Last updated: [DATE]
This policy explains what personal data hars.ai ([COMPANY LEGAL NAME], [REGISTERED ADDRESS]) collects, why, who we share it with and the choices you have.
We do not sell your personal data and do not use your content to train AI models. Legal bases (where GDPR applies): contract (running the service), legitimate interests (security, fraud prevention, product improvement), legal obligation (tax and accounting records) and consent (optional marketing emails).
We share data only with providers that help us run the service, under contracts that limit their use of it:
We may disclose data if required by law, to protect rights and safety, or as part of a merger or acquisition (with notice to you).
Some providers process data outside your country, including in the United States. Where required we rely on appropriate safeguards such as standard contractual clauses. [Lawyer to confirm for your markets.]
We use strictly necessary cookies to keep you signed in and secure your session. We do not use advertising, tracking or analytics cookies, which is why there is no cookie banner: strictly necessary cookies don't need one. If we ever add analytics, we will update this policy and ask for your consent first where the law requires it.
Data is encrypted in transit, passwords are hashed, access is limited to what staff need, and the code the AI writes for your film runs in an isolated sandbox. No system is perfectly secure; we will notify you and regulators of a personal data breach where the law requires.
Depending on where you live (for example under the GDPR, the UK GDPR, India's Digital Personal Data Protection Act 2023 or US state laws), you may have the right to access, correct, delete or port your data, to object to or restrict processing, to withdraw consent, and to complain to a regulator. You can delete your account yourself; for anything else email [PRIVACY EMAIL]. We respond within the time the law requires.
The service is for adults (18+). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
We will post changes here and notify you of material changes by email.
Data controller: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Privacy contact: [PRIVACY EMAIL]. Grievance officer (India): [NAME], [EMAIL]. EU/UK representative: [IF REQUIRED].