Privacy Policy

This policy explains what Space Studios collects when you use the studio, why, who else processes it, and what you can do about it. It is written to be read, not to be impenetrable.

1. What we collect

• Account data. Your email address and an encrypted password hash, or — if you sign in with Google — the email address and basic profile details Google returns. We never see your Google password.
• Profile data. The display name and profile picture you choose, and the setup answers you give during onboarding (such as what you are here to make).
• Content you create and upload. Scripts, story notes, character and location sheets, uploaded reference photos, product photos, prompts, and the images, video clips and voice audio the studio generates for you.
• Usage and billing-meter data. Credit charges and refunds, which model ran, generation status, timestamps, and error messages when a render fails.
• Technical data. Standard server and security logs, including IP address, browser type and request times, used to keep the service running and to prevent abuse.

We do not ask for and do not want special-category data (health, biometric identifiers, political or religious beliefs). Please do not upload reference photos of other people without their permission, and do not upload anyone's identity documents.

2. Why we use it

• to give you an account and keep it secure;
• to run the generations you ask for and show you your library and history;
• to keep reference identity consistent across shots (this is what the Canon does);
• to meter credits, apply refunds when a render fails, and show your usage;
• to detect abuse, enforce the acceptable-use rules, and comply with law;
• to send service email — verification, password resets and important notices.

Where the GDPR applies, our legal bases are performing our contract with you (running the studio), our legitimate interests (security, abuse prevention, product reliability), and legal obligation.

3. Who processes your data

We use a small number of processors, and generation genuinely requires sending your input to model providers.

• Supabase — our database, authentication and file storage provider. Your account record, profile, story data, credit ledger, uploaded reference photos and generated files are stored there.
• AI model providers — the image, video, language and voice models the studio runs on, reached through Lovable's AI gateway. When you generate something, the prompt, any reference or product images you attached, and any voice or script text are transmitted to the provider that runs the chosen model so it can produce the result. Each provider processes that input under its own terms and retention rules.
• Hosting and email infrastructure — to serve the application and deliver verification and password-reset messages.
• Google — only if you choose Google sign-in, for authentication.

These providers operate in several countries, including the United States, so your data may be transferred internationally with appropriate safeguards. We do not sell your data, and we do not use your private content to advertise to you.

4. Demo and marketing content

The preview clips and images on our public pages are made with synthetic, generic subjects created for that purpose. We do not use your uploads, your characters or your generated work in our marketing without asking you first.

5. How long we keep things

Account, profile, story and generated content are kept while your account is active, so your library and continuity references stay usable. Ask us to close your account and we delete your account record and stored content within 30 days, except where we must retain something to comply with law or resolve a dispute. Security logs are kept for a short period. Anything already sent to a model provider is also subject to that provider's retention policy.

6. Security

Data is encrypted in transit, passwords are stored only as hashes, and access to your rows and files is enforced at the database and storage layer so one account cannot read another's content. Uploaded files are served through expiring signed links. No system is perfectly secure; if a breach affects you we will notify you as required by law.

7. Your choices and rights

You can edit your display name and picture, delete individual generations and library items, and export finished work at any time. Depending on where you live you also have the right to access, correct, delete or receive a copy of your data, to object to certain processing, and to complain to your data protection authority. To exercise any of these, email support@spacestudios.app from your account address and we will action it.

8. Cookies and local storage

We use only what the product needs: a session cookie/token so you stay signed in, and browser local storage for preferences such as your last opened board and view mode. We do not run third-party advertising trackers.

9. Children

The studio is not for children under 16, and we do not knowingly collect their data.

10. Changes and contact

We will update this page and its date when our practices change. Questions, requests or complaints: support@spacestudios.app. See also our Terms of Service.