Privacy Policy
Last updated: 25 October 2026
Version 2026-10-25
1. Who is responsible for your data
TOKEN FLOW INFORMATION TECHNOLOGY CONSULTING - L.L.C - S.P.C, trade licence CN-6184552, Abu Dhabi - Al Reem Island, P.O. Box 25573, is responsible for the personal data described in this policy (the "controller"). It runs dramagic: the website at dramagic.studio and the invite-only studio. This policy is written to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and to the principles of the EU and UK GDPR. You can reach us about anything in it at support@dramagic.studio.
2. What we collect
- Account. Your email address and country, your role, and the optional billing details you choose to give (legal name, address, tax number).
- Waitlist and invitation. The email address you gave to join the waitlist, and whether it was approved.
- Sign-in. We send you a one-time link by email. Your signed-in session is kept in your browser; we do not store passwords.
- Your agreement records. Which version of each policy you accepted, when, and the IP address you accepted from; and, for real-person portraits, which likeness confirmation you made and when.
- Your content. Premises, scripts, prompts, reference images, portrait photos and anything else you upload or type ("User Content"), and the storyboards, images, video and exports generated from it.
- Generation records. For each generation: its purpose, the model used, its settings, status, credits estimated and charged, timestamps, and the identifiers and usage figures the AI provider reports back.
- Credit and payment records. Credits granted, held, charged and released. When payments are live: orders, invoices and payment status. Card details are handled by our payment provider, not by us.
- Messages and reports. What you send us in feedback, support emails and reports.
- Technical data. Our server logs record request identifiers, your user identifier, your IP address and basic request details. Logs do not carry email addresses or the text of your prompts.
We do not run third-party analytics or advertising trackers, and we do not sell your personal data.
3. Why we use it, and our legal bases
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create your account, sign you in, generate, store and export your content, and keep your credit balance | Account, content, generation records, credit records | Performing our contract with you |
| Use a real person's portrait as a reference for generation | Portrait photo, likeness confirmation | Your consent through the likeness confirmation, and the contract |
| Send sign-in links, invitations and service messages | Email address | Performing our contract; our legitimate interest in running the service |
| Keep the service secure, stop abuse, apply rate limits and spend limits, enforce the Acceptable Use Policy and look into reports | IP address, logs, account records, content that is reported or flagged | Our legitimate interests in security and in protecting others |
| Understand cost and reliability, fix faults, and plan capacity | Generation records, logs, counts | Our legitimate interests in running the service well |
| Take payments, issue invoices, handle refunds and disputes (when live) | Billing and payment records | Performing our contract; legal obligation |
| Keep records the law requires (tax, accounting) and answer lawful requests | Credit and payment records, agreement records | Legal obligation |
We do not send marketing email. If we ever do, we will ask for your consent first.
4. Portraits and real people
When you register a portrait of a real person, the photo is sent to the AI provider's asset library so the video model can use that person as a reference. Before we accept it, you confirm that you are that person or that you have the right to use their likeness. We keep a record of that confirmation. We do not run our own facial recognition or face-matching on portraits. The provider's model necessarily processes the face in the image to produce video; how long the provider keeps the registered portrait is set by its own terms. If you delete your account, we remove your registered portraits from the provider's asset library as part of carrying out the deletion. A face can be sensitive personal data; if you upload someone else's, make sure they know and agree. To report misuse of a person's likeness, email support@dramagic.studio.
5. Who else handles your data
We use the providers below to run dramagic. They handle personal data on our behalf and only for the purposes shown. We require data-protection terms from them.
| Provider | What it does for us | Personal data it handles | Where data is processed |
|---|---|---|---|
| Fly.io | Runs our API and the background workers that generate and export your content. | Everything that passes through the API: account details, content, generation requests. | Singapore |
| Supabase | Database (accounts, content records, credit records) and sign-in. | Your email address, country, account and content records, credit records, policy acceptances. | Singapore (ap-southeast-1) |
| Cloudflare | DNS, and R2 object storage for the images, video and exports you upload or generate. | Your uploaded and generated media; connection data (IP address) for DNS and network traffic; emails you send to our support address, which it forwards to our mailbox. | R2: Cloudflare chooses the storage location, which may be outside the United Arab Emirates. DNS: global network. |
| Vercel | Hosts and serves the website and the studio front end. | Request data such as your IP address and browser details. | United States (Washington, D.C. region) for server-side functions; pages are served from a global edge network |
| BytePlus ModelArk | AI generation of text, images and video, and the asset library where portraits are registered. | Your prompts and scripts, reference images, portrait photos, and the media generated from them. | Southeast Asia (our AI provider's ap-southeast-1 region). |
| Resend | Sends the sign-in links and service emails. | Your email address and the content of the email. | Japan (Tokyo region) |
| Better Stack | Receives our service logs, monitors uptime and runs the status page. | Log lines with request identifiers, your user identifier and IP address. Logs carry no email addresses and no prompts. | United States |
| Our payment provider (a payment service provider licensed by the Central Bank of the UAE) | Takes card and other payments for credit packs and handles refunds and disputes. | Your name, email, billing details and payment details. You enter card details on our payment provider's secure page; we do not store full card numbers. | The United Arab Emirates, and the card networks that process the payment. |
We may also disclose data when the law requires it, to protect people from harm, or to a buyer if the business is sold, in which case this policy continues to apply to your data. We will update this list before we add a provider that handles personal data.
