1. Who We Are
Genematic ("Genematic", "we", "us", or "our") operates the website https://genematic.ai, optional progressive web features, and native companion apps for iOS and Android (collectively, the "Service"). The iOS and Android apps load our website in a secure in-app browser shell and add native features such as push notifications, camera access, and deep links. Genematic is an AI-powered media generation platform that allows users to create videos and images using state-of-the-art AI models.
The Service is operated by Genematic Ltd, a private limited company registered in England and Wales (Company No. 17150072), registered office: 10 Sheppard Street, Swindon, England, SN1 5DB.
For questions about this Privacy Policy, contact us at support@genematic.ai.
2. Information We Collect
2.1 Information You Provide Directly
- Account credentials: email address and password when you register with email/password authentication.
- Display name and profile photo: set by you in account settings.
- Payment information: token top-up transactions (amounts, timestamps). Purchases in companion apps are completed on the website, not via App Store or Google Play billing. We do not store raw payment card data — payments are processed by third-party payment providers.
- Prompts and inputs: text, image, and other inputs you submit to generate AI content.
- Generated content: AI-generated videos and images produced through the Service that you choose to save or share.
- Public profile and Community Feed: display name, username, bio, profile photo, and any generation you explicitly mark as shared, plus comments and reactions you post on public content.
- Reports and notices: information you submit when reporting content or sending a legal notice (see /legal/report).
- Communications: messages you send to our support team.
2.2 Information from OAuth / Social Login Providers
When you sign in using a third-party provider, we receive information permitted by your account settings with that provider:
- Google Sign-In: name, email address, and profile picture from your Google account.
- Sign in with Apple: name (first-time only, at your discretion) and email address or Apple-generated relay address. Apple may provide a private relay email address if you choose "Hide My Email."
- Facebook Login: name, email address, and profile picture from your Facebook account. Also used as the underlying authentication mechanism for "Continue with Instagram" on our sign-in screen.
- TikTok Login Kit: TikTok Open ID, display name, and profile picture. TikTok does not provide an email address; we create an internal placeholder identifier solely to maintain your account.
We do not receive or store your social provider passwords. OAuth access tokens received from providers (where applicable) are stored encrypted and used solely to maintain your session and, where explicitly requested, to perform actions on your behalf.
2.3 Information Collected Automatically
- Usage data: pages visited, features used, generation history, timestamps.
- Device and browser data: browser type, operating system, device identifiers, IP address, and referrer URL.
- Cookies and session tokens: HTTP-only session cookies used for authentication. On the website, optional analytics and marketing technologies may set additional cookies or local storage entries when you grant consent (see section 6). The native companion apps do not load third-party advertising pixels.
- Push notification tokens: if you grant permission, we store a device token to deliver push notifications — browser web-push subscription data on the website, and Apple Push Notification service (APNs) / Firebase Cloud Messaging (FCM) tokens for the iOS and Android companion apps.
3. How We Use Your Information
We use the information we collect to:
- Create and manage your account and authenticate your identity.
- Provide, operate, and improve the Service.
- Process your AI generation requests and deliver results to you.
- Manage your token balance, process top-up transactions, and maintain billing records.
- Send transactional notifications (generation completed, balance updates) and, with your consent, push notifications.
- Operate the referral programme and credit earnings to referring users.
- Respond to support enquiries and resolve disputes.
- Detect and prevent fraud, abuse, and violations of our Terms of Service and Community Guidelines, including notice-and-action under the EU Digital Services Act and the UK Online Safety Act.
- Operate the Community Feed, public profiles, search-engine indexing of public posts, and (where you opted in) featuring of public posts on our marketing site.
- Comply with legal obligations, including IP notices and illegal-content orders.
Legal Bases for Processing (GDPR)
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data on the following legal bases:
- Contract performance: processing necessary to provide the Service you have requested (account creation, generation delivery, billing), including product updates and promotional emails sent to users who have started a $1 trial, as described in our Terms of Service.
