Privacy Policy

1. What we collect

• Account: your email address; if you sign in with GitHub, your GitHub id, login, name and avatar; which storefront you signed up on; sign-in tokens and sessions.
• Submissions: the URLs you give us, screenshots and extracted text of those pages, public repository content, your creative brief, storyboard feedback, director's notes, ratings and any feedback you leave on a film.
• Films and their artefacts: storyboards, stills, narration audio, music, renders and reports, stored for as long as your account keeps them.
• Payments: Polar handles the checkout; we store the order and checkout ids, what was bought, amounts and currency, and your credit balance. We never receive card numbers.
• Usage and technical data: server logs with IP address, user agent, timestamps and request paths; error reports; render costs and timings.
• Email: which emails we sent you and whether they could be delivered. For outbound pitches (see section 4) also whether they were opened or clicked.

2. Why, and on what legal basis

• To provide the service you asked for — accounts, films, payments, support, the emails that tell you a storyboard or film is ready (performance of a contract).
• To keep the service secure and working, prevent abuse, enforce our terms and limits, and improve the product (our legitimate interests).
• To show free films as examples of our work, as agreed in the Terms (performance of a contract / legitimate interest).
• To send you product news, only if you asked for it, and to send one pitch to publicly listed launches (legitimate interest — see section 4). You can opt out of either at any time.
• To meet legal obligations, such as tax and accounting records.

3. Who processes data for us

We use a small number of providers, each bound by contract to process data only for us:

• Anthropic (Claude models): receives extracts of the page or repository you submit, your brief and feedback, to write and design the film.
• ElevenLabs and Microsoft (text-to-speech): receive the narration text to synthesize the voice.
• Google Fonts: we fetch font files from Google when your page uses them; Google sees our server's request, not you.
• Polar.sh: payments, receipts, tax — as merchant of record under its own privacy policy.
• GitHub: sign-in with GitHub, and access to repositories you connect through the GitHub App.
• Amazon Web Services (SES): sends our emails.
• Our hosting provider, on whose servers the service, its database and its media storage run.

Some of these providers process data outside the European Economic Area, notably in the United States. Where they do, transfers rest on the European Commission's adequacy decisions (the EU–US Data Privacy Framework) or on standard contractual clauses.

4. Founders we write to

To find products that might want a film, we read public launch directories (sites where founders list new products) and note the product's name, website and a publicly published contact address. We may send that address one email introducing the service. The email says why you received it, contains an unsubscribe link, and includes a small image and tracked link that tell us whether it was opened or clicked — nothing more. If you unsubscribe, we never write to that address again. Legal basis: our legitimate interest in reaching businesses that have just launched a product, balanced by the single-email rule.

If you would rather we did not hold your address at all, email legal@ame.link and we delete it.

5. Cookies and local storage

• A session cookie that keeps you signed in.
• A cookie named aireel_pt, set for 30 days when you arrive from a link in one of our emails, so we can tell that the email led to a sign-up. It contains a random token, nothing about you.
• On aireel.tv, a first-party cookie named aireel_acquisition remembers your first marketing-page visit for up to 30 days. We record the page path and a broad source such as Google search, an email or a direct visit, and whether you submit a URL. If you create an account in that browser, we connect that visit to your signup, completed films and purchases to understand which pages help people use the service. We do not record your submitted website, search terms, full referring URL or raw IP address in this analytics record. We honour browser Do Not Track and Global Privacy Control signals for this measurement.
• Local storage remembering which storefront you last viewed.

We use no advertising or third-party analytics cookies.

6. How long we keep data

• Account and films: while your account exists, and for 12 months after it closes so you can come back; then deleted.
• Payment records: as long as tax law requires (in the Netherlands, seven years).
• Server logs: 90 days.
• First-party acquisition records: up to 12 months, removed by a daily cleanup when the analytics service receives visits. Account-linked acquisition records are also deleted when the account is deleted.
• Emails we sent, waitlists and pitch records: until you unsubscribe or ask us to delete them, and at most 24 months after the last contact.
• Free films we feature as examples: for as long as we feature them; removed on request as described in the Terms.

7. We do not sell your data

We do not sell, rent or trade personal data, and we do not share it with data brokers or advertising networks. We share data only with the providers above, with authorities where the law requires it, and with a successor if the service is ever transferred to another operator — who would be bound by this policy.

8. Your rights

Under the GDPR you may ask us for a copy of your personal data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. You may withdraw consent at any time where we rely on it. Email legal@ame.link; we answer within a month. You may also complain to your data-protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

9. Security

Data travels encrypted (TLS). Access to production systems is restricted to the people who run the service. Secrets are kept out of the code and out of the AI models' reach. Films and media are served through signed, expiring links. No system is perfectly secure; if a breach ever affects you, we will tell you and the authorities as the law requires.

10. Changes and contact

We may update this policy; the date at the top shows the current version, and material changes are announced by email or on the site. Questions, requests and complaints: legal@ame.link, or in writing to Ame.link, Tweede Kostverlorenkade 114h, 1053 SB Amsterdam, the Netherlands.