Privacy Policy

1. Information we collect

The information we collect depends on how you use the Service.

• Account and contact information, such as your email address, authentication identifiers, role, account status, and information you send to support.
• User content and creative inputs, including prompts, scripts, scene plans, uploaded images, video, audio, product media, references, names, likenesses, voices, and generated outputs.
• Billing and transaction information, such as token purchases, bundle identifiers, amounts, tax amounts, currency, Stripe session/payment identifiers, refund/dispute state, token ledger entries, and reconciliation records. Stripe processes the payment card details entered into Stripe Checkout; the Service does not store your full payment-card number.
• Technical and security information generated when you use the Service, such as authentication/session cookies, request timestamps, provider task identifiers, error/recovery state, security and moderation events, and infrastructure logs that may include IP address, browser/device information, and request metadata.
• Browser storage used to operate the application, including localStorage or sessionStorage for UI preferences, workflow state, and durable request identifiers used to prevent duplicate submissions. These are not advertising trackers.

2. How we use information

We use personal information to provide, secure, maintain, support, and improve the Service; authenticate users; store projects and media; process generation requests; prevent duplicate charges or provider submissions; recover interrupted work; process token purchases and refunds; enforce safety and rights rules; investigate fraud or abuse; provide customer support; maintain audit records; and comply with legal obligations. We do not use customer Input to train our own AI models unless we first obtain separate permission.

We do not use uploaded media for biometric identification or to determine a person's real-world identity, and we do not create biometric identifiers for identification purposes. Images, video, and voice may nevertheless contain personal information and may be processed by AI providers as necessary to perform the generation you request.

3. AI providers and service providers

To operate the Service, we disclose information to vendors that perform services on our behalf or provide functionality you request. Depending on the workflow, this can include Supabase for authentication/database services, Vercel for hosting and private media storage, Stripe for payment processing and tax calculation, OpenAI for scripts, safety or synthetic narration, Runway for certain video/avatar features, and fal.ai for generative-media requests. Some fal.ai or routing workflows may transfer request content to the third-party model provider used for that request.

These providers process information under their own contracts, data-processing terms, privacy notices, and technical settings. Depending on the provider agreement, model, plan, and settings, a provider may retain request data or use it for safety, service improvement, or model training. Some providers also act as independent controllers for limited purposes such as fraud prevention, security, legal compliance, or payment-network obligations. We do not control those independent uses.

Provider/model availability changes over time. We will update this Policy when a change materially affects how personal information is processed.

4. Payment information

Purchases use Stripe-hosted Checkout. Stripe may collect payment method, billing, tax, fraud-prevention, device, and transaction information directly from you. We receive transaction and fulfillment information needed to credit tokens, display receipts/status, handle refunds or disputes, and reconcile payment problems. We do not receive or store your full card number through the current integration.

5. Cookies and browser storage

The Service uses cookies that are necessary for authentication and session management. It also uses browser localStorage/sessionStorage for application state and user-interface preferences, including request identifiers used for recovery and duplicate-submission protection.

The current application source does not include third-party behavioral advertising pixels or advertising analytics SDKs. Infrastructure and service providers may still collect ordinary technical logs and security information when they provide their services.

6. How we disclose information

We may disclose personal information to the service providers described above; professional advisers such as attorneys, accountants, insurers, and auditors; law enforcement or regulators when required or reasonably necessary to comply with law; or parties to a merger, financing, acquisition, sale, or similar business transaction subject to appropriate protections.

We may also disclose information when reasonably necessary to investigate fraud, payment disputes, security incidents, safety violations, rights complaints, or misuse of the Service, or to protect users, 2Brothers Digital, providers, or others.

7. Sale, targeted advertising, and profiling

We do not sell personal information for money, and the current Service does not use personal information for targeted advertising or for profiling that produces legal or similarly significant decisions about users. If that changes, we will update this Policy and provide any opt-out rights required by law before using personal information in that manner.

8. Retention and deletion

We retain information for as long as reasonably necessary to operate the Service and account, provide recovery, maintain billing and token records, protect against fraud and abuse, resolve disputes, enforce agreements, and satisfy legal, tax, accounting, insurance, and security obligations. Different records have different retention needs.

Project or account deletion may remove associated user-facing content, but some payment, token-ledger, safety, reconciliation, rights-acceptance, legal-acceptance, and audit records may be retained when reasonably necessary for the purposes above. Provider-side retention is also subject to the provider and model settings applicable to the request.

You may request account or personal-data deletion by contacting support@2brothersdigital.com. We will verify the request and explain any information that must be retained.

9. Security

We use administrative, technical, and organizational safeguards designed to protect information, including authenticated access controls, row-level database security, private media storage/signing, server-side authorization, payment webhook verification, safety controls, and audit/reconciliation records. No system is completely secure, and we cannot guarantee absolute security.

10. Your privacy choices and rights

You may contact support@2brothersdigital.com with the subject "Privacy Request" to ask to access, correct, delete, or obtain a copy of personal information associated with your account. Depending on where you live and whether a privacy law applies to 2Brothers Digital, you may have additional rights, including rights to confirm processing or opt out of certain uses. We may need to verify your identity before acting on a request.

If we deny a privacy request and applicable law gives you a right to appeal, reply or write to support@2brothersdigital.com with the subject "Privacy Appeal" and explain why you believe the decision should be reconsidered. We will review the appeal separately and provide any regulator-contact information required by applicable law.

Kentucky's Consumer Data Protection Act, when its applicability thresholds are met, provides eligible Kentucky consumers rights including access, correction, deletion, portability, and opt-out rights for targeted advertising, sale, or certain profiling. The current Service does not sell personal information or use it for targeted advertising.

11. International processing

2Brothers Digital is based in the United States. Our providers may process information in the United States and other countries. Those locations may have privacy laws different from the laws where you live. Where required, we and our providers use contractual or other mechanisms intended to support lawful transfers.

12. Children

The Service is intended only for people age 18 or older. We do not knowingly offer accounts to children. If you believe a child has provided personal information through the Service, contact us so we can investigate and take appropriate action.

13. Changes to this Policy

We may update this Privacy Policy as the Service, providers, laws, or data practices change. We will change the version/effective date and provide additional notice when a change is material. Material changes may require a new acknowledgement before continued use.

14. Contact

For privacy questions or requests, contact 2Brothers Digital LLC at support@2brothersdigital.com.