Privacy Policy
Last updated: 9 October 2026
Data controller: Talestudio, Business Registration No. 333-27-02069, 169 Dolma-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea, 13606.
Privacy Officer: Daewon Yoon, owner, support@talestudio.art
1 What we collect and why
| Data | Purpose | Retention |
|---|---|---|
| Account data received when you sign in with Google (email address, display name, profile image, Google account identifier). If email-and-password sign-in becomes available, the account email and authentication records associated with that method | Create/manage your account, authenticate you, communicate about the Service | Deleted after account closure within a reasonable period, except records we must keep by law (see "Statutory retention" below) |
| The material you enter or upload, currently written documents: story outlines, treatments, dialogue, and descriptions of characters and locations | Generate the storyboard, imagery, and video you request | Kept while the project exists; deleted when you delete the project, and after account closure within a reasonable period |
| Generated output (video, storyboard frames, images) | Deliver the output to you; allow you to revisit/export it | Kept while your account is active. When you close your account your access ends immediately and the files are deleted progressively from our systems and backups thereafter, so export anything you want to keep before closing it |
| Usage & system logs (Take consumption, error logs, IP, device/browser) | Billing accuracy, abuse prevention, debugging, security | Access logs about 3 months. Take-consumption records are kept with the billing records below |
| Payment and order data (account email, product and order identifiers, plan or pack purchased, amount and currency, purchase and renewal dates, payment/subscription/refund status) | Paid checkout is not currently available. When checkout opens through Creem, use the order and status information Creem provides to activate purchases, maintain Take balances, handle cancellation and refunds, and keep transaction records. Tale Studio will not receive or store your full card number | No paid orders are currently collected through the Service. After checkout opens, applicable transaction and complaint records are kept for the statutory periods below |
| Image/video prompt screening records (the text prompt submitted for screening, any internal request reference sent, the screening decision, and related usage/error logs) | Screen prompts before generation, prevent prohibited content, investigate abuse and technical faults | Access and error logs are generally kept for about 3 months; Creem's own retention is described in §7 |
Statutory retention. Korean law requires us to keep certain transaction records even after you close your account, and we keep them only for these purposes:
| Record | Retention | Basis |
|---|---|---|
| Contracts and withdrawal-of-subscription records | 5 years | Act on Consumer Protection in Electronic Commerce |
| Payment and service-supply records | 5 years | same |
| Consumer complaint and dispute records | 3 years | same |
| Display/advertising records | 6 months | same |
We do not sell your personal data.
We do not train Tale Studio's own AI models on your content. Third-party AI providers process content under their applicable terms and configurations, which can differ by model and API endpoint. See §7.
We do access your content where running the Service requires it: to produce the output you asked for, to investigate a fault you or we have noticed, to look into suspected abuse, and where the law obliges us. Access is limited to what the task needs.
Our AI providers. The providers and the categories of content sent to them are listed in §7. Their retention and use of data depend on the applicable agreement, endpoint, and account configuration. We will update this page if those arrangements change materially.
2 Who we share data with
- Google: sign-in when you choose Google. Google confirms your identity to us and provides your basic profile fields; Google's own handling of your Google account is governed by Google's Privacy Policy.
- Creem (Armitage Labs OÜ, Estonia): content-policy screening for text prompts before image or video generation, including free generations; payment processing, tax collection/remittance, and billing support when paid checkout opens. Creem's handling of buyer data is described in its Privacy Notice. Creem is not currently processing Tale Studio purchases.
- AI model providers, which run the generation you request: fal for image and video, and Google and Anthropic for the text our agents generate. See §7 for their legal entities, countries, and retention terms.
- Vercel: application hosting and content delivery; processes requests to the site, including IP addresses and request logs.
- Supabase: database, authentication session storage, and file storage for your projects and generated output. Your data is stored in Supabase's Singapore region.
- Law enforcement or regulators, only where legally compelled.
We do not otherwise disclose your data to third parties for their own marketing purposes.
Content screening. Before a user-supplied text prompt reaches an image or video generation model, including during free use, we send the prompt to Creem's Moderation API for a content-policy decision. We may also send an internal user or generation reference to associate the decision with the request. We use the decision to allow or block generation. A blocked request, or a request we cannot screen because of an API error, is not sent to an image or video model and does not consume a Take or plan-included generation allowance. See §7 for this transfer.
3 Legal bases for processing
Where the GDPR or a similar framework applies, we rely on: performance of a contract (creating your account, running generations you request, billing); legitimate interests (security, abuse prevention, and debugging); consent where we ask for it separately; and legal obligation for the statutory retention listed above.
4 Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, export it in a portable format, restrict or object to processing, and withdraw consent you previously gave.
To exercise any of these, email support@talestudio.art. We respond within the time applicable law requires for the right you exercise and where you live. You will not be charged, and we will not degrade your service for asking.
Complaints. If you are unhappy with how we handled your request, you can complain to your data protection authority: in Korea, the Personal Information Protection Commission (PIPC); in the EEA or UK, your national supervisory authority.
