Your data, kept in Europe.

• We collect what we need to make your videos and run your account, nothing to sell.
• Your account, brand kits and videos are stored in the European Union, in Frankfurt (Germany).
• No advertising pixels in your browser, and analytics cookies only if you allow them. If you allow ad measurement, we tell Meta and X when you sign up, leave your email for launch news or buy, with your email hashed, so we can see which of our ads work. Without your consent, nothing is sent.
• We do not sell or rent personal data, and we do not train AI models on your content.
• You can get a copy of your data or have it deleted at any time.

loudscene is run by BLM GROUP SRL (CUI 51672006, Trade Register J2025028942008), Str. Dionisie cel Mic 53C, Bl. 50A, Sc. D, Et. 3, Ap. 52, 900355 Constanța, Romania, the controller for account, billing and website data. For content your business customers upload about their own customers (for example names in a testimonial video), the customer is the controller and we process it on their behalf under the Data processing agreement. Contact: contact@loudscene.com.

• Account: email, name, profile picture from Google, GitHub or X if you sign in with them, a wallet address if you sign in with one. To run your account (contract).
• Your content: the websites you paste, what we extract from them (colours, fonts, logos, text, screenshots), briefs, uploads, videos and comments. To make and host your videos (contract).
• Billing: your plan and your payments. loudscene is paid in crypto from your own wallet, so for each payment we keep the wallet address it came from, the transaction hash, the asset and the amount. Transactions on a public blockchain such as Robinhood Chain are public and permanent: anyone can see them, and neither we nor you can delete them (contract, legal obligations).
• Referrals: the referral code you arrived with, stored in a cookie for 90 days, and whether you became a paying customer, so creators can be paid (legitimate interest).
• Previews without an account: a salted hash of your IP address and a device cookie, to limit free previews per day. Raw IP addresses are not stored (legitimate interest: preventing abuse).
• Downloading a preview: the email you give us on /try, to send you the file. We keep it with the download until a day after the link goes out (8 days at most), with a salted hash of your IP address to limit downloads per day (your request; legitimate interest: preventing abuse). Only if you tick the box does the address also join our list for launch news and new templates, and we remember which preview you made so we can remind you before it expires (a day after you made it, and on its last day), until you unsubscribe or the preview expires (consent).
• Emails while you get started: when you create an account we send a few short emails that help you use it, for example a reminder to make your first video or to export it. Every one has an unsubscribe link, and unsubscribing stops them; sign-in links and receipts still arrive (legitimate interest: helping you use the service you signed up for).
• Review links: the name a guest types and their comments, visible to the team that shared the link (contract with that team).
• Integrations you connect: for the Telegram bot, your Telegram user id and the messages you send it; for the GitHub App, the repositories you pick and their release notes and pull request titles. To make videos from them (contract).
• Community sentiment for the agent: if you add the agent to a Telegram group, it keeps the text of plain group messages; if you link an X account, it keeps the text of recent public posts that mention it. Both are stored without their authors, with handles, links and email addresses removed, and deleted after 2 days. We use them only to measure how your community feels and to alert your team when the mood turns sharply negative; you can turn those alerts off in the agent settings (contract with the workspace that set up the agent).
• Ad measurement, only with your consent: when you sign up, leave your email for launch news or buy a plan or credit pack, our server sends Meta and X (Twitter) a conversion event: the kind of event, the time, the page, a SHA-256 hash of your email (and, for Meta, of your account id), and (for sign-ups and launch-news sign-ups) your IP address, browser user agent and the platform's click id if you arrived from one of our ads. Purchases also include the amount. Meta and X use it to tell us which ads led to sign-ups and sales. We ask once on our marketing pages ("Allow" or "No thanks"); without "Allow", nothing is sent (consent).
• Technical logs: errors and request metadata kept for up to 30 days for security and debugging (legitimate interest).

Our database and file storage, where your account, brand kits and videos are kept, run in the EU (Frankfurt, Germany). The website and API are served by Vercel and videos are rendered on Railway; they handle data while a page loads or a video renders, and part of that happens outside the EU, as it does for some other sub-processors below. Whenever personal data leaves the EU we rely on the EU Standard Contractual Clauses or an adequacy decision (such as the EU-US Data Privacy Framework).

