Privacy Policy

Introduction

DIMANTIKA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, a company registered in Gdańsk, Poland (“Dimantika,” “we,” “us,” or “our”), is the controller of your personal data. We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Clipwright, our short-form video generation service for talking-actor UGC clips and faceless videos.

This Privacy Policy describes the legal bases on which we process your data (section 7.1). Where a use of your data requires your consent, we ask for it separately.

We are established in the European Union, so the General Data Protection Regulation governs how we handle your data. Section 7.2 lists rights we extend to California residents.

Information We Collect

We collect several types of information from and about users of our Service:

2.1 Personal Information

• Account Information: Email address, name, and authentication credentials
• Sign-up Source: The site that referred you to us, and any referral or campaign marker carried by the link that brought you here. We keep these with your sign-up
• Profile Information: Optional profile details you choose to provide
• Generation Input: the script or brief you write, the description of the person you want on camera, and any image, b-roll or other reference URL you submit for a run
• Reference Videos: a video you submit as a reference for analysis, and the analysis we make of it
• Contact Information: When you contact our support team

2.2 Payment Information

• Billing Details: Name, billing address, and payment method information
• Transaction History: Records of your credit purchases and payment history
• Note: Payment processing is handled by Stripe; we do not store full payment card details

2.3 Usage Information

• Service Usage: Generation runs, credits consumed, usage frequency
• Run Records: what each run asked for, whether it succeeded or failed, and the video it produced
• Preferences: Whether the dashboard sidebar is open. Your light or dark theme is kept in your browser and is not sent to us.

2.4 Technical Information

Our public pages use a cookieless visit counter run by a web analytics provider in the United States. It counts page views, the referring site, the country, the browser type and how quickly the page loaded. It sets no cookie, stores nothing on your device and builds no profile of you. The dashboard and the other pages you reach after signing in do not load it.

Apart from that counter, we run no analytics. This paragraph and the two that follow are about what our code writes; the provider hosting the Service keeps its own record of the requests that reach it, described further down.

When something on our side fails or looks wrong, our server writes a line about it to its own console, which is kept by the provider hosting the dashboard. These lines are about operations, not a record of the pages you visit. A line usually names the operation and may carry the account, the payment or the run involved; some carry none of these. We do not promise a fixed set of fields, and some lines are written not by us but by the libraries we use.

Where the failure came from another system — our payment provider or our database — we may record the error report it returned. Depending on what failed, such a report can include identifiers for the failed request and the email address or the stored record the operation touched. We never write your password or the secret part of an API key ourselves, and we do not keep that secret after the key is issued: we can show you only its first few characters again. What we cannot promise on behalf of those other systems is that nothing sensitive ever appears inside a report they hand us; where it does, it is kept for as long as the line that carries it (see section 5).

We do not write down your ordinary successful actions in production. A line can still appear for an operation that completed, when something about it was not as expected. We read these lines only to find out why something broke.

A few places write to your browser’s console instead, when something goes wrong on the page — those messages stay on your machine and never reach us.

The service that runs our video generation keeps operational logs of each run — its stages, timings and any failure — and we use them to find out why a render went wrong. Our maintenance tasks log there too, about our own infrastructure rather than about you.

What remains is inherent to reaching a server over the internet. Whichever provider hosts the part of the Service your browser is talking to receives that request, and with it your IP address, the time of the request and what your browser reports about itself. That is the hosting provider for the page or the API you called, and it keeps its own operational record of those requests — successful ones included — under its own terms rather than ours. Most of the providers listed in section 4 are ones we call on your behalf, and they see what we send them rather than your browser. Three are different, because your browser goes to them directly: Stripe, when you pay — the checkout page is Stripe’s own; our cloud storage provider, when you open or download a finished video, since the link we give you points at the storage itself; and, on our public pages, the web analytics provider that runs the visit counter. All three receive your request as any site you visit would. Each provider processes what it receives as part of delivering and securing its own platform, under its own terms. We do not combine any of it with your account or use it to profile you.

The cookies this site sets are listed in our Cookie Policy. There is no advertising or tracking cookie among them.

How We Use Information

We use the collected information for the following purposes:

3.1 Service Provision

• Provide and maintain the Clipwright video generation service
• Process your generation requests through our providers
• Manage your account, credit balance, and API keys
• Store your generation history and the resulting video files

3.2 Communication

• Respond to your inquiries and support requests
• Send transactional email that the Service itself requires — account confirmation when you register, and password reset — delivered by our authentication provider. Signing in itself sends no email.

