Privacy Policy

Fanch Studio ("we", "us", or "our") operates the Fanch Studio platform. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our AI video creation services. We are committed to protecting your privacy and handling your data in a transparent and responsible manner.

We collect information you provide directly: account registration data (name, email, password hash), payment information (processed securely via Stripe — we never store full card numbers), project content (scripts, prompts, and creative inputs you provide), and usage preferences (language, model selection, workflow configuration). We also automatically collect: device and browser information, IP address and approximate location, usage analytics (pages visited, features used, session duration), and performance metrics (error logs, API response times).

We use your information to: provide and maintain the Fanch Studio platform, process AI generation requests and render video content, manage your account and credit balance, process payments and prevent fraud, improve our services and develop new features, send service update notifications and respond to support requests, and ensure platform security and compliance.

When you use our AI features, your prompts and creative inputs are sent to third-party AI providers (such as OpenAI, Google, and other providers configured through our model gateway) to generate content. We do not use your creative content to train AI models. Generated outputs (images, videos, audio) are stored in your account and owned by you, subject to the terms of the underlying AI providers.

We do not sell your personal data. We only share information with: payment processors (Stripe) to process transactions, AI service providers to fulfill generation requests (only the minimum necessary data is transmitted), cloud infrastructure providers for hosting and storage, and law enforcement when required by law. All third-party providers are bound by data processing agreements and are required to protect your data.

We implement industry-standard security measures, including: encryption in transit (TLS 1.3) and at rest, AES-256 encryption for API keys, secure session management via NextAuth.js, user-level concurrency controls and rate limiting, regular codebase security audits (27 automated guards), and idempotent transaction processing to prevent duplicate charges.

We retain your account data while your account remains active. Project data and generated content remain available until you delete them. Payment records are retained as required by financial regulations. You may contact our support team at any time to request deletion of your account and associated data.

Depending on your jurisdiction, you may have the right to: access the personal data we hold about you, correct inaccurate data, delete your data (right to be forgotten), export your data in a portable format, object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise any of these rights, please contact [email protected].

Your data may be processed in regions outside your country of residence. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and compliance with applicable data protection frameworks.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a prominent notice on the platform. Continued use of the service after changes constitutes acceptance of the updated policy.

For privacy-related inquiries, please contact [email protected].