Introduction
DIMANTIKA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, a company registered in Gdańsk, Poland (“Dimantika,” “we,” “us,” or “our”), is the controller of your personal data. We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Clipwright, our UGC video generation service.
By using our Service, you consent to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.
We are established in the European Union, so the General Data Protection Regulation governs how we handle your data. Section 7.2 lists rights we extend to California residents; whether the California Consumer Privacy Act applies to us has not been assessed.
🛡️ Privacy Compliance Statement
🇪🇺 Your GDPR rights
We are established in the European Union and handle your data under the General Data Protection Regulation. These are the rights we honour on request:
- ✓ Lawful basis for data processing
- ✓ Right to access, rectify, and delete data
- ✓ Data portability and objection rights
- ✓ Right to complain to a supervisory authority
🇺🇸 California residents
Whether the California Consumer Privacy Act applies to us has not been assessed. We honour these rights for California residents regardless:
- ✓ Right to know what data we collect
- ✓ Right to delete personal information
- ✓ Right to opt-out of data sales (we don’t sell data)
- ✓ Non-discrimination for exercising rights
Data protection requests: support@dimantika.com
Information We Collect
We collect several types of information from and about users of our Service:
2.1 Personal Information
- Account Information: Email address, name, and authentication credentials
- Profile Information: Optional profile details you choose to provide
- Generation Input: the script you write, the description of the person you want on camera, and any image, b-roll or other reference URL you submit for a run
- Contact Information: When you contact our support team
2.2 Payment Information
- Billing Details: Name, billing address, and payment method information
- Transaction History: Records of your credit purchases and payment history
- Note: Payment processing is handled by Stripe; we do not store full payment card details
2.3 Usage Information
- Service Usage: Generation runs, credits consumed, usage frequency
- Run Records: what each run asked for, whether it succeeded or failed, and the video it produced
- Preferences: Whether the dashboard sidebar is open. Your light or dark theme is kept in your browser and is not sent to us.
2.4 Technical Information
We run no analytics of our own. We do not track which pages you view and we do not build a profile of your behaviour. This paragraph and the two that follow are about what our code writes; the provider hosting the Service keeps its own record of the requests that reach it, described further down.
When something on our side fails or looks wrong, our server writes a line about it to its own console, which is kept by the provider hosting the dashboard. These lines are about operations, not a record of the pages you visit: a payment we could not process, a key we could not issue, a check on your session that did not succeed, an attempt to open an admin page without the rights for it. A line usually names the operation and may carry the account, the payment or the run involved; some carry none of these. We do not promise a fixed set of fields, and some lines are written not by us but by the libraries we use, in whatever shape they choose.
Where the failure came from another system — our payment provider or our database — we generally record that system’s error report as it reached us, rather than a summary of it. Such a report is structured, and beyond a message it can include the details that system chose to return: identifiers for the failed request, the response it sent us and, depending on what failed, the email address or the stored record the operation touched. We never write your password or the secret half of an API key ourselves. We do not hold that secret either: an API key is stored as a one-way hash, next to its first few characters, which are kept so you can tell your keys apart and are the only part of it we can show you again. What we cannot promise on behalf of those other systems is that nothing sensitive ever appears inside a report they hand us; where it does, it is kept for as long as the line that carries it (see section 5).
We do not write down your ordinary successful actions in production. A line can still appear for an operation that completed, when something about it was not as expected — a payment we credited to you but could not match to its payment record, for instance. We read these lines only to find out why something broke.
A few places write to your browser’s console instead, when something goes wrong on the page — those messages stay on your machine and never reach us.
The pipeline that renders your videos does write operational logs, to the service that runs it. They cover the run — its stages, timings and any failure — and our own spend accounting, and we use them to find out why a render went wrong or why a limit stopped one. The same service runs our scheduled maintenance, such as database backups, and those jobs log there too; those lines report on our own infrastructure — which job ran, how large the result was, what went wrong — rather than on you.
What remains is inherent to reaching a server over the internet. Whichever provider hosts the part of the Service your browser is talking to receives that request, and with it your IP address, the time of the request and what your browser reports about itself. That is the hosting provider for the page or the API you called, and it keeps its own operational record of those requests — successful ones included — under its own terms rather than ours. Most of the providers listed in section 4 are ones we call on your behalf, and they see what we send them rather than your browser. Two are different, because your browser goes to them directly: Stripe, when you pay — the checkout page is Stripe’s own — and Cloudflare R2, when you open or download a finished video, since the link we give you points at the storage itself. Both receive your request as any site you visit would. Each provider processes what it receives as part of delivering and securing its own platform, under its own terms. We do not combine any of it with your account or use it to profile you.
The cookies this site sets are listed in our Cookie Policy. There is no advertising or tracking cookie among them.
