Privacy Policy

Effective Date: May 17, 2026

Cinemaya ("Cinemaya," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Cinemaya mobile application and related services (collectively, the "Services"). By using the Services, you confirm that you have read and understood this Privacy Policy.

1. Who We Are

Cinemaya is operated from Mumbai, India. We are the data controller of your personal information for the purposes of applicable data protection laws, including the EU/UK GDPR, the California Consumer Privacy Act ("CCPA/CPRA"), and the Digital Personal Data Protection Act, 2023 ("DPDPA") of India.

For data-related inquiries, contact us at support@cinemaya.ai.

2. Information We Collect

Account Information.

Email address (received from Apple Sign In or Google Sign In)
Display name (if provided)
Authentication tokens
Account creation date and consent records (timestamp, policy version, age confirmation)

Content and Usage Data.

Prompts, scripts, and other text you submit for generation
Generated videos, images, and other AI-generated outputs
Custom characters and reference images you create
App usage patterns (features accessed, time spent, generation history)
Likes, comments, and other interactions on the explore feed

Device and Technical Data.

Device type, operating system, app version
IP address
Crash reports and performance metrics

Payment and Subscription Data.

Purchase and subscription status (received from Apple App Store or Google Play; we do not collect or store payment card details)
Credit balance and transaction history

Communications.

Correspondence with our support team and grievance officer

3. How We Use Your Information

We use your personal information to:

Provide the Services — process generation requests, manage your account, deliver content, and maintain credit balances.
Process Payments — verify and manage subscription status and credit purchases through Apple and Google.
Communicate — respond to support requests and send essential service notifications. We send marketing communications only with your separate consent.
Improve the Services — analyze usage patterns, fix bugs, and develop new features.
Ensure Safety — detect, prevent, and respond to violations of our Terms of Use, fraud, abuse, and security incidents.
Comply with Law — meet legal obligations, respond to lawful requests, and enforce our agreements.

We do not use your prompts, uploaded content, or AI-generated outputs to train artificial intelligence models. Your content is processed solely to deliver the Services to you.

4. Legal Bases for Processing (EEA, UK, Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data under the following legal bases:

Performance of a Contract — to provide the Services you have requested.
Legitimate Interests — for service improvement, security, fraud prevention, and analytics, balanced against your rights.
Consent — for marketing communications and certain optional features; you may withdraw consent at any time.
Legal Obligation — to comply with applicable laws.

5. How We Share Information

We do not sell your personal information. We share information only as follows:

Service Providers (Subprocessors). We engage trusted third-party providers to operate the Services. Current subprocessors include:
- Supabase — authentication and database hosting
- Google Cloud Platform — application hosting and infrastructure
- Replicate, Runway, Luma, Kling, MiniMax, Google, Anthropic, OpenAI and similar AI providers — AI inference processing
- RevenueCat — subscription management
- Google Analytics — usage analytics (configured in a service-provider capacity; Google Signals and advertising features disabled)
- Firebase (Google) — mobile analytics SDK, crash reporting, and related services that feed into Google Analytics
- AppsFlyer — mobile attribution and install analytics (configured in a service-provider capacity)
- Apple and Google — payment processing for in-app purchases
Legal and Safety. We may disclose information if required by law, court order, governmental request, or to protect the rights, property, or safety of Cinemaya, our users, or others.
Business Transfers. In the event of a merger, acquisition, or sale of substantially all assets, your information may be transferred to the successor entity, subject to this Privacy Policy.
With Your Consent. We may share information in other circumstances with your explicit consent.

6. International Data Transfers

We are based in India. Your information may be transferred to and processed in India, the United States, the European Union, or other countries where our service providers operate. These countries may have data protection laws different from your country of residence.

Where required, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, or equivalent mechanisms.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy:

Account data — retained while your account is active; deleted within thirty (30) days after account closure.
User Content — retained while present in your account; deleted within thirty (30) days after you remove it or close your account.
Transaction records — retained for up to seven (7) years to comply with tax, accounting, and financial regulations.
Consent and security logs — retained for up to three (3) years for legal defense and security investigation purposes.
Anonymized analytics data — may be retained indefinitely in aggregated form that does not identify you.

8. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

Encryption in transit (TLS) and at rest;
Access controls and multi-factor authentication for our systems;
Regular security reviews;
Limited employee and contractor access on a need-to-know basis.

No system is perfectly secure. While we take security seriously, we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a personal data breach affecting your information, we will notify the relevant regulatory authorities and affected users as required by applicable law. Where GDPR applies, we will notify the competent supervisory authority within seventy-two (72) hours of becoming aware of the breach where required.

10. Children's Privacy

The Services are intended exclusively for users aged eighteen (18) and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will delete it and terminate the account. If you believe we may have collected such information, please contact us at support@cinemaya.ai.

11. User Content Ownership and Visibility

You retain ownership of the prompts, scripts, custom characters, and other content you submit, as well as the AI outputs you generate, subject to the rights and licenses of the underlying AI models and the licenses described in our Terms of Use.

Visibility. Generated content is set to Public by default. Public content appears on the in-app explore feed and may be used by Cinemaya for marketing and promotional purposes as described in our Terms of Use. Paid subscribers may change the visibility of their content to Private; Private content is visible only to you, does not appear on the explore feed, and is not used for marketing or AI model training.

12. Your Privacy Rights

Depending on where you reside, you may have the following rights:

Access — request a copy of the personal information we hold about you.
Correction — request correction of inaccurate or incomplete information.
Deletion — request deletion of your personal information (subject to legal retention requirements).
Restriction — request that we limit how we process your information.
Portability — receive your information in a structured, machine-readable format.
Objection — object to certain processing, including processing based on legitimate interests or for direct marketing.
Withdrawal of Consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
Complaint — lodge a complaint with the supervisory authority in your jurisdiction.

To exercise these rights, contact us at support@cinemaya.ai. We will respond within the timeframes required by applicable law. We may request information to verify your identity before fulfilling requests. We do not discriminate against users who exercise their privacy rights.

13. Region-Specific Disclosures

European Economic Area, United Kingdom, and Switzerland. You have the rights described in Section 12. You may lodge a complaint with your local data protection authority. If required, our EU/UK representative will be appointed and identified here.

California Residents (CCPA/CPRA).

We collect the categories of personal information listed in Section 2 (identifiers, commercial information, internet/network activity, device information, user-generated content, and inferences drawn from this information).
We collect this information from you, your device, and our service providers.
We use it for the business purposes described in Section 3.
We do not sell or share personal information as defined under the CCPA/CPRA. We do not engage in cross-context behavioral advertising.
You have the right to know, delete, correct, and limit the use of sensitive personal information. To exercise these rights, contact support@cinemaya.ai.

India (DPDPA 2023).

We process your personal data in accordance with the Digital Personal Data Protection Act, 2023.
You have rights of access, correction, completion, updating, erasure, grievance redressal, and nomination as provided under the Act.
Contact our grievance officer (Section 17) for any data protection concerns.

14. Cookies and Analytics

We use limited cookies and similar technologies for essential functions and analytics. Please see our Cookies Policy for details.

We use Google Analytics configured as a service provider. Google Signals, advertising features, and ads personalization are disabled. We do not use cookies or trackers for advertising purposes.

15. Account Deletion

You can delete your account at any time through the in-app Settings menu or by contacting support@cinemaya.ai. Account deletion will remove your personal information, User Content, and account data within thirty (30) days, except where retention is required by law or for legitimate business purposes (such as tax recordkeeping, fraud prevention, or legal defense).

16. Third-Party Services

The Services may link to or integrate with third-party services (such as social platforms for sharing your generated content). Their privacy practices are governed by their own policies, which we encourage you to review.

17. Grievance Officer (India)

In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDPA 2023:

Name: Regan Crasto Designation: Grievance Officer Email: support@cinemaya.ai

Grievances will be acknowledged within twenty-four (24) hours and resolved within fifteen (15) days of receipt.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through in-app notice or email at least thirty (30) days before they take effect, except where shorter notice is required by law or for security reasons. The "Effective Date" at the top reflects the latest revision.

19. Contact

For questions, requests, or complaints regarding this Privacy Policy, please contact:

Email: support@cinemaya.ai