• Supabase: database, sign-in and file storage (EU, Frankfurt).
• Vercel: the website and API (a global edge network; server functions in the EU, Frankfurt).
• Railway: render workers that turn your videos into files.
• Anthropic: the AI that writes scripts and animation code from your brief and site text, reads the community sample above for the agent, and looks at frames of clips you upload to find their best moments.
• ElevenLabs: voice-over, only when you ask for one.
• Sume: AI footage, only when you ask for a clip. A router in front of AI video models: it receives the clip's prompt and, if you pick one, the image the clip starts from, passes them to the video model that makes the clip (Kling AI by default) and keeps the image and the finished clip on its own storage.
• Kling AI (Kuaishou): the video model behind AI footage, through Sume or, as our fallback, directly; it receives the clip's prompt and, if you pick one, the image the clip starts from (processed in Singapore when we use it directly).
• Pexels and Pixabay: free stock footage, only when you ask for a stock clip. They receive two or three search words taken from the clip's description, never your name, your account or your images.
• Hostinger: email hosting; sign-in, notification and reminder emails are sent through it.
• hCaptcha (Intuition Machines): bot protection on the sign-in and sign-up pages; it receives your IP address and details of your browser and how you use the page.
• Google: website analytics (Google Analytics), with cookies only if you allow them.
• Meta: measuring our ads, only if you allow it (hashed email and the conversion events above).
• X (Twitter): measuring our ads, only if you allow it (hashed email and the conversion events above).
• GitHub: only if you install the GitHub App, which reads release notes and pull request titles of the repositories you pick.
• Telegram: only if you link the Telegram bot, which receives your messages and sends you your videos.

We use cookies the service needs: your session, your current workspace, the referral code you arrived with (90 days), the preview limit on /try, and view counts on share pages (one day). On our marketing pages we ask one question, about analytics and ad measurement. Until you choose "Allow", Google Analytics runs without cookies and sends only anonymous pings, and nothing goes to Meta or X. If you allow it, Google sets its analytics cookies (_ga) for up to two years, and if you arrived from one of our Meta or X ads we keep its click id in a first-party cookie (_fbc for Meta, 90 days; ls_twclid for X, 30 days), so a later sign-up or purchase can be matched to that ad; and we note where your first visit came from (the campaign tags in the link, or the site that linked to us) in ls_src for 30 days, saved with your account if you sign up, so we know which channels bring people. Only loudscene reads it. We load no advertising pixels or scripts. Your choice is kept in your browser and in a cookie (ls_consent, one year) so our server can respect it; you can change it by clearing site data, which also removes _fbc, ls_twclid and ls_src. On the sign-in page your browser also remembers which sign-in method you used last, to mark it for you; that stays on your device and is never sent to us.

Only what you choose: a share link shows its video and your display name to anyone who has the link; the gallery shows videos you opted in, with your display name and avatar. The Creators leaderboard shows your display name only if you opt in. You can undo any of these at any time.

• Account and content: while your account exists. Deleted videos are removed from storage within 30 days, and from any backups within 90.
• Previews made without an account: deleted after 7 days unless you create an account to keep them.
• Invoices and payout records: as long as tax law requires (up to 10 years).

You can access, correct, export or delete your personal data, object to processing based on legitimate interest, and restrict processing. Your profile and workspaces can be changed or deleted in Settings; for a copy of your data, deleting your account or anything else, write to contact@loudscene.com and we answer within 30 days.

You can also complain to your data protection authority; in Romania that is the ANSPDCP.

Access to data is limited per workspace by row-level security in the database. API keys are stored only as hashes; connector credentials are encrypted. Generated animation code runs in a sandbox with no network access, and brand extraction refuses private network addresses. If a breach affects you, we will tell you and the authority within the time the GDPR requires.

We will announce material changes to this policy by email and in the app at least 30 days before they apply.