receives only a payment reference, amount and status, never your full card number.
4. Why we use it (purposes) and our legal basis
| Purpose | Legal basis (DPDP Act) | Legal basis (GDPR, where applicable) |
|---|---|---|
| Create and secure your account, sign you in | Your consent (given at sign-up) | Performance of a contract |
| Provide the features you ask for, including the AI features | Your consent | Performance of a contract |
| Process payments and keep billing records | Your consent; compliance with law (tax/accounting) | Contract; legal obligation |
| Send service emails (verification, password reset, receipts, security alerts) | Your consent | Contract; legitimate interests |
| Prevent fraud and abuse, keep the service secure | Legitimate uses permitted by law | Legitimate interests |
| Marketing messages (only if you opt in separately) | Your separate, optional consent | Consent |
We do not sell your personal data. We do not use your data for targeted advertising.
5. AI features
CineStudio AI sends the concept, script text, reference images, audio and settings you give an AI feature to the provider that powers that feature:
- Text (stories, scripts, shot lists, notes): OpenAI, Anthropic Claude or Google Gemini, through Emergent's AI gateway.
- Images (storyboards, posters, frames): OpenAI or Google Gemini image models, through Emergent's AI gateway.
- Voice and transcription: OpenAI text-to-speech and speech-to-text, through Emergent's AI gateway.
- Motion shots, lip-sync and music: fal.ai, which runs models such as Kling, Veo, Wan and Stable Audio.
- Originality check: short extracts of your script may be searched on public web search engines (DuckDuckGo or Bing) to look for close matches.
Where your studio is set up to use local AI models on its own servers, that work does not leave those servers.
- AI output is generated automatically, can be wrong, incomplete or biased, and is not professional advice.
- Content you submit to an AI feature (text, images, audio, files) is sent to the AI provider listed below only to produce the result you asked for.
- How long each AI provider keeps that content, and whether it may use it to improve its models, is set by that provider's own terms (linked below). We do not use your content to train our own models.
6. Who we share it with
We share personal data only with service providers ("Data Processors") that help us run CineStudio AI, and only what they need:
| Provider | What it does for us | Their policy |
|---|---|---|
| Emergent (Emergent Labs) | Hosting, AI gateway, sign-in with Google on preview sites, file storage | https://emergent.sh |
| OpenAI | AI text, images, voice and transcription | https://openai.com/policies/privacy-policy |
| Anthropic | AI text (Claude) | https://www.anthropic.com/legal/privacy |
| AI text and images (Gemini), Google sign-in | https://policies.google.com/privacy | |
| fal.ai | AI video, lip-sync and audio models | https://fal.ai/privacy |
| DuckDuckGo / Microsoft Bing | Web search for the originality check | https://duckduckgo.com/privacy, https://privacy.microsoft.com |
| MongoDB / database host | Database | https://www.mongodb.com/legal/privacy |
| Razorpay | Payments in India | https://razorpay.com/privacy/ |
| Stripe | Card payments | https://stripe.com/privacy |
| Resend | Account and notification email | https://resend.com/legal/privacy-policy |
| ip-api.com | Approximate city of sign-in IP addresses, for new-device alerts | https://ip-api.com/docs/legal |
We may also disclose data if required by law, court order or a government authority with lawful power to ask, or to protect the rights, safety or property of our users or the public. If Headkey Software Technologies Private Limited is involved in a merger or acquisition, data may transfer to the new owner under this policy.
7. International transfers
Some providers above process data outside India (for example in the United States or the EU). We transfer data only to countries not restricted by the Government of India under the DPDP Act. Where GDPR applies, we rely on appropriate safeguards such as the provider's Standard Contractual Clauses.
8. How long we keep it
- Account, projects and media: while your account is open. Deleting your account removes your projects, upload records, brand kits and sessions straight away; copies of media files can remain in storage, no longer linked to any account, until we purge them (email us to ask for this).
- Films you share by link stay visible to anyone with the link until you turn the link off or delete them.
- Sign-in sessions: until they expire or you sign them out; new-device history keeps your last 30 devices.
- Billing records: as long as tax and accounting law requires (usually 8 years), without your name after deletion.
- Consent records: for as long as your account exists and then as long as needed to show what you agreed to.
When you delete your account we delete or anonymise your personal data within 30 days, except records we must keep by law (for example invoices and payment records, usually kept for up to 8 years under Indian tax law), which we keep only for that purpose.
9. Your rights
Under the DPDP Act you can:
- get a summary of the personal data we hold about you and how we process it;
- ask us to correct, complete, update or erase your personal data;
- withdraw your consent at any time. This is as easy as giving it: go to Account & sign-in and choose Delete account. Withdrawal does not affect processing already done;
- nominate another person to exercise your rights if you die or become incapable;
- raise a grievance with us at info@headkeysoftwaresolution.com. We aim to acknowledge a grievance within 24 hours and resolve it within 15 days.
If you are not satisfied, you may complain to the Data Protection Board of India.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, objection, data portability, and to complain to your local data protection authority.
How to use them: download your films and files from the app, or email us for a full copy of your data. To delete your account, go to Account & sign-in and choose Delete account. You can also email info@headkeysoftwaresolution.com about any of these rights. We may ask you to verify your identity first.
10. Children
CineStudio AI is meant for people aged 18 or older. You must confirm you are 18+ when you sign up. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, email info@headkeysoftwaresolution.com and we will delete it.
11. Security
We use reasonable security safeguards, including encrypted connections (HTTPS), hashed passwords, access controls and limited staff access. No online service is completely secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.
12. Cookies and local storage
See our Cookie Policy.
13. Changes to this policy
When we make a material change, we will update the version and effective date above and ask you to review and accept the new version the next time you sign in. You can always see the current version at /privacy.
14. Contact
Headkey Software Technologies Private Limited (CIN U72900KA2019PTC130529), #3, 3rd Floor, RR Block, 4th A Main, Santrupthi Nagar, J P Nagar 7th Phase, Bengaluru, Karnataka 560078, India · info@headkeysoftwaresolution.com