Privacy Policy
Last updated: 2 November 2026
1. Who is responsible
The controller is Nerqis Ltd, incorporated under the laws of the Republic of Cyprus, registration number HE487200, registered office at 7 Magdanis Street, Flat/Office 101, Kato Polemidia, 4152 Limassol, Cyprus. Questions and requests go to [email protected].
2. The short version
- Generation runs on your own provider accounts. When you generate something, your prompts and material go to the providers you connected, under your agreement with them.
- Your files are private. They open only through signed links that expire.
- No advertising. We show no ads and do not sell personal data or use it for advertising.
- No model training by us. We do not use your projects to train AI models.
3. What we collect, and why
3.1 Your account
Your email address, a hash of your password (we cannot read the password) or your Google or Apple identity if you sign in with them, your name, nickname, biography and avatar if you add them, your two-factor secret and recovery codes if you turn that on, and your sign-in sessions. One-time email codes are kept for a few minutes.
Basis: performance of the contract (art. 6(1)(b) GDPR).
3.2 Your projects
Projects, series, bibles, scripts, characters, locations, voices, shots, prompts, the images, video and audio generated or added for them, edits, translations and assembled episodes. Your use of a plan and the provider spending we work out for you are stored with them.
Basis: the contract.
3.3 Your provider keys
The API keys you add. They are encrypted before storage and cannot be read back through the Service. They are decrypted only to make the calls you ask for, such as generation and rendering.
Basis: the contract.
3.4 Subscriptions
The App Store or Google Play handles the payment, and we never see your card. We receive and keep your plan, its dates and renewal state, cancellations and refunds, the store's identifiers, and its notifications about the purchase. A keyed digest of your email address, not the address itself, records that a trial was used.
Basis: the contract, our legal duty to keep accounting records (art. 6(1)(c)), and for the digest our legitimate interest in preventing abuse of the trial (art. 6(1)(f)).
3.5 Notifications and messages to us
Your device's push token and notification settings, what we pushed to you, and what you send through the feedback form or by email.
Basis: the contract, and our legitimate interest in answering you.
3.6 Product analytics in the app
The mobile app sends PostHog events about how it is used, such as screens opened, actions taken and start-up time, with your account number, platform and app version. There is no session recording. This website and the web panel do not use analytics.
Basis: our legitimate interest in understanding and improving the app (art. 6(1)(f)). You may object: see section 8.
3.7 Errors and server records
When the app or the panel fails, we receive the error, its technical trace, the build and device details, the screen, and your account number if you are signed in. Our servers record requests with an IP address and time, and technical traces of requests and background jobs. Those traces can include prompts and answers from AI calls, so that we can diagnose failures. Passwords, keys and tokens are masked. Serious errors are sent to our private operations channel in Telegram.
Basis: our legitimate interest in a service that works, is secure and is not abused (art. 6(1)(f)).
4. What we do not ask for
Your phone number, your location or your address book. The app asks for access to your camera, microphone or photos only for a feature you use, and you can refuse. Face ID or a similar check, if used, stays on your device.
5. Who receives it
Service providers working for us, each only for its own task:
| Provider | What it does | Where |
|---|---|---|
| DigitalOcean | Servers and database | Amsterdam, the Netherlands |
| Cloudflare | File storage (R2), sending and routing email, and the network in front of our domains | EU and outside the EEA |
| PostHog | Product analytics in the app | EU |
| Google (Firebase Cloud Messaging) | Delivering push notifications | Outside the EEA |
| Apple, Google | App distribution, sign-in, push notifications and subscription payments | Outside the EEA |
| Telegram | Our private operations alerts | Outside the EEA |
Providers you connect. When you run a step, what it needs (your prompts, scripts, voices, images, audio and video) goes to the provider you added a key for: OpenRouter and the model vendor it routes to, kie.ai, ElevenLabs, fal.ai or Modal. They act under your account and your agreement with them, and may store or use the material as their own terms say, so please read them. Do not put anything into a prompt that you are not willing to send to them.
DramaMint. If you publish a series there, the episodes and their details go to DramaMint, which is run by the same company under its own terms and privacy policy.
Others. We disclose data where the law requires it or where it is needed to establish or defend a legal claim, and to a buyer of the business, who must respect this policy. Our operators can see account and billing records, and content when support, safety or a legal request needs it.
6. Transfers outside the European Economic Area
Providers marked as outside the EEA are mainly in the United States. Those transfers rely on the European Commission's standard contractual clauses or on the EU-US Data Privacy Framework where the provider is certified. Ask us for details at [email protected]. Providers you connect yourself may process data elsewhere, as their own terms say.
7. How long we keep things
| What | How long |
|---|---|
| Account, projects, files and provider keys | Until you delete them or the account |
| One-time email codes | Minutes |
| Server logs, traces and error records | A limited period, overwritten as new ones arrive |
| Trial digest | Kept after deletion, so that a trial cannot be repeated; it holds no address |
| Feedback and provider spending records | Kept after deletion with the link to your account removed |
| Backups | Removed as backups roll over on their own schedule |
| What the law requires us to keep | As long as it requires, and only that |
What deletion removes is set out in Account Deletion.
8. Your rights
You may ask for access to your data and a portable copy, correction, erasure and restriction, and you may object to processing based on our legitimate interests and withdraw any consent you gave. Write to [email protected] from your account's address. It is free, we answer within one month (we may extend that by two months for a complex request and will tell you why), and we may ask you to confirm that it is you. You can edit your profile and delete your account in the app yourself.
You may complain to a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection in Cyprus, and you may also go to the authority where you live.
9. Automated decisions
We make no decision about you by automated means that has a legal or similarly significant effect. Automated quality checks and validators look at generated media and text, not at you.
10. Children
The Service is for people aged 18 or over. If we learn that we hold the data of someone younger, we delete the account. Tell us at [email protected].
11. Security
Traffic is encrypted in transit, provider keys are encrypted before storage, and files are reached through expiring signed links. Two-factor sign-in is available, and access to production is limited. No system is perfectly secure. If a breach is likely to put people's rights at risk, we notify the Office of the Commissioner for Personal Data Protection within 72 hours and, where the risk is high, the people affected.
12. Changes
If we change how we use personal data in a way that matters, we update this policy and tell you before the change takes effect. Where it needs your consent, we ask for it.
13. Contact
Nerqis Ltd, 7 Magdanis Street, Flat/Office 101, Kato Polemidia, 4152 Limassol, Cyprus.
Privacy: [email protected]
Questions about this document?
Write to [email protected]. For anything about your own data, write to [email protected].