How We Use Information
We use the collected information for the following purposes:
3.1 Service Provision
- Provide and maintain the Clipwright video generation service
- Process your generation requests through our providers
- Manage your account, credit balance, and API keys
- Store your generation history and the resulting video files
3.2 Communication
- Respond to your inquiries and support requests
- Send transactional email that the Service itself requires — account confirmation when you register, and password reset — delivered by our authentication provider. Signing in itself sends no email.
3.3 Service Improvement
- Monitor service performance and reliability
- Develop new generation features and provider integrations
3.4 Legal and Security
- Comply with legal obligations and regulations
- Protect against fraud, abuse, and security threats
- Enforce our Terms of Service
- Resolve disputes and investigate violations
Information Sharing and Disclosure
We do not sell, trade, or otherwise transfer your personal information to third parties except as described below:
4.1 Service Providers
These are the providers that process your personal data on our behalf, as of the date at the top of this page:
- Stripe: payment processing, invoicing and tax calculation. Stripe receives your email address, billing address, payment details and our internal account identifier, which is how a payment is matched to your balance. If you buy as a business and enter a VAT identification number, Stripe receives that too. We never receive or store your card number.
- Supabase: authentication and the application database — your account, credit balance and run history.
- Cloudflare R2: storage of everything a run produces — the finished video, the audio track, word-level timings and provider job identifiers — and of database backups. When you open a finished video, your browser fetches it from R2 directly, so R2 also sees that request itself (see section 2.4).
- Trigger.dev: runs the generation pipeline. It receives the full request you sent, including your script, together with the run and account identifiers. It also runs our scheduled database backups, which means a copy of the database — and so of your account data — passes through it on the way to storage.
- Railway: hosting for the dashboard and the API, which includes keeping the failure logs described in section 2.4.
We also send ourselves operational alerts through Telegram. They come from our scheduled maintenance and monitoring jobs — database backups, vendor balance and spend checks, the queue depth, the job that deletes finished video once its retention period is over — and they are sent when something needs our attention or, once a day, as a summary. They carry counts, thresholds and amounts. They never carry your scripts, your images or your video, and they are never used to contact you.
Support requests are different. When you write to us through the support form in your dashboard, a copy of the request is forwarded to us through Telegram so that we see it quickly. That copy carries the text you wrote (shortened if it is long), the email addresses associated with your account, your account identifier, the run you attached and its warnings, and the time you wrote. Telegram is only how the request reaches us; we do not use it to reply to you. The message stays in our Telegram chat until we delete it by hand: nothing removes it on a schedule. When we delete your account at your request (see Data Retention), we also remove the text and the addresses from the copy kept in our own database, but a message already delivered to Telegram is not recalled.
4.2 Third-Party Generation Providers
Producing a video requires sending the material you submit to specialist providers:
- ElevenLabs: synthesis of the voice track from your script
- HeyGen: generation of the presenter or avatar video
- fal.ai: the check we run on the description of a personal actor, and the generation of that actor’s images
What each receives differs. ElevenLabs receives the text of your script, because it synthesises the voice from it, together with the identifier of the voice you chose. HeyGen receives the resulting audio file and the image of the presenter, the resolution and aspect ratio, and our internal run identifier — but not the script text. These three are the generation providers we use today. We encourage you to review their privacy policies.
fal.ai receives the words you wrote for a personal actor, and it receives them twice: once as the description itself, for the check that refuses a description naming a real person, and once inside the prompt we build from it for the image. Asking for a second format of an actor also sends the portrait we generated earlier, because the new image is an edit of that portrait. It does not receive your account, your scripts or your videos. No photograph of anyone is involved at any point: a personal actor is made from text.
Two things about that provider are worth stating plainly, because they are ours to keep true rather than properties of their service. We switch off payload storage with a header we send on every call, so no copy of what we send or receive is kept there; were we to stop sending it, this sentence would stop being true, and we would have to change it. Each generated image sits on their content storage for up to 10 minutes so that our renderer can fetch it, and expires there afterwards. For that window the image can be opened by anyone who has its address, which is known to them and to us.
The models behind fal.ai belong to other companies, and fal.ai is the route to them rather than the destination: the description goes on to OpenRouter and Anthropic for the check, and the images are produced at OpenAI. Processing happens in the United States under the data processing terms fal.ai gives us, which exclude training on the content we send.
If we add or change a provider, we update this page. Nothing in the Service enforces that ordering, so please treat the list as accurate as of the date at the top rather than as a guarantee about tomorrow.
4.3 Legal Requirements
We may disclose your information if required by law or in good faith belief that such disclosure is necessary to:
- Comply with legal processes or government requests
- Protect our rights, property, or safety
- Protect the rights, property, or safety of our users
- Investigate potential violations of our Terms of Service
4.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We would publish the change on this page. We have no mailing mechanism, so we cannot promise to reach you individually before it happens.