5 Children and supervised users
Accounts are held by adults (see the Terms of Service). We do not create accounts directly for anyone under 18, and we do not knowingly collect personal data from a child who has signed up on their own. If we learn that has happened, we delete the account and its data.
Where an organisation, parent, or guardian holds an account and allows a supervised user under 18 to work on it, that account holder is responsible for obtaining whatever parental or institutional consent their own law requires, and for deciding what personal data those users enter. We process that data on the account holder's instructions.
If you believe a child has created an account directly, contact us at support@talestudio.art.
6 Security
We apply reasonable technical and organizational measures to protect your data:
- Google sign-in is authenticated through Google. If email-and-password sign-in is made available, authentication is handled through Supabase; we do not need your plaintext password to provide the Service.
- Payment card data does not reach us through Creem checkout. Paid checkout is not yet open; when it opens, card entry and payment processing will be handled by Creem (see the Terms of Service).
- Encryption in transit, and access controls limiting who can reach production data.
- Data at rest is stored with Supabase, on enterprise-grade infrastructure with encryption at rest. The application itself runs on Vercel.
- Your project data and files are stored in Supabase's Singapore region. See §7 for the full cross-border picture.
No system is 100% secure. We use authentication providers for sign-in and Creem for prompt screening and, when paid checkout opens, card processing.
7 Cross-border data transfers
Because Tale Studio's AI pipeline calls third-party model providers and (depending on your own location) our infrastructure may be located outside your country, your data may be transferred internationally. Under Korean law (PIPA Art. 28-8) and similar frameworks elsewhere, we disclose:
| Recipient | Country | What is transferred | Purpose | Retention there | Legal basis |
|---|---|---|---|---|---|
| Features & Labels, Inc. ("fal"), and the model providers it uses for image and video generation | United States; other recipient locations depend on the model endpoint | The project content a generation requires, the prompts and generation parameters derived from your source material | Run the AI video and image generation you request | Governed by the applicable fal API Services Terms, data processing terms, and any third-party model terms. Retention and training restrictions may differ for excluded or third-party API models | Necessary to perform our contract with you |
| Google (Google LLC / Google Ireland Ltd, depending on your region) | United States and Google's global infrastructure | Your email address, display name, profile image, and Google account identifier, exchanged at sign-in | Authenticate you (Google SSO), so that no password is stored by Tale Studio | For the life of your account; Google's own retention is governed by its privacy policy | Necessary to perform our contract with you |
| Vercel Inc., a United States company | United States, with static assets served from Vercel's global edge network | Requests to the Service, including IP address, browser/device information, and request logs | Host and serve the Tale Studio application | Per Vercel's own retention terms | Necessary to perform our contract with you |
| Supabase Inc., a United States company | Your data is stored in Singapore. Supabase Inc., as the operator, may access it from the United States for support and maintenance | Account data from the sign-in method you use, project data, the material you upload, and generated output | Database, authentication sessions, and file storage | For the life of your account, then per the retention table in §1 | Necessary to perform our contract with you |
| Google LLC (or Google Ireland Limited, depending on your region) | United States | The prompts, story premises, and scripts you enter | Generate the planning, treatment, and screenplay text you request | Google's paid Gemini API terms restrict use of prompts and responses for product improvement; logging and retention depend on the API and project configuration | Necessary to perform our contract with you |
| Anthropic PBC | United States | The prompts, story premises, and scripts you enter | Generate the planning, treatment, and screenplay text you request | Under Anthropic's commercial API terms, inputs and outputs are not used to train its models by default | Necessary to perform our contract with you |
| Armitage Labs OÜ (Creem) | Estonia; Creem may use service providers in other locations as described in its Privacy Notice | Text prompts submitted for image/video generation and, if used, an internal user or generation reference | Screen prompts for prohibited content before image/video generation, including free generations | Creem's Privacy Notice describes retention according to processing purpose and legal obligations; it does not state a fixed moderation-prompt retention period | Necessary to provide and protect the Service; our legitimate interest in preventing misuse |
| Armitage Labs OÜ (Creem), once paid checkout opens | Estonia; other processing locations are described in Creem's Privacy Notice | Buyer details entered at checkout and the order, product, subscription, payment-status, and refund information needed to complete and service the purchase; full card details are collected by Creem, not Tale Studio | Sell subscriptions and Take packs as Merchant of Record; payment, taxes, receipts, cancellation, and refunds | Creem's Privacy Notice lists retention by data category and applicable legal obligation; Tale Studio keeps the transaction records listed in §1 | Necessary to perform a purchase contract and comply with applicable law |
Transfer safeguards. Talestudio is established in the Republic of Korea, which the European Commission recognises as providing an adequate level of data protection for covered transfers from the EEA. Onward transfers to providers outside Korea are governed by the applicable provider agreements and data protection rules. Contact us for information about the safeguards for a specific transfer.
Where a transfer relies on your consent, you may withdraw that consent. Transfers that are necessary to provide a generation you request may instead rely on performance of our contract with you, as described in §3.