Privacy Policy

This Privacy Policy explains how Paul Lenyn Cuao Alcántara, doing business as ScenorAI ("we", "us"), collects, uses, shares, and protects information when you use the ScenorAI website, applications, and services (the "Service").

We are the data controller for personal data processed in connection with the Service. Contact us at [email protected] for any privacy-related question.

1. Information We Collect

1.1 Information you provide

• Account information. When you sign in with Google, we receive your name, email address, and profile picture.
• User Content. Topics, custom scripts, configuration choices, and any audio file you upload to be used as a voice track.
• Communications. Messages you send to support or via in-product forms.

1.2 Information collected automatically

• Usage data. Pages visited, features used, generation jobs and their parameters, credit balances, and timestamps.
• Device and log data. IP address, browser type, operating system, referrer URL, and similar diagnostic information.
• Cookies and similar technologies. Used to keep you signed in, remember preferences, and operate the Service. We do not use third-party advertising cookies.

1.3 Information from third parties

Our Merchant of Record processes your payment and shares with us limited transaction data (plan, last four card digits, country, transaction status). We do not receive or store full payment card numbers.

2. How We Use Information

We use the information we collect to:

• Operate, maintain, and improve the Service;
• Generate the videos you request and deliver the output to you;
• Manage your account, credits, subscriptions, and billing;
• Communicate with you about the Service, updates, and security;
• Detect, prevent, and address fraud, abuse, or technical issues;
• Comply with legal obligations and enforce our Terms.

3. Legal Bases (GDPR)

Where the GDPR applies, we process personal data on the following bases: performance of a contract (operating the Service you signed up for), legitimate interests (security, fraud prevention, product improvement), legal obligations, and consent where required (e.g., certain marketing communications).

4. Sharing and Disclosure

We share information only as necessary to operate the Service:

• AI providers (OpenAI, OpenRouter, ElevenLabs, Fal.ai) receive the inputs needed to generate scripts, voice, and visuals. They process this data under their own terms and privacy policies.
• Hosting and storage. Application infrastructure runs on Hetzner Cloud (servers in the European Union). Generated videos and assets are stored on Cloudflare R2.
• Authentication. Google handles sign-in via OAuth (basic scopes only: email, profile, openid).
• Third-party publishing platforms (user-initiated). If you choose to publish a generated video to YouTube, Instagram or TikTok, you authorize us through the platform's own OAuth flow to upload on your behalf. We store only the access tokens needed to publish and revoke them when you disconnect the integration. We do not access these accounts beyond what each integration explicitly requires for publishing.
• Notifications. Transactional emails are delivered through Novu and its underlying email providers.
• Payments. Our Merchant of Record processes purchases and handles tax compliance.
• Legal and safety. We may disclose information when required by law or to protect rights, safety, or the integrity of the Service.
• Successors. If we are involved in a merger, acquisition, or asset sale, information may be transferred subject to this Policy.

We do not sell your personal data.

5. International Transfers

Your data may be processed in countries other than your own, including the European Union and the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

6. Retention

Generated videos and intermediate assets are retained for up to 30 days from creation. Account records (profile, transaction history, audit logs) are kept for as long as your account is active and afterwards as required for legal, accounting, or security purposes. We delete or anonymize data when it is no longer needed.

7. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent. To exercise any right, write to [email protected]. You also have the right to lodge a complaint with your local data-protection authority.

8. Security

We use industry-standard safeguards including encrypted transport (HTTPS), access-controlled databases, secret management, and regular backups. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the appropriate authorities as required by law.

9. Children

The Service is intended for users 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via email or through the Service. The "Effective date" above indicates when this Policy was last revised.

11. Contact

Privacy questions: [email protected]
General support: [email protected]
Operator: Paul Lenyn Cuao Alcántara, Bogotá, Colombia.