3.3 Service Improvement

• Monitor service performance and reliability
• Develop new generation features and provider integrations
• Study our run records in aggregate to improve the Service

3.4 Legal and Security

• Comply with legal obligations and regulations
• Protect against fraud, abuse, and security threats
• Enforce our Terms of Service
• Resolve disputes and investigate violations

3.5 References

We use the content you submit as references to operate, improve and develop our services, including developing and training our models and creative methods. Our legal basis is our legitimate interest in improving the Service. You have the right to object to this use by writing to support@dimantika.com.

We do not use faces or voices to train any model without your explicit consent.

Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties except as described below:

4.1 Service Providers

These are the providers that process your personal data on our behalf, as of the date at the top of this page:

• Stripe: payment processing, invoicing and tax calculation. Stripe receives your email address, billing address, payment details and an account identifier. If you buy as a business and enter a VAT identification number, Stripe receives that too. We never receive or store your card number.
• Supabase: authentication and the application database — your account, credit balance and run history.
• A cloud storage provider: stores your generated videos and related files, and our database backups. When you open a finished video, your browser fetches it from this provider directly, so it also sees that request itself (see section 2.4).
• A job-processing provider in the United States: runs video generation and maintenance tasks, including database backups, and stores their data there. It receives the request you sent, including your script, and a copy of your account data passes through it.
• A hosting provider: runs our website and API in a European region; the provider is based in the United States and may process service data, such as logs, there. Its hosting includes keeping the failure logs described in section 2.4.
• A web analytics provider in the United States: counts visits to our public pages, as described in section 2.4. It does not receive your account data: the dashboard does not load it.

Two kinds of message that carry your personal data reach us through Telegram, so that we see them quickly. Telegram is only how they reach us; we do not use it to contact you.

Support requests are the first. When you write to us through the support form in your dashboard or send us feedback, a notice of the request is forwarded to us through Telegram. That notice carries only part of the request’s identifier, where it came from and its kind, and the identifier of the run you attached, if any — neither the text you wrote nor your email address. The message is deleted from our Telegram chat about 24 hours after it was sent. When we delete your account at your request (see Data Retention), we also delete any such message still in the chat and remove the text and the addresses from the copy kept in our own database.

Sign-up notifications are the second. When you sign up, or when we enter an application for you at your request, a notification reaches us through Telegram. It carries a masked form of your email address — the first two letters before the @ and the full domain, for example jo…@example.com — the identifier of your application, and whether your account was opened at sign-up or your application is waiting for admission, with the number of applications waiting. It is deleted from our Telegram chat on the same terms as a support notice, and deleting your account also removes the address and the sign-up source from the copy in our own database.

4.2 Third-Party Generation Providers

Producing a video requires sending the material you submit to specialist providers in these categories. Where they process your data is set out under International Data Transfers below.

• Speech-synthesis services: receive the text of your script, or the narration written from your brief, and the voice you chose, to synthesise the voice track
• Speech-recognition and video-analysis services: receive a reference video you submit, to transcribe its speech and analyse it
• Presenter-video services: receive the synthesised voice track and the image of the presenter, to generate the presenter or avatar video
• Text-generation services: receive your script or brief, to write the narration of a faceless video from a brief and to plan its scenes
• Image and video generation services: receive the prompts derived from your script or brief, the prompt of an image or clip you ask for, and any reference image you supply or image a clip starts from, to generate images and video clips
• An image-generation service for personal actors: receives the description you write for a personal actor, to check that it does not name a real person and to draw the actor’s images
• A cloud rendering service: receives the prepared scenes and audio, to assemble the finished video

Each provider receives only what its step needs. The current list of provider names is available on request at support@dimantika.com.

Some image and video generation is processed in Asia. That provider processes what it receives in Malaysia, Indonesia, Singapore or the European Economic Area, and it may be kept there for a limited period for safety review; what its content filter flags is kept for up to 180 days in Malaysia, and its filter logs may be stored in Singapore. Please keep special categories of personal data — health, ethnic origin, religion, sex life and the like — out of a prompt or a reference image.

The image-generation provider for personal actors is in the United States. It receives the description you write for a personal actor and, for additional formats of that actor, the portrait generated earlier. It does not receive your account, your scripts or your videos. No photograph of anyone is involved at any point: a personal actor is made from text. That provider keeps no copy of what we send it or receive from it, except that each generated image stays on its storage for up to 10 minutes before it is deleted. During that time the image can be opened by anyone who has its address, which is known to the provider and to us. Processing happens in the United States under the data processing terms that provider gives us.

Providers process what we send them to perform the request, under their own terms. Where a provider offers an option to exclude our content from training, we use it.

We update this page when our providers change.

