Privacy Policy & Data Protection

1. Introduction & Overview

Cinroom AI ("Cinroom", "we", "our", or "us") operates an AI-powered platform that turns jewelry photographs into commercial videos and campaign images. This Privacy Policy describes what data we collect, how we use it, who else receives it, how long we keep it, and how you can get it deleted.

This policy applies to cinroom.com and to the Cinroom application. By creating an account or uploading files, you accept the practices described here.

2. In Plain Language: We Collect Your Data

3. Information We Collect

• Account Data: Email address, full name, hashed credentials, and authentication provider metadata (Google OAuth or email login).
• Uploaded Creative Assets: Jewelry reference photographs, CAD renderings, multi-angle product images, and brand guideline images provided for AI video/image rendering.
• Creative Inputs & Preferences: Custom text prompts, creative vision inputs, model casting preferences (gender, age, country of origin, ethnicity), duration, and aspect ratio selections. Casting preferences describe the fictional model you want generated; they are not data about you.
• Generated Output: The videos and images the AI produces from your inputs, together with the job history, status and any error messages.
• Transaction Data: Subscription tier, credit balance, purchase history, and transaction identifiers. Payments are processed by Dodo Payments; we do not store full card numbers on our servers.
• Technical Usage Data: IP address, browser type, device information, operating system, referring page, and interaction logs used for diagnostics, security and fraud prevention.
• Analytics & Session Data: Pages viewed, features used, and — where you have accepted optional cookies — a replay of your mouse movement, scrolling, clicks and typing behaviour on our pages, captured by Microsoft Clarity. See section 7.
• Support Correspondence: Emails and messages you send us, including any files attached to them.

4. How We Use Your Information

• Generating jewelry video commercials and campaign images from your uploaded references.
• Maintaining the visual fidelity of your jewelry during AI rendering.
• Managing accounts, credit balances, subscription billing and transaction processing.
• Providing customer support and debugging failed renders. Our staff can access your jobs, uploads and outputs where it is necessary to resolve a support request, investigate abuse, or comply with the law.
• Measuring which features are used, so we can improve the product.
• Ensuring platform security and preventing unauthorised access, fraud or API abuse.
• Sending service messages about your renders, billing and account.

Our legal bases under GDPR are: performance of a contract (to deliver renders you paid for), legitimate interests (security, fraud prevention, product improvement), consent (optional analytics and session replay cookies), and legal obligation (tax and accounting records).

5. Artificial Intelligence: How Your Uploads Are Processed

Cinroom is an AI product. This section explains what that means for your files.

• Your images and prompts are sent to third-party AI providers. To render a film or image we transmit your uploaded reference images and your prompt text to BytePlus (operated by ByteDance) and, for some image features, to OpenAI. These providers process that content on their own infrastructure, which may be outside your country.
• We do not train our own models on your content. Cinroom does not operate or fine-tune any AI model using your uploads, prompts or outputs.
• We cannot guarantee what third-party providers do with data on their side. Their use of submitted content — including whether it may be retained or used to improve their services — is governed by their own terms and privacy policies, not by ours. If your designs are commercially sensitive, review those providers' terms before uploading.
• Outputs are machine-generated. Videos and images produced by Cinroom are synthetic. Any person, model, hand or environment appearing in a render is AI-generated and does not depict a real individual. Outputs may contain errors or artefacts and should be reviewed before publication.
• Automated content screening. Prompts and uploads may be screened automatically by us or by our AI providers for prohibited content. A render can be rejected by these filters without a human reviewing it. You can contact us to have such a decision reviewed by a person.
• No automated decisions with legal effect. We do not use AI to make decisions that produce legal or similarly significant effects about you.

6. Third-Party Subprocessors & Data Collectors

These are every company that receives your data in order for Cinroom to work. We share only what each one needs, and we do not sell your data to anyone.

We may also disclose data where we are legally required to, or to a successor entity if Cinroom is acquired or merged. We will notify you before your data becomes subject to a materially different privacy policy.

7. Cookies, Analytics & Session Recording

When you first visit, we ask you to choose between Essential Only and Accept All.

• Essential cookies keep you signed in, remember your cookie choice, and secure payment flows. These cannot be switched off without breaking the product.
• Product analytics (PostHog) records which pages and features you use, tied to your account once you sign in. It does not record your screen.
• Session replay (Microsoft Clarity) reconstructs a playback of your visit — mouse movement, scrolling, clicks and typing behaviour — and links it to your account so we can investigate support issues. This runs only if you choose "Accept All"; if you choose "Essential Only" the Clarity script is never loaded.
• Error monitoring (Sentry) captures crash and performance reports, including your account ID, so we can fix faults.

To change your choice, clear this site's data in your browser and the banner will appear again, or email us and we will action it for you.

8. Data Retention & Deletion

• Uploads and generated files are kept for as long as your account is open, so that you can return to your work. They are not deleted automatically.
• On request, we delete them. Email deb@cinroom.com from your account address asking for deletion of specific files or of your whole account. We action it within 30 days and confirm by email.
• Account closure removes your uploads, generated files and profile from our active systems. Encrypted backups may retain copies for up to 90 days before they are overwritten.
• Billing and tax records are retained for the period required by law (typically 7 years), even after account closure. These contain transaction amounts and identifiers, not your creative files.
• Copies held by third parties — such as AI providers or analytics vendors — are deleted according to their own retention schedules, which we do not control. Deleting a file from Cinroom does not by itself erase any copy held by a provider that processed it.

9. Data Security & How Your Files Are Stored

Traffic between your browser and Cinroom is encrypted with TLS. Account data is held in a managed database (Supabase) and files are held in object storage (Cloudflare R2), both of which encrypt data at rest.

We do not sell, rent, or publish your uploads or your generated films, and we do not feature customer work in our showcase or marketing without asking you first. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant supervisory authority as required by law.

10. Your GDPR & CCPA Data Rights

Depending on where you live, you have the following rights over your data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Deletion (Right to be Forgotten): Request deletion of your account, uploaded images and generated assets, as described in section 8.
• Right to Rectification: Update or correct your account information at any time in Settings, or by contacting us.
• Right to Data Portability: Export your generated assets and project history.
• Right to Object: Object to processing based on our legitimate interests, and withdraw consent for optional analytics and session replay at any time.
• Right to Non-Discrimination (CCPA): We will not degrade your service or change your price because you exercised a privacy right.
• Do Not Sell or Share (CCPA): We do not sell personal information, and we do not share it for cross-context behavioural advertising.

To exercise any of these rights, contact our Privacy Office at deb@cinroom.com. We respond within 30 days. If you are in the EEA or UK and are unhappy with our response, you may complain to your local data protection authority.

11. International Data Transfers

Cinroom and its providers operate globally. Your data — including your uploaded images — may be processed in countries other than your own, including the United States and Singapore, which may not provide the same level of data protection as your home country. Where required, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

12. Children's Privacy

Cinroom is a business tool and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to This Policy

We update this policy when our practices change. The "Last Updated" date at the top of this page always reflects the current version. If a change materially affects how we handle your data, we will notify account holders by email before it takes effect.

14. Contact & Inquiries

If you have any questions regarding this Privacy Policy, please contact us at: