Privacy Policy

Last updated: 2026-06-20

This Privacy Policy explains how Control ("we", "us") collects, uses, and protects personal data when you use the Service. We act as the data controller for the personal data described below. We process data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data we collect

• Account data: your name, email address, and authentication identifiers (e.g. Google account ID for OAuth sign-in).
• Content data: prompts, uploaded images/video/audio, and generated outputs, along with associated workflow and project metadata.
• Usage and billing data: generation history, credit balance and transactions, and subscription status. Payment card details are handled by our payment processor and never reach our servers.
• Technical data: IP address and request metadata used for security, rate limiting, and abuse prevention.

2. How we use data and legal bases

• To provide the Service (account, generation, storage) — performance of a contract.
• To process payments and manage subscriptions — performance of a contract and legal obligation.
• To secure the Service (rate limiting, abuse and fraud prevention) — our legitimate interests.
• To comply with law (e.g. tax and accounting records) — legal obligation.

3. Processors and sub-processors

We share data with the following providers solely to operate the Service:

• AI generation — APImart and Replicate (process your prompts and reference media to generate video, images and text).
• Storage — Cloudflare R2 (stores your uploaded and generated media).
• Hosting — Railway (application and database hosting).
• Authentication — Google (OAuth sign-in) and our email delivery provider (magic-link sign-in).
• Payments — Lemon Squeezy, our merchant of record.
• Security — Upstash (rate-limit state).

Some providers may process data outside the European Economic Area; where they do, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

4. Retention

We keep your account and content data for as long as your account is active. When you delete your account, your personal data and media are deleted, except records we must retain for legal or accounting purposes (e.g. transaction records), which are anonymized or retained only as required by law.

5. Your rights

Under the GDPR you have the right to:

• access a copy of your personal data (available as a self-service export in your account settings);
• rectify inaccurate data;
• erase your data ("right to be forgotten") by deleting your account;
• restrict or object to certain processing;
• data portability;
• lodge a complaint with your local supervisory authority.

You can exercise access and erasure directly from your account settings, or contact us for any other request.

6. Security

We use industry-standard measures to protect your data, including encrypted transport, access controls, and per-job secrets for provider callbacks. No system is perfectly secure; we cannot guarantee absolute security.

7. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from children.

8. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by the "Last updated" date above.

9. Contact

For privacy questions or to exercise your rights, contact us at [email protected].