6. How long we keep it
| Data | How long we keep it |
|---|---|
| Your account and content | While your account is open, until you delete it or ask us to. |
| Videos of takes you did not select | Cleaned up 30 days after the take was made and the shot last changed. Selected takes and key frames stay. |
| Media of failed takes | Cleaned up after 7 days. |
| Older exports | We keep the newest three finished exports of each episode; older ones are removed. |
| Uploads that were never completed | Removed after 24 hours. |
| Files we remove (cleanup, your deletion, account deletion) | Kept in a private recovery area for 14 days, then permanently erased. Only we can read it. Database records deleted with your account cannot be recovered from it. |
| Account deletion | Carried out within 30 days of your request. Your content, portraits, agreement records (including their IP addresses), waitlist entry and sign-in record are deleted. Generation and credit records are kept without the personal details (prompts, free text and links to you are removed), so our accounts stay complete. Orders, payments and invoices are kept for 7 years, as UAE tax and accounting law requires. |
| Server logs | 30 days |
| Backups and job-queue data | Deleted data can remain in backups and queued jobs until they expire: our database provider keeps daily backups for 7 days, and our own off-site copy of the database (account and studio data, including email addresses) is kept for 35 days once it is switched on; completed background jobs are cleared automatically 7 days after they finish, and jobs that never ran are dropped after 14 days. |
| Copies held by our AI provider | As set by the provider's own terms. |
| Support emails and reports | Up to 2 years after the conversation ends |
7. International transfers
Our database and servers are in Singapore, our logs are in the United States, and the other providers in section 5 work from the places listed there. We are based in the United Arab Emirates and you can use dramagic from anywhere, so your data is transferred across borders, including to countries whose data-protection law differs from yours. We use contracts with data-protection terms and, where the law requires it, standard contractual clauses or an equivalent mechanism.
8. AI and automated processing
Your prompts, scripts and images are processed by AI models to produce what you ask for. Our own checks and the providers' filters can refuse a request automatically; a refused generation is not charged. We do not use automated processing to make decisions about you that have legal or similarly significant effects. If you think a refusal or a suspension was wrong, email support@dramagic.studio and a person will look at it.
9. Your rights and how to use them
Depending on where you live, you can ask to access your data, get a copy in a portable format, correct it, delete it, restrict or object to some uses, and withdraw consent you gave. Two of these you can do yourself, at once, in the studio under "Your data" (/studio/account):
- Download my data gives you a file with everything we store about you (profile, agreement records, series, scripts, shots, takes, media links, generation and credit records, feedback). You can do this up to three times a day.
- Delete my account files a deletion request. You can cancel it while it is pending, and we carry it out within 30 days. Section 6 says what is deleted and what is kept.
For anything else, email support@dramagic.studio. We may ask you to prove who you are, and we answer within 30 days. There is no charge unless a request is clearly unfounded or excessive. You may also complain to your data-protection authority (see section 14).
10. Cookies and browser storage
We do not use advertising or analytics cookies, and no third-party analytics runs on dramagic. Your signed-in session is kept in your browser's local storage rather than in a cookie, and is removed when you sign out. Our hosting and network providers may process technical data needed to deliver pages and block attacks.
11. Children
dramagic is not for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us data, email support@dramagic.studio and we will delete it.
12. How we protect your data
- Traffic between your browser, our servers and our database is encrypted in transit.
- You sign in with a one-time emailed link; we store no passwords.
- Every request is checked against your account, so you can reach only your own content.
- Media is kept in a private store and is reached only through short-lived signed links.
- Administrator access needs multi-factor authentication, and administrator changes are written to an audit log.
- Our logs leave out email addresses and prompts.
- Our build pipeline scans dependencies and licences automatically.
No system is perfectly secure, and we do not claim any security certification. If a personal-data breach affects you, we will tell you and the authorities as the law requires.
13. Changes to this policy
Each version of this policy has an identifier, shown at the top. When we make a material change we publish a new version and ask you to accept it at your next sign-in. We keep a record of the versions you accepted.
14. Contact and complaints
TOKEN FLOW INFORMATION TECHNOLOGY CONSULTING - L.L.C - S.P.C, trade licence CN-6184552, Abu Dhabi - Al Reem Island, P.O. Box 25573. Privacy questions and requests: support@dramagic.studio. If you are not satisfied with our answer you can complain to your supervisory authority.