- Legitimate interests: fraud prevention, security, product improvement, operating the referral programme, moderating User Content, defending legal claims, and keeping a limited record of removed posts — where these interests are not overridden by your rights.
- Consent: push notifications and optional marketing communications for users who have not started a paid trial or subscription. You may withdraw consent at any time.
- Legal obligation: compliance with applicable laws.
4. How We Share Your Information
We do not sell your personal information. We share data only as described below:
4.1 Service Providers and Sub-processors
We engage the following third parties to operate the Service. Each processes data only on our instructions and under appropriate data processing agreements:
- Supabase, Inc. — database, authentication, and file storage. Privacy Policy
- Vercel, Inc. — hosting and serverless infrastructure. Privacy Policy
- Fal.ai, Inc. — AI model inference for image and video generation. Prompts and input media you submit are transmitted to Fal.ai for processing. Privacy Policy
- OpenAI, LLC — AI-assisted features (e.g. prompt enhancement). Privacy Policy
- BunnyWay d.o.o. (Bunny.net / Bunny Stream) — video CDN and streaming delivery. Privacy Policy
- Stripe, Inc. — card payments, subscriptions, and billing portal. Privacy Policy
- Google LLC — Google Sign-In OAuth, Google Analytics / Tag Manager on the website (with consent where required). Privacy Policy
- Meta Platforms, Inc. — Facebook Login OAuth and, on the website with marketing consent, Meta advertising measurement (Meta Pixel). Privacy Policy
- PostHog, Inc. — product analytics on the website and in the companion apps after analytics consent, plus strictly necessary production error diagnostics without session replay or form/input contents. Privacy Policy
- Google Firebase (Google LLC) — delivery of push notifications to iOS and Android companion apps via FCM. Privacy information
4.2 Other Disclosures
- Legal requirements: we may disclose information if required by law, court order, or governmental authority, or to protect the rights, safety, or property of Genematic, our users, or the public.
- Business transfers: in connection with a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
- Community Feed and public profiles: content you explicitly mark as shared (opt-in) is visible to other users and may be indexed by search engines, cached by CDNs, embedded in link previews, and shown on our landing/marketing surfaces as described in the Terms. Your display name, username, and profile picture are shown alongside publicly shared content. Unpublishing does not guarantee deletion of copies already held by third parties.
- People depicted in your posts: if you publish another person's face, voice, or other identifier, you must have a lawful basis. That person may contact legal@genematic.ai to request restriction or erasure of the public post. We may unpublish without deciding the underlying dispute.
5. Data Retention
We retain your personal data for as long as your account is active or as necessary to provide the Service. Specifically:
- Account data (email, display name, profile picture) — retained until you request deletion.
- Generated content — retained until you delete it or request account deletion. Public posts may remain in backups, CDN caches, legal holds, and search-engine indexes for a limited period after you unpublish (typically up to 90 days for operational backups; longer if required by law or an active dispute).
- Moderation and notice records — retained as needed to handle repeat-infringer tracking, DSA/UK OSA accountability, and legal defence.
- Billing and transaction records — retained for 7 years for accounting and legal compliance.
- Push notification tokens — retained until you unsubscribe or the subscription expires.
- Server logs — retained for up to 90 days.
After account deletion, we may retain anonymised aggregate data (e.g. usage statistics) indefinitely, as this cannot be linked back to you.
6. Cookies and Tracking Technologies
We use the following cookies and browser storage:
- Authentication session cookies (HTTP-only, Secure): set by Supabase SSR to maintain your login session. These are strictly necessary and cannot be disabled without breaking the Service.
- Referral code storage (localStorage): stores your referral code locally for automatic application during registration.
- CCP affiliate click mark (cookie + localStorage, up to 14 days): when you open a creator affiliate link to the dashboard, we may store a first-visit timestamp and creator code so we can attribute a later signup within 14 days and calculate the creator's 10% top-up commission window.
