Privacy Policy

1. Identity and Contact Details

The data controller for onira.studio (“Onira,” “we,” “us”) is Biel Carpi, based in Spain.

• Email: hello@onira.studio
• Website: onira.studio

For any privacy-related questions or requests, please contact us at the email address above.

2. Scope and Applicability

This Privacy Policy applies to the website at onira.studio, the Onira web application, and all related services (collectively, the “Service”). It does not apply to third-party websites or services linked from Onira.

3. Data We Collect

3.1 Data You Provide

• Account information — name, email address, and password when you create an account.
• Prompts and creative instructions — the text prompts, scripts, mood selections, and other inputs you submit to generate videos.
• Payment information — billing details processed through our payment processor (Stripe). We do not store your full credit card number.
• Support communications — messages and feedback you send us.

3.2 Data Collected Automatically

• Device and browser data — IP address, browser type, operating system, screen resolution, and device identifiers.
• Usage data — pages visited, features used, session duration, clicks, and interaction patterns.
• Cookies and similar technologies — see Section 12 and our Cookie Policy.
• Analytics data — collected via Google Analytics (GA4) to understand how the Service is used.

3.3 Data from Third Parties

If you sign in using a third-party provider (e.g., Google), we receive basic profile information (name, email, profile picture) as authorised by you. We may also receive payment confirmation data from Stripe.

4. How We Use Your Data

• Service delivery — to process your prompts through our AI pipeline and deliver generated videos.
• Account management — to create and maintain your account, manage subscriptions, and process payments.
• Communication — to send you launch updates, product announcements, and service notifications. You can opt out of marketing emails at any time.
• Analytics and improvement — to understand usage patterns, diagnose technical issues, and improve the Service.
• Security and fraud prevention — to protect against abuse, spam, and unauthorized access, including via rate limiting and access controls.
• Legal compliance — to comply with applicable laws, regulations, and legal processes.

5. Legal Bases for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Contract performance (Art. 6(1)(b)) — processing your prompts to deliver the video generation service, managing your account, and processing payments.
• Consent (Art. 6(1)(a)) — sending marketing emails and placing non-essential cookies.
• Legitimate interest (Art. 6(1)(f)) — analytics to improve the Service, fraud prevention, and securing our infrastructure.
• Legal obligation (Art. 6(1)(c)) — retaining billing records as required by Spanish tax law.

6. AI Processing and Third-Party AI Models

Onira is an AI video production platform. When you submit a prompt, your text instructions are sent to third-party AI models to generate scripts, narration, images, music, and video. The following providers may process your data:

Your prompts are sent to these providers on a pass-through basis solely to generate the requested content. We do not control how these providers process data beyond our contractual agreements with them. We encourage you to review their privacy policies.

7. No AI Model Training on Your Data

We do not use your prompts, scripts, or generated videos to train AI models. Onira uses third-party AI models and does not develop or train its own foundation models. Your creative inputs are used solely to deliver the service you requested. Note that third-party AI providers may have their own data usage policies — please refer to their privacy policies linked in Section 6.

8. Data Sharing and Recipients

We do not sell your personal data. We may share data with the following categories of recipients:

• AI model providers — as described in Section 6, to generate content.
• Payment processor — Stripe, to process subscriptions and payments.
• Analytics services — Google Analytics (GA4), to understand usage patterns.
• Hosting and infrastructure — Vercel and cloud providers that host the Service.
• Legal and regulatory — when required by law, court order, or to protect our rights.

9. International Data Transfers

Onira is based in Spain (EU). Some of our service providers, including AI model providers, are based in the United States and other countries outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including:

• The EU-U.S. Data Privacy Framework, where the recipient is certified.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission for specific countries.

10. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Account data — retained for the duration of your account plus 30 days after deletion.
• Prompts and creative inputs — retained for 90 days, then automatically deleted.
• Generated videos — available for download during your active subscription. Deleted 30 days after account closure.
• Payment and billing records — retained as required by Spanish tax law (up to 5 years).
• Analytics data — retained for up to 26 months via Google Analytics.

11. Your Rights Under GDPR

If you are in the European Economic Area, you have the following rights regarding your personal data:

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data (“right to be forgotten”).
• Right to restriction of processing — request that we limit how we process your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making — Onira does not make automated decisions with legal or similarly significant effects about you.

To exercise any of these rights, contact us at hello@onira.studio. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es, or with your local supervisory authority.

12. California Consumer Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know — request information about the categories and specific pieces of personal data we collect, use, and disclose.
• Right to delete — request deletion of your personal data.
• Right to correct — request correction of inaccurate personal data.
• Right to opt out of sale or sharing — we do not sell or share your personal data for cross-context behavioral advertising.
• Right to non-discrimination — we will not discriminate against you for exercising these rights.

To exercise your CCPA/CPRA rights, contact us at hello@onira.studio.

13. Children's Privacy

Onira is not directed at anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at hello@onira.studio and we will delete the data promptly.

14. Cookies and Tracking Technologies

We use cookies and similar technologies (including localStorage) to operate the Service, remember your preferences, and analyse usage. For a complete list of cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

15. Data Security

We implement industry-standard security measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS) for all data transmitted between your browser and our servers.
• Encrypted API connections to all third-party AI providers.
• Access controls limiting who can access personal data within our organisation.
• Regular security reviews of our infrastructure and code.

However, no method of electronic transmission or storage is 100% secure. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and will notify affected individuals without undue delay where the breach poses a high risk to their rights.

16. EU AI Act Transparency Disclosure

In accordance with the EU Artificial Intelligence Act (Regulation 2024/1689), we disclose the following:

• Onira uses artificial intelligence systems to generate video content, including scripts, narration, images, music, and video footage.
• All content produced by Onira is AI-generated. Videos created through the Service are synthetic media.
• Users who publish AI-generated content may be required to label it as AI-generated under applicable laws and platform policies, including YouTube's AI disclosure requirements.

17. Third-Party Links

The Service may contain links to third-party websites and services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data.

18. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. The “Effective date” at the top of this page indicates when this version was last updated. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

19. Contact Us

If you have questions about this Privacy Policy, your personal data, or wish to exercise your rights, contact us at:

• Email: hello@onira.studio