Privacy Policy

1. Operator and data controller

The individual owner currently operating the service from Florida under the E—BRIN product and operating name determines how personal information is processed for E—BRIN and acts as the data controller where that term applies. This policy does not represent that a corporation, LLC, or other registered entity operates E—BRIN. Privacy requests may be submitted through Support.

2. Categories of personal information

• Identifiers and account information, including email, display name, authentication records, and workspace membership.
• Customer content, including prompts, uploads, brand materials, projects, generated assets, feedback, and related metadata.
• Commercial and billing information, including plan status, credit ledger entries, Stripe customer references, and transaction status. E—BRIN does not store full card numbers.
• Internet, device, security, diagnostic, and usage information needed to protect and operate the service.
• Support communications and information you choose to provide.

3. Purposes of processing

Information is processed to authenticate users, isolate workspaces, provide requested creative functions, store and deliver private assets, administer credits and billing, prevent abuse, troubleshoot failures, communicate service information, comply with law, respond to requests, and improve reliability. E—BRIN does not sell personal information in the ordinary commercial sense and does not currently use it for cross-context behavioral advertising.

3A. Publication choices and consent records

E—BRIN does not use private creations for promotion automatically. If you publish a creation, E—BRIN records the selected destinations, the applicable consent text and version, the account and workspace, the creation identifier, and the time permission was granted or withdrawn. Community-gallery, website, and advertising permissions are separate choices. These records are used to honor your instructions, document authorization, manage removal requests, and protect users and the service.

4. Service providers and processors

When a generation is authorized, relevant prompts and media may be sent to OpenAI, Google, Runway, MiniMax, or ElevenLabs to perform the requested image, video, voice, sound, music, or dubbing operation. Supabase supports authentication and application data services; Google may provide optional account sign-in and process generation prompts and supplied reference images for image and video generation; and Stripe processes Checkout, subscriptions, billing portal access, and payment information when billing is enabled. Hosting and private asset infrastructure also process limited technical data needed to deliver the service. These providers process information under their own terms, privacy notices, and service arrangements.

5. Cookies and similar technologies

E—BRIN uses essential session and authentication technologies for sign-in, security, and account continuity. Optional first-party usage statistics are off by default. We record no optional analytics event or analytics identifier until you choose “Permitir estadísticas” in the statistics preferences at the bottom of the site. If you allow them, an opaque browser identifier counts daily landing visits and product sessions; signed-in events also include your internal user and workspace identifiers, a normalized page category, and the event date and time. These events are account-linked, not anonymous. They do not include an IP address, user agent, email, prompt, payment method, or advertising identifier.

The necessary cookie remembering your statistics choice and the optional analytics identifier each last up to 365 days. Choosing “Retirar permiso” stops future optional events and clears the analytics identifier in that browser. You can reject statistics and still use the service. Withdrawal does not by itself erase previously collected records; you may request deletion through the privacy-request process. Earlier records created before this opt-in policy are not automatically deleted by this change. Google and Stripe may set technologies when you use their sign-in or payment services. E—BRIN does not currently use third-party advertising trackers or behavioral advertising tools.

6. Data isolation and security

E—BRIN uses authenticated, server-side workspace controls and private asset delivery. No system is perfectly secure. Avoid submitting unnecessary sensitive data, protect your credentials, and promptly report suspected compromise through Support.

7. Retention

Active account and project information is retained while the account remains open. Deleted customer content is targeted for removal from active systems within 30 days and from rotating backups within a further 90 days. Ordinary technical logs are generally retained for 90 days; fraud-prevention records for up to 2 years; ordinary support records for 3 years; and billing, tax, consent, privacy-request, legal-case, and security-incident records for up to 7 years. Inactive unpaid accounts may be reviewed for deletion after 24 months. A narrower or longer period may apply where law, security, a dispute, or a documented legal hold requires it.

8. Your choices and requests

You may update certain account and billing information through the application or Stripe Customer Portal. You may ask to access, correct, delete, or obtain information about personal information associated with your account by selecting “Privacy request” through Support or Contact. E—BRIN may verify your identity and may retain information where permitted or required for security, legal, billing, or recordkeeping purposes.

8A. Request handling and account deletion

Verified privacy requests receive a reference and are placed into a controlled workflow. E—BRIN targets acknowledgement without undue delay and completion within the period required by applicable law. Account deletion includes withdrawal of future publication permissions, termination of application access, deletion or de-identification of active workspace data and assets, and deletion of the authentication account after owned storage objects are removed. Limited billing, consent, security, fraud, and legal records may be retained when required or permitted. Existing short-lived authentication tokens may remain technically valid until expiry, so sensitive operations also use current server-side account and workspace checks.

10A. European data protection

For people in the European Economic Area, United Kingdom, or Switzerland, processing may rely on performance of the requested service, compliance with law, legitimate interests such as security and fraud prevention, or consent where required. Depending on applicable law, you may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent, and may complain to a competent supervisory authority. Relevant service providers may process information outside your country using applicable contractual or other transfer safeguards.

9. U.S. privacy rights

Depending on your U.S. state of residence and applicable law, you may have rights to confirm processing, access, correct, delete, or obtain a copy of certain personal information, and to receive information about data practices. Where required, you may also appeal a denied request or opt out of sale, sharing, or targeted advertising. E—BRIN does not currently sell personal information or use it for targeted advertising in the ordinary commercial sense. These statements do not expand rights beyond applicable law.

10. International processing and children

Service providers may process information in countries other than your own, subject to their applicable safeguards. E—BRIN is an adults-only service for people aged 18 or older, including free accounts. It is not intended for minors, and parent or guardian supervision does not create an exception. We record an explicit adult self-declaration tied to the verified account, the applicable policy version, and its timestamp before new AI work or purchases. We do not collect a date of birth or identity document for this confirmation, and it is not documentary age verification. If you believe a minor has provided information, contact Support so the situation can be reviewed and the applicable privacy rights addressed.

11. Policy changes

Material changes will be posted with an updated version or effective date. Signed-in users may submit verified export or deletion requests in Data & Privacy under Settings; questions and other privacy requests may also be submitted through Support.