Privacy policy
Last updated: October 30, 2026
This is an English translation for convenience. If it differs from the Spanish version, the Spanish version prevails.
This policy explains what personal data Cinestoria processes, why, and what rights you have, under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Controller
Oscar Sanchez, with Tax ID 21752066T and address at Lope de Vega 99, Barcelona. Privacy contact: hola@cinestoria.com.
What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Waitlist email and the plan you're interested in | Letting you know when spots open and about the launch. | Your consent (art. 6.1.a GDPR). |
| Email and password (stored with irreversible encryption) | Creating and maintaining your account. | Performance of the contract (art. 6.1.b). |
| Your preferred language | Showing Cinestoria and sending you emails in that language. | Performance of the contract (art. 6.1.b). |
| Channels, topics, scripts, chosen voices, videos, images and thumbnails | Producing your videos and keeping them for you to download. | Performance of the contract (art. 6.1.b). |
| API keys you connect (Anthropic, fal.ai, ElevenLabs), stored encrypted | Using your accounts with those providers when producing your videos. | Performance of the contract (art. 6.1.b). |
| Strategist data: your channels' descriptions, the YouTube channel you link and the competitors you follow (public YouTube data), the YouTube Studio data you upload (screenshots or CSV), and each channel's reports and memory | Analyzing your channels and your niche, giving you ideas and recommendations, and applying what's learned to your scripts. | Performance of the contract (art. 6.1.b). |
| If you connect your YouTube channel to publish: the permission you grant in Google (stored encrypted), your channel's name, address and image, and the videos you upload from Cinestoria with their title, description, tags, thumbnail and visibility | Uploading to your channel the videos you decide to publish, with the details you choose, showing you where they are and, if you turn it on, analyzing their results (their YouTube statistics) with the Strategist. | Performance of the contract (art. 6.1.b). |
| Teams: the email of whoever you invite, their role, whether they accepted and when they last logged in; and who approved each script or storyboard and who published each video | Letting your team work in your account with the role you give them and letting you know who did what. The account holder sees this data about their team. | Performance of the contract (art. 6.1.b) and the account holder's legitimate interest in organizing their work (art. 6.1.f). |
| Link reviews: the name the reviewer types, their comments, their decision and when they made it; and, to limit abuse, their IP address temporarily | Letting whoever produces the video receive and see their client's comments. Only the account that sent the link sees it. It's deleted when the video or the account is deleted. | The account holder's legitimate interest in reviewing their work with their client and in protecting the service (art. 6.1.f). |
| API and webhooks: each API key's name, its fingerprint (never the key) and when it was used; your webhook URLs, their encrypted secret and the log of notifications sent (what, when and how your URL responded) | Letting you connect Cinestoria with your systems and check that notifications arrive. Notifications carry data about your videos (title, status, links) to the URL you choose. The log is deleted after 30 days. | Performance of the contract (art. 6.1.b). |
| If you turn on two-step verification: its key (encrypted), the fingerprint of your recovery codes and the last code used | Asking you for a second code when you log in, to protect your account. They're deleted when you turn it off. | Performance of the contract (art. 6.1.b). |
| Referral program: who recommended Cinestoria to you or whom you recommended it to, and the free months | Giving you the extra trial days and giving whoever recommends a free month. Whoever recommended you only sees your shortened email (a•••@…) when you pay. | Performance of the contract (art. 6.1.b). |
| Finished minutes, commissions and billing data | Charging for the service and meeting tax obligations. | Contract and legal obligation (art. 6.1.b and 6.1.c). |
| IP address and login attempts | Protecting the service against abuse (limits on login or sign-up attempts). | Legitimate interest (art. 6.1.f). Kept in memory for an hour at most; the server's technical logs, a few weeks. |
| Email for product news (only if you tick the box) | Sending you Cinestoria news. | Your consent (art. 6.1.a), which you can withdraw at any time. |
| Help chat: what you write, the page you write from, your language, the email you leave if you ask to talk to a person without an account and, to limit abuse, a fingerprint of your IP address (not the address) | Answering your questions instantly with an AI assistant and, if you ask, having someone from the team reply by email. If you have an account, the assistant sees its status (plan, which keys are connected, never their value, channels, this month's spending and your latest videos) to help you. Keys, passwords and card numbers you type are hidden before being stored. | Legitimate interest in answering your questions (art. 6.1.f) and, if you have an account, performance of the contract (art. 6.1.b). |
Who it's shared with
To produce your videos, Cinestoria sends the AI providers the necessary content (the topic, the script, the image descriptions and the texts to be voiced) through your own accounts: you have your own contract with them and their terms and privacy policies apply.