- OAuth state and PKCE cookies (HTTP-only, Secure, 10-minute TTL): used during the TikTok OAuth flow to prevent CSRF attacks.
- Cookie consent preferences (localStorage + cookie): records your choices for analytics and marketing categories.
- Analytics and marketing (website only, opt-in): with your consent, we may load Google Tag Manager / Google Analytics, Meta Pixel, Reddit Pixel, and PostHog to measure product usage and advertising performance. You can change your choice anytime via Cookie preferences in the site footer.
- Essential error diagnostics: when the website or an API crashes, we may send PostHog the error type, stack trace, page path without query parameters, timestamp, and release context. We do not include form values, prompts, session replay, or advertising identifiers in these diagnostic reports.
- Companion apps: the iOS and Android apps do not load Meta, Reddit, or Google advertising tags. Product analytics (PostHog) runs only if you accept the analytics category in cookie preferences.
We do not sell your personal information. We do not use fingerprinting technologies. We do not link app activity to third-party advertising networks in the native companion apps.
7. International Data Transfers
Our service providers operate in the United States and the European Union. If you are located in the EEA or UK, your data may be transferred to countries that do not have the same data protection laws as your home country. Where required, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- The EU–US Data Privacy Framework (where applicable).
8. Your Rights
8.1 Rights for EEA / UK Users (GDPR)
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion of your personal data, subject to legal retention requirements.
- Restriction — request that we restrict processing of your data in certain circumstances.
- Data portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent (e.g. push notifications), withdraw it at any time without affecting lawfulness of prior processing.
To exercise these rights, email support@genematic.ai. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g. your national data protection authority).
8.2 Rights for California Residents (CCPA / CPRA)
California residents have the right to:
- Know what personal information we collect, use, disclose, and sell (we do not sell personal information).
- Delete personal information we have collected, subject to certain exceptions.
- Correct inaccurate personal information.
- Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
- Non-discrimination — we will not discriminate against you for exercising your privacy rights.
To submit a California privacy request, email support@genematic.ai with the subject line "California Privacy Request."
8.3 Account Deletion
Step-by-step instructions (including in-app and email options) are on our User data & account deletion page. You may also email support@genematic.ai. Note that billing records are retained as required by law. Token balances are non-refundable upon deletion.
9. Children's Privacy
The Service is not directed to children under the age of 13 (or 16 where required by applicable law, including in the EEA). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately and we will take steps to delete such information.
10. Security
We implement industry-standard technical and organisational measures to protect your personal data, including:
- TLS encryption for all data in transit.
- Encryption at rest for database contents.
- HTTP-only, Secure, SameSite session cookies.
- Row Level Security (RLS) policies so users can only access their own data.
- PKCE and state parameters for all OAuth flows.
- Service role keys never exposed to the client.
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
11. AI-Generated Content and Inputs
Prompts, images, and other inputs you submit to generate content are transmitted to our AI model providers (Fal.ai, OpenAI) for processing. Please review their respective privacy policies regarding how they handle inference inputs. We recommend you do not include sensitive personal data (e.g. government ID numbers, health information) in generation prompts.
AI-generated outputs are stored in your account. Content you share publicly on the Community Feed is visible to other users and may be indexed by search engines. You are solely responsible for Inputs and Outputs, including personal data of third parties that you choose to generate or publish. Genematic hosts public posts as a technical intermediary as described in the Terms of Service.
Prohibited subject matter: As described in our Terms of Service, you must not request generations involving NSFW / 18+ adult content, politics, violence, or “dangerous” subject matter.
Responsibility for generations: You are solely and exclusively responsible for your prompts, uploads, and the AI outputs produced from your account. Genematic processes requests on your behalf as a technical intermediary and does not assume liability for user-generated content or for your compliance with law or third-party rights.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with a new effective date and, where appropriate, by email. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
