Privacy Policy

EpisodeMaker AI decides what is collected on episodemaker.ai and why. Under the GDPR, that makes us the data controller. Reach us through contact@episodemaker.ai.

Your account. Email address, and — if you sign in with Google — your display name and profile picture. Nothing else from your Google account.

What you create. The ideas you type, the scripts, characters, sets and storyboards generated from them, and the video shots produced. This is the substance of the product; we cannot provide it without storing it.

Your billing record. Plan, subscription status, credit movements and invoices. We never receive your card number — it goes straight from your browser to Stripe, and our servers never touch it.

Technical logs. IP address, browser and timestamps of requests, kept by our host for security and troubleshooting.

Audience measurement. We use Google Analytics to count visits and see which pages people actually use. It sets cookies and records the pages you open, roughly where you are in the world, and what kind of device you are on. It does not receive your name, your email, or anything you write in the product.

Our host counts page views too, without cookies and without anything that identifies you — it tells us a page was opened and how fast it loaded, nothing more.

That is the extent of it. There is no advertising pixel, no remarketing tag, and nothing that follows you to other sites.

• To run the service — creating your account, storing your work, generating video, metering credits. Basis: performance of our contract with you.
• To take payment and meet our accounting obligations. Basis: contract, and legal obligation for the records we must keep.
• To keep the service safe — spotting abuse, fraudulent payments and duplicate accounts farming free credits. Basis: our legitimate interest in not being defrauded.
• To email you about your account — confirmation, receipts, failed payments. Basis: contract. These are not marketing and you cannot unsubscribe from them while you have an account.
• To understand how the site is used — which pages get read, where people stop. Basis: our legitimate interest in improving a product we are still building, and your consent where the law requires it for the cookies involved.

We do not sell your data, we do not share it with advertisers, and we do not use your scripts or videos to train AI models.

Running this service means using other companies. Each one only receives what it needs:

• Supabase — Database, authentication and file storage. Sees your account, everything you write, and your generated files.
• Vercel — Hosting and page-view counts. Sees technical request logs, and which pages are opened — without cookies.
• Stripe — Payments. Sees your name, email, billing address and card — we never see the card.
• Resend — Transactional email. Sees your email address and the messages we send you.
• Google Analytics — Audience measurement. Sees the pages you visit, your approximate location and your device.
• OpenRouter — Text and video model access. Sees the prompts sent for a generation.
• fal.ai — Video model access. Sees the prompts and reference images sent for a render.

Some of these are established in the United States, so your data may be transferred outside the European Economic Area. Those transfers rely on the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the provider is certified.

One consequence worth stating plainly: the prompts and reference images behind a render are sent to the model provider — there is no way to generate video without that. They apply their own safety filters to what they receive.

We will also disclose data if a law or a valid court order requires it, and to a buyer if the business is ever sold — in which case this policy follows the data.

Two kinds sit on this site, and they are not equivalent.

The ones that sign you in. Without them there is no session and no account — nothing to consent to, because refusing them would mean refusing to log in.

The ones Google Analytics sets to tell a returning visitor from a new one. These are not necessary to run the service. Our host's own page counting sets none at all.

You can refuse or delete them at any time from your browser settings, or install Google's opt-out extension, and everything on the site keeps working. Blocking them costs you nothing.

• Your account and your work — for as long as the account exists.
• Generated files — according to your plan's retention, shown on the pricing page. Finished episodes are kept far longer than drafts.
• After you close your account — ninety days, then deletion. That window exists so an accidental or disputed closure can be undone.
• Invoices and payment records — as long as accounting and tax law require, which is longer than the rest and not something we can shorten at request.
• Technical logs — a few weeks.

If the GDPR applies to you, you can ask us to:

• give you a copy of your data, in a portable format;
• correct anything inaccurate;
• delete your data — which means closing your account;
• restrict or object to a particular use;
• withdraw consent, where a use rests on consent.

Write to contact@episodemaker.ai. We answer within one month. There is no charge and no need to justify the request.

If our answer does not satisfy you, you can complain to your national data protection authority — in France, the CNIL. We would rather you told us first, but it is your right either way.

Data is encrypted in transit and at rest. Your files sit in private storage reachable only through short-lived signed links, and database-level rules make one account's rows unreadable to another. Payment card data never reaches our systems at all.

No system is perfect. If a breach ever affects your data, we will tell you and the competent authority within the deadlines the law sets, and we will tell you what actually happened rather than a sanitised version of it.

The service is not intended for anyone under 16. We do not knowingly collect their data, and we delete any account we discover belongs to a child.

If we change this policy in a way that matters — a new processor, a new purpose — we will email you before it takes effect. The date at the top always reflects the current version.