Your workspace content is private by default. We process it to provide the tools you choose, and share the relevant information with the providers needed to run them.
Business locationNicosia, Cyprus
Include your account email and any relevant payment or job reference.
Never send passwords, full card numbers or card security codes.
About this policy
This policy applies to the MotionLoot website, accounts, workspaces and creative tools. MotionLoot is responsible for the personal information it processes to operate these services. Our business location appears above.
If you use a workspace managed by another person or organization, its administrators also control membership and the content shared within that workspace.
Information we collect
We collect information you provide, information created through your use of MotionLoot, and information supplied by our payment and service providers. This includes:
- Account and workspace information: your email address, display name, account identifier, workspace names, memberships, roles and invitations.
- Creative content: prompts, uploaded artwork and reference files, characters, project settings, generated images and videos, and edits.
- Billing records: subscriptions, invoices, payment references, credit balances and transactions. Stripe processes payment details; the MotionLoot application database does not store full card numbers or card security codes.
- Technical and usage information: IP addresses, browser and device information, sign-in events, generation status, error logs and records needed to secure and operate the service.
- Communications: information you send when asking for help, reporting an issue or exercising your rights.
How and why we use information
Where data-protection law requires a legal basis, we rely on the basis appropriate to the activity:
- Contract: creating accounts, providing workspaces and creative tools, processing requested generations, delivering purchases, and handling service and billing enquiries.
- Legitimate interests: keeping the service secure and reliable, preventing fraud and abuse, diagnosing errors and resolving disputes. We consider these interests alongside your rights and reasonable expectations.
- Legal obligations: maintaining required transaction records and responding to lawful requests.
- Consent: optional processing for which consent is required. We explain that use separately, and you can withdraw consent without affecting earlier lawful processing.
Your creative content and AI processing
When you request an AI feature, the relevant prompt, references and project context are sent to the provider supporting that feature. The provider returns generated content and processing information so we can deliver the result and account for usage.
MotionLoot does not train its own AI models on your private workspace content. External providers process requests under their applicable terms and agreements, and their retention and processing practices can differ by service. Only upload content and personal information you have permission to use in this way.
Creating or uploading content does not automatically publish it in a public gallery or give MotionLoot permission to use your private work in advertising. Workspace members can access shared content according to their permissions.
Service providers
We use the following providers to operate MotionLoot. The information involved depends on the feature you use:
- Supabase — account authentication and database services.
- Railway — website hosting and background processing.
- Cloudflare — storage of uploaded and generated media through R2, and aggregate website traffic and performance measurement through Web Analytics.
- Upstash — generation queues and request-rate controls.
- OpenAI — creative planning and prompt assistance.
- BytePlus — supported image and video generation.
- Stripe — checkout, subscriptions, payment processing and billing records.
- Resend — delivery of account emails through our authentication service.
Website analytics
We use Cloudflare Web Analytics to understand page visits, referring websites, visitor countries, browser and device types, and page performance. Cloudflare does not use analytics cookies, browser storage or fingerprinting to identify individual visitors, and does not log URL query strings for this service.
We do not attach your name, email address, account identity, prompts or uploaded content to analytics events. This integration does not record sessions or form entries. We skip the analytics script when your browser sends a Do Not Track or Global Privacy Control preference.
Optional advertising measurement
Where enabled, we ask before using optional Meta advertising measurement. If you allow it, our server sends Meta visits to the homepage and pricing page, completed registrations, opened checkout sessions and confirmed purchases, including purchase value and currency. We send browser and advertising-click identifiers, browser information and a public page address. We do not send your email address, prompts, artwork, private project addresses, authentication codes or payment-card details through this integration.
Meta may use these events to attribute activity to Facebook and Instagram ads and improve advertising delivery, under its privacy policy. Our integration uses server events rather than loading the Meta Pixel script on your workspace. Server events respect the same consent choice as the website.
Choose Reject optional to continue without this measurement. Use Privacy choices to change or withdraw your permission at any time. Withdrawal stops future measurement and removes our advertising identifier cookies; it does not recall events already shared. We also keep optional measurement off when your browser sends Global Privacy Control or Do Not Track.
Your consent preference is stored for up to 180 days. Optional browser and advertising-click identifier cookies are stored for up to 90 days. Meta applies its own retention rules to events it receives.
Retention and deletion
We retain account and workspace information for as long as needed to provide the service and meet the purposes described in this policy. Retention depends on whether the account remains active, whether information is needed for a transaction or unresolved dispute, and applicable legal record-keeping requirements.
You can delete eligible media in the Asset library. Files referenced by a project may need to be detached first. Contact us to request account closure or deletion of personal information; we may need to verify your identity and your authority over a shared workspace.
Some billing, security and legal records may be retained after closure where necessary for those purposes. Deletion from active systems does not necessarily remove every backup copy immediately. Provider-held records and backups are subject to their retention processes and applicable legal requirements.
International processing
Our service providers may process information in countries outside your country of residence, including outside the European Economic Area. Data-protection rules may differ between countries.
International transfers are subject to applicable data-protection requirements. The relevant transfer mechanism depends on the provider and destination, and may include an adequacy decision or contractual safeguards. Contact us for information about the arrangements applicable to your data and how to obtain details of relevant safeguards.
Security
We use authenticated access, workspace permissions and other technical controls to help protect information against unauthorized access and misuse. No online service can guarantee absolute security. Keep your credentials private and only invite people you trust into your workspace.
Your privacy rights
Depending on applicable law, you may request access to your personal information, correction, deletion, restriction of processing or a portable copy. You may object to processing based on legitimate interests and withdraw consent where consent is the basis. These rights are subject to the conditions and exceptions in the relevant law.
Privacy requests may require information necessary to verify your identity. Where the GDPR applies, we normally respond within one month of receiving a request; if a permitted extension is needed, we will explain why within that period.
You may complain to a data-protection authority, including the authority where you live or work. In Cyprus, this is the Commissioner for Personal Data Protection.
Age requirements and policy updates
MotionLoot is intended for adults who can enter into a binding agreement. It is not directed at children. Contact us if you believe a child has provided personal information so we can investigate.
We update this policy when our information practices change. The date above identifies the current version. We provide additional notice of material changes where required by law.