Data Retention
We retain your information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy:
- Account Information: Until you delete your account, and then for as long as it remains in a database backup. Backups are pruned on a schedule and kept for at least 14 days, so in practice a copy survives a little longer than that — and longer still if a pruning run fails
- Generated Video and Audio: The finished clip, its audio track and the intermediate files a run produces are kept for 30 days after the run finishes, then deleted from our object storage. Download what you need within that window: we keep no copy afterwards, and a link we issued earlier stops working when the file goes. Links themselves expire sooner — a download link is valid for seven days from the moment it is issued
- Personal Actor Images: The portrait of an actor you created, and the other formats made from it, are kept until you delete the actor or your account. Our cleanup job then removes the files from our storage. The record that an image was produced and what it cost stays with your run history until the account is deleted, because your balance is built from it
- Support Requests: Kept in our database as long as your account; deleting the account removes the text you wrote. The copy forwarded to our Telegram chat (section 4.1) stays there until we delete it by hand, including after your account is deleted
- Payment Information: As required by law and for tax/accounting purposes (typically 7 years)
- Run Records: What was generated, when, and how many credits it cost — kept as long as your account, because your balance and history are built from them
- Logs (section 2.4): We keep no copy of our own, and they do not all sit in one place. The lines the dashboard and the API write, and the request records the host keeps, live with our hosting provider; the logs of the jobs we run outside it — rendering your videos, and scheduled maintenance such as our database backups — live with the service that runs those jobs. Each ages out under that provider’s own retention, governed by our plan with them rather than by a period we set
- Legal Holds: Information may be retained longer if required by law or legal proceedings
You can request deletion of your data at any time by contacting us. During the beta the Service has no self-service deletion control: you cannot delete the account yourself from the dashboard. We run the deletion for you and reply when it is done, within 30 days of your request. Records we are required to keep — payment and accounting records in particular — are retained for the periods stated above even after an account is closed.
Data Security
We implement appropriate technical and organizational security measures to protect your personal information:
- Encryption: Data encryption in transit and at rest
- Access Controls: Limited access to personal information on a need-to-know basis
- Incident Response: Procedures for detecting and responding to security breaches
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.
Your Privacy Rights
Depending on your location, you may have the following rights regarding your personal information:
- Access: Request access to your personal information
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information
- Portability: Request a copy of your data in a portable format
- Restriction: Request restriction of processing in certain circumstances
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent for processing where consent is the legal basis
7.1 GDPR Rights (EU Users)
If you are located in the European Union, you have additional rights under the GDPR:
- Legal Basis: We process your data based on contract performance, legitimate interests, and consent
- Data protection contact: We have not appointed a Data Protection Officer. Write to support@dimantika.com for any question about how we handle your data, and we will answer it.
- Supervisory Authority: You have the right to lodge a complaint with your local data protection authority
- Automated Decision-Making: We do not engage in automated decision-making that significantly affects you
7.2 California Residents
We have not assessed whether the California Consumer Privacy Act applies to us. If you are a California resident, we extend you these rights regardless:
- Right to Know: Request disclosure of personal information collected, used, or shared
- Right to Delete: Request deletion of personal information
- Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal information)
- Right to Non-Discrimination: Not be discriminated against for exercising your rights
Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience:
- Essential Cookies: Required for basic site functionality and security
- Preference Cookies: Remember your settings and preferences
You can control cookie settings through your browser preferences. However, disabling certain cookies may affect the functionality of our Service. For more detailed information, please see our Cookie Policy.
International Data Transfers
Where your data is processed depends on the provider. Our dashboard and API are deployed to a European region of our hosting provider, and the providers listed in section 4 are established outside the European Economic Area or may process data outside it, so using the Service involves transfers abroad.
For those transfers we rely on the data protection terms of each provider, which include the European Commission’s Standard Contractual Clauses or an adequacy decision where one applies. We have not yet published which mechanism applies to which provider. Documenting that provider by provider is part of the legal review of this Service, and until it is done we would rather say so than list mechanisms we have not confirmed. Write to us at the address in section 12 if you need the detail before then.
We do not ask for, and do not rely on, your separate consent to transfer data abroad: the transfers described here are necessary to provide the Service you asked for.
Children's Privacy
Our Service is not intended for anyone under 16 years of age, and the Terms require you to be at least 16 to hold an account. We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.
We do not offer a route by which a parent or guardian can authorise a younger person to use the Service. If we learn that we have collected personal information from someone under 16, we will take steps to remove that information from our servers.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by:
- Posting the updated policy on this page
- Updating the “Last Updated” date at the top of it
We do not currently send policy notifications by email, so please check this page if the date above has changed.
Your continued use of our Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
This Privacy Policy is effective as of 2026-09-17. We reserve the right to modify this policy at any time, so please review it frequently.