- Anthropic (research, script, quality control and the Strategist's analyses, including the YouTube Studio data you upload for a report).
- fal.ai (images and video clips).
- ElevenLabs (voice, music and sound effects).
- Anthropic, also as Cinestoria's processor (with its account, not yours) for the help chat's answers: it receives the conversation and, if you have an account, the account status described above.
- YouTube (Google): Cinestoria uses the YouTube API services. The Strategist reads public data about channels and videos (views, dates, titles) and, in “What your audience asks for”, the public comments on videos: only their text, likes and number of replies, never the commenter's name. They aren't stored: they're sent to Anthropic for the analysis, and the report only keeps short phrases without their author. If you connect your channel to publish, Cinestoria asks Google for three permissions: upload videos, see your channel (its name, address and image) and see its statistics (read only). It only uploads the videos you decide to publish, never deletes or changes the ones you already have, only reads the statistics of the videos you publish from Cinestoria (views, retention, traffic sources) to analyze them with the Strategist if you have it on, and doesn't read your comments. You can withdraw the permission at any time from “Channels” (the “Disconnect” button) or from your Google account permissions page; when you disconnect, Cinestoria deletes the stored permission immediately. The YouTube Terms of Service and the Google Privacy Policy apply. Cinestoria's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: that data isn't used for advertising, isn't sold and isn't used to train AI models.
- Hosting: Hetzner Online GmbH, with servers in the European Union, as data processor.
- Payments: Stripe Payments Europe, Ltd. (Ireland), which manages the subscription, card payments and invoices. Cinestoria never sees or stores your card.
- Email delivery (confirming your email, password resets and notifications about your videos): smtp-relay.brevo.com, as data processor.
Some of these providers are outside the European Economic Area (mainly in the United States). Transfers rely on the safeguards each of them offers, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell your data or use it for advertising.
How long we keep it
- Your account data and keys, for as long as you have the account. Each video's files, 30 days from creation (we let you know before deleting them).
- If you delete your account from “Account”, it's deleted immediately; the server's backups rotate and disappear within 14 days at most. What must be kept by law (commissions and billing data) is kept.
- The Strategist's reports, each channel's memory and the timed script of your videos (to analyze their results even after their files are deleted), for as long as you have the account. You can delete any memory note and unlink your YouTube channel whenever you want. The permission to publish on YouTube, until you disconnect the channel or delete the account; the record of the videos you uploaded (their YouTube ID and the details they were uploaded with), for as long as you have the account. The YouTube Studio files you upload are deleted 30 days after the report. Public YouTube data is cached for 30 days at most.
- Billing data, for as long as tax rules require (generally 4 to 6 years).
- The waitlist email, until launch or until you ask to be removed.
- Help chat conversations, 180 days from the last message.
Your rights
You can request access to, rectification, erasure, objection to, restriction of processing and portability of your data, and withdraw your consent at any time, by writing to hola@cinestoria.com. You can remove your API keys at any time from Connections. If you believe we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
Security
Passwords are stored with irreversible encryption and API keys are encrypted. Access to the application uses its own session that expires. No system is infallible: if we detect an incident affecting your data, we'll notify you as the law requires.