Privacy Policy

This Privacy Policy explains how Neuroflix Private Limited (“Neuroflix”, “we”, “us” or “our”) collects, uses, stores, shares and protects your personal data when you use our website, applications and services (the “Service”). It should be read together with our Terms of Service.

Using Neuroflix necessarily involves processing a real person’s face and voice to generate an AI version of them, so this policy gives that sensitive data particular attention. By using the Service, you acknowledge the practices described here.

Neuroflix Private Limited is a company incorporated in Singapore and registered with the Accounting and Corporate Regulatory Authority (ACRA). We are the organisation responsible for (the controller of) the personal data processed through the Service, and we handle it in line with the Singapore Personal Data Protection Act 2012 (PDPA) and, where they apply to you, the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

You can reach our Data Protection Officer, and raise any privacy question or request, at general@neuroflix.sg.

We collect the following categories of personal data:

• Account information. When you sign up, our authentication provider collects your name, email address and login credentials, and we store an account identifier to link your projects to you.
• Content you upload. Your speaking take (video and audio), reference photos of yourself, the scripts and details you type, and any optional closing clip you choose to add.
• Facial and voice data. Your photos and recordings contain biometric-type data, namely your facial imagery and the sound of your voice, which we process to generate your likeness. See the next section.
• Generated output. The images, clips, captions and finished videos created for you.
• Usage and device data. Limited technical information such as IP address, browser and device type, and the pages and actions requested, recorded automatically in the logs of our hosting and infrastructure providers to operate, secure and debug the Service.

To create your video, we process the face and voice contained in your uploads. Depending on your jurisdiction, this may be treated as sensitive or special-category personal data. We rely on your explicit consent as the legal basis for processing it, which you give when you upload your content and confirm you have the right to do so.

Responsibility for obtaining any third party’s consent rests with you, as set out in the Terms of Service.

We use personal data to:

• provide the Service: generate, edit, caption, render and deliver your videos from the inputs you give us;
• create and secure your account and authenticate your access;
• operate, maintain, debug, secure and improve the Service;
• communicate with you about the Service, including service notices and support;
• enforce our Terms, prevent abuse and misuse, and comply with legal obligations.

We do not use your uploaded content or likeness to train our own generative models.

Where the GDPR applies, we rely on: your consent for processing facial and voice data and any optional communications; performance of a contract to provide the Service you request; legitimate interests in operating, securing and improving the Service (balanced against your rights); and legal obligation where the law requires us to retain or disclose data. Under the PDPA, we collect, use and disclose personal data with your consent and for purposes a reasonable person would consider appropriate. You may withdraw consent at any time.

The generation itself is performed by third-party AI providers, including Fal AI (video and image generation, and speech transcription to align captions) and Google (used to position captions, which involves sending still frames containing your facial imagery to Google). To create your video, your inputs, including your recording, photos and prompts, are transmitted to these providers strictly so they can produce the requested output. We share only what is needed for generation, and we do not permit your inputs to be used to train their foundation models for their own purposes, to the extent their terms allow us to control this. Their handling of data is also governed by their own privacy terms.

We rely on a small set of trusted providers who process data on our behalf, under contractual confidentiality and security obligations:

• Authentication (Clerk): to manage sign-up, login and account security.
• Storage and database (Supabase): to store your uploads, generated assets and project data.
• AI generation (Fal AI, Google): to generate the speaking clips, pose images and cutscene animation, transcribe your speech for captions, and position those captions.
• Video rendering (Remotion, on Amazon Web Services): to assemble and render your final video.
• Hosting and background processing (Vercel, Inngest): to run the application and orchestrate generation.
• Payments (Stripe): to process payments and give you a billing history. We share your account email and name with Stripe so it can manage your payments and issue invoices; Stripe handles your card details directly, and we do not receive or store your full card number.

These providers act as our processors and may process data in locations outside your country, subject to the safeguards described below.

We do not sell your personal data. We share it only:

• with the service providers described above, to operate the Service;
• when required by law, legal process, or a valid government request, or to protect the rights, safety and property of Neuroflix, our users or the public;
• in connection with a merger, acquisition or asset sale, in which case we will require the recipient to honour this policy and will notify you of any material change;
• with your direction, for example when you download or share your finished video.

When your video is finished, we host it at an unguessable public web address so you can share it by link. Anyone who has that link can view the video until you delete the project it belongs to.

We keep personal data for as long as your account is active or as needed to provide the Service, and afterwards only as long as necessary for the purposes described here, to comply with legal obligations, resolve disputes and enforce our agreements. You can delete an individual project and its uploads at any time, which removes the associated files and data and disables that project’s share link. To delete your entire account, email us at general@neuroflix.sg and we will delete your projects and associated personal data.

We retain limited transaction and billing records, such as payment references and the amounts charged, held mainly in the systems of our payment processor (Stripe), for as long as required for accounting, tax and audit purposes, even after a project or account is deleted. Limited copies may also persist for a short time in routine backups, or where retention is legally required.

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, access controls that scope your data to your account, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

We are based in Singapore, and several of our providers (including Fal AI, Google, Amazon Web Services, Stripe, Clerk and Vercel) process data in the United States and other countries, which may have different data-protection laws from your own. Where we transfer personal data internationally, we put appropriate safeguards in place, such as standard contractual clauses or transfers to jurisdictions recognised as providing adequate protection, and take reasonable steps to ensure your data remains protected to a comparable standard.

Subject to applicable law, you may have the right to:

• access the personal data we hold about you, and request a copy;
• correct inaccurate or incomplete data;
• delete your data, including your facial and voice data;
• withdraw consent at any time (without affecting processing already carried out);
• object to or restrict certain processing, and request portability of data you provided;
• opt out of the “sale” or “sharing” of personal data (note that we do not sell your data).

To exercise any of these, email general@neuroflix.sg. We will respond within the timeframe required by law and may need to verify your identity first. You also have the right to lodge a complaint with your local data-protection authority, which in Singapore is the Personal Data Protection Commission (PDPC).

We use a small number of strictly necessary cookies and similar technologies, principally to keep you signed in (set by our authentication provider) and to remember basic interface preferences. We do not use advertising cookies or third-party behavioural-analytics or session-recording tools. Our hosting and infrastructure providers automatically keep technical logs, which may include your IP address, to run and secure the Service. You can control cookies through your browser settings; disabling essential cookies may stop you from signing in or affect how the Service works.

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from minors or permit the creation of content depicting a minor. If you believe a minor has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect means you accept the updated policy.

Questions, concerns or requests about your privacy? Reach us at general@neuroflix.sg.