This Privacy Policy explains how personal data is processed when you use Actora at https://actorastudio.com, in line with the EU General Data Protection Regulation (GDPR). The rules for using the service, payments and refunds are in our Terms of Service.
1. Who is responsible for your data
The controller of your personal data is:
- Ahmet Utlu, individual seller (a natural person, not a company), resident in Poland
- Email: [email protected]
- Postal address: available on request by email
We have not appointed a data protection officer. For any privacy question, email us at the address above.
2. What data we collect
- Account data: your email address, name or brand name, and your password. Passwords are stored only as a salted PBKDF2 hash, never in plain text.
- Google Sign-In: if you sign in with Google, we receive your Google email address and name.
- Product information and uploads: product descriptions, website URLs and the content we read from them, and files you upload (for example images, screen recordings, or the recording for a Custom AI Twin).
- Generated content: the scripts and videos you generate, and your generation history.
- Connected social accounts: if you connect Instagram, Facebook or TikTok, we store the account IDs, account names and the access (OAuth) tokens needed to publish on your behalf.
- Payment data: payments are processed by Stripe. We receive information such as your Stripe customer ID, plan, amounts, dates and payment status. We never see your full card number.
- Support messages: the emails you send us and our replies.
- Technical logs: IP address, browser user agent, and the date and time of requests.
- Consent records: your acceptance of the Terms and your request for immediate supply at checkout (see Terms, section 7), with timestamp and IP address.
3. Why we use your data and on what legal basis
- Providing the service (account, script and video generation, Autopilot publishing to your connected accounts, service emails, support): necessary to perform our contract with you, Art. 6(1)(b) GDPR.
- Payments, invoices/receipts and accounting records: contract, and compliance with legal obligations under Polish tax and accounting law, Art. 6(1)(b) and (c) GDPR.
- Recording your checkout consent and confirming it by email: compliance with consumer law obligations, Art. 6(1)(c) GDPR, and our legitimate interest in being able to prove it, Art. 6(1)(f) GDPR.
- Security, fraud and abuse prevention, handling chargebacks, and establishing or defending legal claims (including technical logs, generation history and consent records): our legitimate interests, Art. 6(1)(f) GDPR.
- Custom AI Twin: the face and voice in the recording you send are processed only to create and run your own Twin, based on your explicit consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR (insofar as they qualify as biometric data). You can withdraw this consent at any time; we then delete the Twin.
- Where we ask for your consent for something specific, the legal basis is your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time.
You need to give us the data marked as required (for example your email) to create an account and use the service. Everything else is optional.
4. Service providers and other recipients
We use the following providers to run Actora. They process data on our behalf or, where stated, as independent controllers under their own privacy policies:
- Stripe (payments, checkout and subscription management; US/EU).
- Google: Gemini API to generate scripts from your product information (we use the paid API, under which Google does not use your inputs to train its models); Google Sign-In; and Gmail to send our emails. Our website fonts are hosted on our own server, so no data is sent to Google when you visit the site.
- fal.ai (AI video and lip-sync rendering; USA).
- Microsoft (text-to-speech service that turns the script text into the voice). Only the script text is sent, not your account data.
- Meta (Instagram/Facebook), only if you connect an account, to publish your videos.
- TikTok, only if you connect an account, to publish your videos.
- Cloudflare (content delivery network and proxy; all traffic to the website passes through it).
- Contabo (server hosting in the European Union).
We may also disclose data to authorities or courts where the law requires it.
5. Transfers outside the EU/EEA
Some providers (for example Stripe, Google, fal.ai, Microsoft, Meta, TikTok and Cloudflare) may process data in the United States or other countries outside the EU/EEA. Such transfers are based on an adequacy decision, in particular the EU-US Data Privacy Framework where the recipient is certified under it, or on the European Commission's Standard Contractual Clauses (SCCs). You can ask us for more information about these safeguards by email.
6. How long we keep your data
- Generated videos: 30 days, then deleted automatically.
- Uploaded files: 24 hours.
- Custom AI Twin: the raw recording is deleted after the Twin is delivered (at the latest after 30 days); the Twin itself is kept while your account exists, or until you withdraw consent or ask us to delete it.
- Account data (including scripts, generation history and connected-account tokens): while your account exists, and up to 30 days after you ask us to delete it. Tokens for a social account are deleted when you disconnect it.
- Payment records: 5 years, as required by Polish accounting and tax rules.
- Consent records: until the limitation period for claims related to the purchase has expired.
- Support messages: up to 2 years.
- Technical logs (IP address, browser, request logs): up to 90 days, unless needed longer to investigate a specific security incident or payment dispute.
7. Your rights
Under the GDPR you have the right to:
- access your data and get a copy;
- have incorrect data corrected (rectification);
- have your data deleted (erasure);
- restrict processing;
- receive your data in a portable format (data portability);
- object to processing based on our legitimate interests;
- withdraw any consent you gave, at any time, without affecting processing that happened before.
To use these rights, email [email protected]. We may need to confirm your identity first.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also contact the data protection authority in your country of residence.
8. Cookies and browser storage
Actora does not use advertising or analytics cookies. We only use strictly necessary browser storage (localStorage) to keep you signed in (session token) and to remember your language and interface preferences. Because this storage is strictly necessary for the service you request, no consent banner is required.
Stripe Checkout and Google Sign-In run on their own pages and set their own cookies there, under their own privacy policies.
9. Security
Connections to Actora are encrypted with HTTPS. Passwords are stored as salted PBKDF2 hashes. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
10. Automated decisions, AI and children
- We use AI to generate scripts and videos from the information you provide. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
- Actora is not intended for children under 16, and we do not knowingly collect their data.
11. Changes to this policy
We may update this Privacy Policy when our service or the law changes. The current version and its date are always shown at the top of this page. We will inform subscribers about material changes by email.