4.3 Legal Requirements

We may disclose your information if required by law or in good faith belief that such disclosure is necessary to:

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users
• Investigate potential violations of our Terms of Service

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We would publish the change on this page. We have no mailing mechanism, so we cannot promise to reach you individually before it happens.

Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy:

• Account Information: Until you delete your account, and then for as long as it remains in a database backup. Backups are kept for at least 14 days, and a copy may survive somewhat longer. The sign-up notification sent to our Telegram chat (section 4.1) is deleted there about 24 hours after it was sent
• Generated Video and Audio: The finished clip, its audio track and the intermediate files a run produces are kept for 365 days after the run finishes, then deleted from our object storage. Download what you need within that window: we keep no copy afterwards, and a link we issued earlier stops working when the file goes. Links themselves expire sooner — a download link is valid for seven days from the moment it is issued
• Personal Actor Images: The portrait of an actor you created, and the other formats made from it, are kept until you delete the actor or your account, and are then removed from our storage. The record that an image was produced and what it cost stays with your run history until the account is deleted, because your balance is built from it
• Assets: Pictures you save as assets of your account, and the ones you keep from your own generations, are kept until you delete them or your account. A deleted asset’s file is removed from our storage about a week later, or later while a legal hold applies; deleting the account removes the files at once. We keep no backup copy of them
• Support Requests: Kept in our database as long as your account; deleting the account removes the text you wrote. The notice forwarded to our Telegram chat (section 4.1) is deleted there about 24 hours after it was sent
• Payment Information: As required by law and for tax/accounting purposes (typically 7 years)
• Run Records: What was generated, when, and how many credits it cost — kept as long as your account, because your balance and history are built from them
• Logs (section 2.4): We keep no copy of our own. The lines the dashboard and the API write, and the request records the host keeps, live with our hosting provider; the logs of video generation and maintenance tasks live with the service that runs them. Each ages out under that provider’s own retention rather than by a period we set
• Visit Counts (section 2.4): We keep no copy of our own. The counts live with the web analytics provider and age out under its own retention rather than by a period we set
• Legal Holds: Information may be retained longer if required by law or legal proceedings

You can request deletion of your data at any time by contacting us. During the beta the Service has no self-service deletion control: you cannot delete the account yourself from the dashboard. We run the deletion for you and reply when it is done, within 30 days of your request. Records we are required to keep — payment and accounting records in particular — are retained for the periods stated above even after an account is closed.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information:

• Encryption: Data encryption in transit and at rest
• Access Controls: Limited access to personal information on a need-to-know basis
• Incident Response: Procedures for detecting and responding to security breaches

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for processing where consent is the legal basis

7.1 GDPR Rights (EU Users)

If you are located in the European Union, you have additional rights under the GDPR:

• Legal Basis: We process your data based on contract performance, legitimate interests, and consent
• Data protection contact: We have not appointed a Data Protection Officer. Write to support@dimantika.com for any question about how we handle your data, and we will answer it.
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority
• Automated Checks: We use automated checks to assess actor descriptions and may temporarily limit further actor creation following repeated refusals

7.2 California Residents

If you are a California resident, we extend you these rights. To use them, write to support@dimantika.com:

• Right to Know: Request disclosure of personal information collected, used, or shared
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal information)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for basic site functionality and security
• Preference Cookies: Remember your settings and preferences
• Visit Counter: On our public pages only, a script that counts visits without setting a cookie (section 2.4)

You can control cookie settings through your browser preferences. However, disabling certain cookies may affect the functionality of our Service. For more detailed information, please see our Cookie Policy.

International Data Transfers

Where your data is processed depends on the provider. Our dashboard and API are deployed to a European region of our hosting provider, and the providers listed in section 4 are established outside the European Economic Area or may process data outside it, so using the Service involves transfers abroad.

Where personal data is transferred outside the EEA, we rely on an applicable European Commission adequacy decision or the European Commission’s Standard Contractual Clauses. You can request information about the safeguards applicable to your data and a copy of the relevant safeguards at support@dimantika.com.

We do not ask for, and do not rely on, your separate consent to transfer data abroad: the transfers described here are necessary to provide the Service you asked for.

Children's Privacy

Our Service is not intended for anyone under 16 years of age, and the Terms require you to be at least 16 to hold an account. We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

We do not offer a route by which a parent or guardian can authorise a younger person to use the Service. If we learn that we have collected personal information from someone under 16, we will take steps to remove that information from our servers.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by:

• Posting the updated policy on this page
• Updating the “Last Updated” date at the top of it

We do not currently send policy notifications by email, so please check this page if the date above has changed.

Your continued use of our Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your requests within the timeframes required by applicable law, typically within 30 days.

Last Updated: 2026-11-04