Privacy Policy

1. Who We Are & Contact

This Policy is issued by NEXTFRAME AI STUDIO LLC (a limited liability company organized under the laws of Wyoming, USA — “we”, “us”, “our”) for the service it operates at filmai.ai (“NEXTFRAME Cinema Master Pro” / “電影大師 Pro”, the “Service”).

As a US-based data controller, we treat California's Consumer Privacy Act / Privacy Rights Act (CCPA / CPRA) as the primary data-protection framework. We also provide equivalent or stronger protections under: EU / UK General Data Protection Regulation (GDPR), Taiwan Personal Data Protection Act (PDPA / 個人資料保護法), and other applicable law.

For privacy questions, to exercise any right, or to withdraw consent, email ai@next-frame.aiwith the subject “Privacy Request”.

2. Personal Data We Collect

2.1 You Provide Directly

• Account identity:email, name, profile image (via Clerk sign-in).
• Payment data:Card details are collected and processed directly by Stripe Inc. We only receive Stripe-issued tokens and billing metadata (amount, subscription status, invoice IDs); your card number never touches our servers.
• User content:projects, outlines, uploaded reference materials, and AI-generated images and videos.
• Communications:messages you submit via the in-product feedback button, email, or support channels.

2.2 Collected Automatically

• Usage logs:IP address, browser type, page paths, interaction timestamps. Used for anomaly detection, debugging, and fraud prevention.
• Cookies:see §7.
• Generation metadata:model choice, resolution, duration, credit-debit records. Used for billing and capacity planning.
• Agent connections (MCP):when you connect filmai to an AI client (e.g. Claude, ChatGPT, Codex, Cursor), that client sends tool requests on your behalf (prompts, reference media URLs, generation settings), which we process the same way as actions you take on the website. Connection keys and OAuth access tokens are stored only as hashes. For every write or credit-charging call we log the tool name, a hash of the arguments, the credits charged, and whether it succeeded (never the prompt text), for billing, usage limits, and abuse detection. Your conversation with the AI client is handled by that client under its own privacy policy; we cannot see it. You can revoke keys or connections at any time from your account page.

2.3 Received From Third Parties

When you sign in via OAuth (Google), we receive the profile fields you authorize that provider to release — typically email, display name, and profile photo URL.

3. Legal Bases for Processing

As a US company, our processing activities rely primarily on these bases: (1) necessity to perform our service contract with you; (2) compliance with US federal and state legal obligations (tax, AML, consumer protection); (3) our legitimate interests (fraud prevention, platform security, product improvement); and (4) your explicit consent (marketing communications).

For visitors from the EU / UK, the corresponding GDPR Art. 6 lawful bases map as follows:

For visitors from Taiwan, we process under PDPA Article 19(1), primarily under “contractual or quasi-contractual relationship” (Service delivery) and “data subject consent” (marketing).

4. What We Do Not Do

We do not use your content to train AI models, and we do not license your content to any third party for training. Your projects, prompts and generated results are sent to AI model providers only while executing a generation request you actively triggered; we do not retrieve or reuse your content from those providers. Each provider retains short-term data under its own policy (for example, output files for around 7 days, with separate log retention) and may use de-identified aggregate usage data to improve its services — see Section 5 for each provider.

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under CCPA / CPRA.

5. Sub-processors

6. International Data Transfers

The Service stores and processes data across multiple jurisdictions. For visitors from the EU, UK, and Switzerland, we rely on the EU Standard Contractual Clauses (SCCs) as the transfer mechanism. For Taiwan residents, we handle cross-border transfers per Article 21 of the Taiwan PDPA. For US residents, transfers within the US occur under generally applicable federal and state privacy law.

If you have concerns about a specific sub-processor's transfer mechanism, email ai@next-frame.ai, we will provide that provider's SCCs or DPA; where a provider does not offer such documents, we will tell you its published privacy policy and governing jurisdiction so you can assess the transfer.

7. Cookies & Similar Technologies

We do not currently run advertising or retargeting cookies. If we ever enable them, we will update this Policy and present a cookie consent banner.

8. Data Retention

To request full deletion, email ai@next-frame.ai; we process within 14 business days (subject to legal retention obligations).

9. Automated Decision-Making & AI Processing

The Service's core feature is AI-automated generation. For requests you initiate, output is determined entirely by the AI model — we do not curate content. For potentially Acceptable-Use-violating content, our detection mechanisms include automated classifiers (e.g., NSFW, deepfake risk scoring). Requests flagged as high-risk may be blocked or queued for human review.

If you believe an automated decision has materially affected you (e.g., account suspension by mistake), you have the right to request human review. Email ai@next-frame.aiwith details; we respond within 14 business days.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child has registered, please contact ai@next-frame.ai; we will verify and promptly delete the account and related data.

11. Your Rights

As a US company, our primary framework for your rights is California CCPA / CPRA. We provide equivalent or stronger protections under other applicable laws. Regardless of where you reside, you have the following rights:

11.1 California Residents (CCPA / CPRA)

• Know what categories of personal information we collect, sources, purposes, and sharing recipients
• Access the specific personal information we hold about you (past 12 months)
• Correct inaccurate information
• Delete your personal information (subject to legal retention obligations)
• Opt out of “sale” or “sharing” (we do neither, but you retain this right)
• Limit processing of “sensitive personal information”
• Non-discrimination for exercising any right
• Authorize an agent to act on your behalf

We respond to CCPA / CPRA requests within 45 days, extendable by another 45 days with notice.

11.2 EU / UK Residents (GDPR / UK GDPR)

• Right of access
• Right to rectification
• Right to erasure / “right to be forgotten”
• Right to restrict or object to processing
• Right to portability (machine-readable export)
• Right to withdraw consent
• Right to object to automated decision-making (Art. 22)

We respond to GDPR requests within 30 days.

11.3 Taiwan Residents (PDPA / 個人資料保護法)

• Inquire and request to review
• Request a copy of records
• Request supplementation or correction
• Request cessation of collection, processing, or use
• Request deletion

We respond to PDPA requests within 30 days.

11.4 Other Jurisdictions

If your local data-protection law (e.g., Canada PIPEDA, Brazil LGPD, Australia Privacy Act, other US state laws including VCDPA / CPA / CTDPA) grants you additional rights, we will honor those rights accordingly.

11.5 How to Exercise Your Rights

Send all privacy requests to ai@next-frame.aiwith the subject “Privacy Request”, and include: (i) request type; (ii) the email address registered to your account; (iii) for California residents, statutory identity proof (e.g., partial driver's license showing name and a portion of the document number — redact the rest).

11.6 Complaint Authorities

If you are not satisfied with our response, you may file a complaint with:

• California: California Privacy Protection Agency (cppa.ca.gov)
• EU / UK: your Member State Data Protection Authority
• Taiwan: National Development Council Personal Data Protection Office (NDC)
• Other US states: that state's Attorney General or Privacy Agency

12. Breach Notification

If a security incident materially affects your personal information, we will notify the relevant supervisory authority within 72 hours of discovery (where required by law), and notify affected users by email within a reasonable time describing the nature of the incident, potential risks, and the remediation we have taken.

13. Changes to This Policy

We may update this Policy from time to time. Material changes (expanding data categories, processing purposes, retention periods, or adding sub-processors) will be notified by email at least 30 days in advance. Non-material changes take effect immediately; the “Last updated” date above reflects the current version.