Privacy Policy

Who we are

Colomred AI Video Studio ("Colomred", "we") is operated by [company legal name], [registered address]. We are the data controller for the personal data described on this page, and you can reach us about any of it at [support email].

What we collect

• Account data. Your name, your email address and a password we store only as a hash.
• Production content. The ideas, titles, scripts, prompts, images and audio you submit or generate, and the masters the renderer produces from them.
• Provider credentials. The API keys you connect. These are sealed at rest with AES-256-GCM and are never shown back to you in full.
• Usage and technical data. Which engines a production used, generation and token counts, error records, your IP address, your browser and the times you signed in.
• Billing data. Your plan and its status. Card details are held by our payment processor, not by us.

How we use it

We use this data to create and render your productions, to keep your account and workspace working, to enforce plan limits and rate guardrails, to send you transactional messages such as a password reset or a finished render, to detect abuse, and to meet our legal and accounting obligations.

We do not sell your personal data, and we do not use your production content or your prompts to train models of our own.

Your API keys

A provider key is used only to make the calls a production needs, on your instruction. Keys are encrypted at rest, kept out of the logs and never returned to the browser after you save them.

Cookies

We set a small number of strictly necessary cookies — your session, your language and your theme. The cookie policy lists them exactly. We set no advertising or cross-site tracking cookies.

Who we share it with

• Model providers. Your prompts and reference images are sent to the provider you selected for that asset, so that it can generate the result.
• Infrastructure. The hosting, database, object storage, email delivery and payment providers that run the service for us.
• Authorities. Where we are legally required to disclose, and only as far as the law requires.

Every processor is bound by contract to use the data only for the service we bought from them.

How long we keep it

Account data is kept while your account is open, and afterwards for as long as we must keep records. Production content and renders are kept until you delete them or close your account. Encrypted keys are deleted when you remove them. Backups roll off on a fixed schedule.

Security

Passwords are hashed, provider keys are encrypted, sessions are signed and carry an expiry, and administrative actions are written to an audit log. No system is perfect: if a breach affects your rights we will tell you, and the competent authority, as the law requires.

International transfers

We and our processors may store data outside your country. Where data leaves the EEA or the United Kingdom we rely on an adequacy decision or on standard contractual clauses.

Your rights

Depending on where you live, you may have the right to be told what we hold, to receive a copy, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time. Write to [support email] and we will answer within the period the law allows. You may also complain to your local data protection authority.

Children

The service is a professional tool and is not directed at children. We do not knowingly hold data about anyone under 16.

Changes to this policy

We may update this policy as the service changes. The date at the top of the page is when it last changed, and a material change is announced in the app or by email.

Contact

Questions about this policy, or a request about your data: [support email].