Privacy Policy
This page explains what we collect when you use Cnemai, why, and who else handles it. We do not sell your data and we do not track you for ads.
What we collect
- Account. Your name, email address and avatar. If you sign in with Google, these come from your Google account. If you use an email link, we keep the address we send it to.
- Studio content. What you upload (songs, reference images, footage), what you make (stills, clips, voices, sound, cuts, notes), and your Copilot conversations.
- Usage ledger. One line per take: the model, the provider, the prompt, the references used and the price. We use it to bill you and to show you what you spent.
- Technical logs. Server logs such as request times, errors and IP addresses, which we need to run and secure the service.
- Site visits, only if you allow analytics. On cnemai.com: the pages you view, the site or link that brought you (referrer and campaign tags), and your browser and device type. No cookies, and no profile of you.
- Billing. Once billing opens, Stripe handles your payment details. We see the result and basic billing details, never your full card number.
Cnemai doesn't need sensitive personal data, such as health details, government ID numbers or bank account numbers. Please keep it out of prompts, notes and uploads.
What we don't do
- No ad tracking, and no ads.
- No selling or renting of your data.
- No training of our own models on your content.
- No public access: no studio is public and there are no public share links.
Faces and voices
You can pin pictures of real people, your own face included, and work with voices. We use them only as references for the takes you ask for, sent to the model you pick. We do not build face or voice prints from them, and we do not use them to recognise or identify anyone.
Only bring a real person into your studio with their consent. The rule is in our AI & content policy.
Why we use it
We use your data to run the service you asked for, to bill you, to keep the service and your studio secure, and to answer you when you ask for help. If you allow analytics, we also use site visits to see which pages and links bring people to cnemai.com. Where a law asks for a legal basis, these are: performing our contract with you, our legitimate interest in security and support, your consent for analytics, and meeting legal duties.
Who processes it for us
These services receive data so Cnemai can work. A model provider only receives data when you, or the Copilot on your behalf, use one of its models.
| Service | What for | What data |
|---|---|---|
| DigitalOcean | Hosting, database and file storage | All account and studio data |
| Sign-in; Vertex AI models: Gemini, Nano Banana images, Gemini/Omni video, song reading | Google account name, email, avatar; prompts, reference images, footage you pin, the song | |
| Anthropic | Claude, which runs the Copilot | Chat messages, project context, tool results |
| OpenAI | GPT Image | Prompts, references |
| xAI | Grok models, only when a studio picks them | Prompts, references |
| ElevenLabs | Voices, sound effects, speech-to-text for song lyrics | Text, audio |
| BeatAPI | Model gateway serving MiniMax H3 video and Seedance | Prompts, reference frames, audio and clips |
| reinforce42 | Partner GPU service running open models (MiniMax H3, Qwen Image, gpt-oss) for some studios | Prompts, references |
| PostHog | Site analytics on cnemai.com, cookie-less, only if you allow it | Pages viewed, referrer and campaign tags, browser and device type; the IP address is hashed into a daily visitor count and dropped |
| Resend | Sign-in emails | Email address |
| Stripe | Payments, once billing opens | Billing details (we never see full card numbers) |
If you connect Claude or ChatGPT to your studio, that assistant receives the studio data its tools return, under your own agreement with Anthropic or OpenAI.
Connected assistants
If you connect Claude, ChatGPT or another assistant to your studio, we receive its requests: the instructions and files it passes along, the studio and project it is working in, and the token that shows you allowed it. We use them to check the connection is yours, to do what it asks, and to stop abuse.
What our tools send back (sheets, takes, notes, job status, file links) is then held by that assistant under your own agreement with the company that runs it. Removing the connection stops new requests. It does not delete what was already made in your studio or sent to the assistant.
Model providers and training
Where a provider offers business or API terms, we use them. Under their API terms, Anthropic, OpenAI and Google (Vertex AI) do not use API inputs to train their models.
For BeatAPI, reinforce42 and xAI, their own terms apply to the data they receive. Check the model card in the app before you send material you consider sensitive, and pick a different model if you prefer.
How long we keep it
We do not hard-delete your work. When you "delete" something in a studio, it is archived and can be restored. Your data stays while your account is open.
If you close your account and ask us to delete your data, we do so within 30 days, except what we must keep by law (for example, billing records) or for an open legal matter. Export what you want to keep first. Data already sent to a model provider is held under that provider's terms.
Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you.
- Export it, in a format you can take elsewhere.
- Correct it if it is wrong.
- Delete it, subject to what the law makes us keep.
- Object to or restrict a use of it.
If you are in California, you also have the right to know what we collect and why, and not to be treated differently for using your rights. We do not sell or share personal data for cross-context ads. If you are in the EU or UK, you may also complain to your local data protection authority.
Write to [email protected] to use any of these rights. We may need to confirm it's you before we act.
Emails
We send the emails the service needs: sign-in links, receipts, and notice of changes to these pages. If we ever send news, every one will carry an unsubscribe link.
Security
Data is encrypted in transit. Access to a studio is limited to its members. We are moving all media reads to signed URLs, so a file link only works for a short time. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.
Where your data is handled
Cnemai runs in the United States, and so do most of the services listed above. If you use it from somewhere else, your data is handled in the US, where privacy law may differ from yours.
Children
Cnemai is not for anyone under 18. We do not knowingly collect data from children. If you think a child has an account, write to us and we will close it.
Changes
If we change this policy in a way that matters, we email you at least 30 days before it takes effect, and we update the date at the top of this page.
Contact
Write to [email protected] with any privacy question.