Privacy policy

How we handle personal data (GDPR). Controller: Ľubomír Kochan, details on the Legal page, contact info@kinemiq.app.

What we process and why

Account – name, e-mail, password (stored only as a hash), plan, credits, the history of your exports (time, format, length) and the days you used the app while signed in (to see whether the app is useful to you; kept for 120 days, deleted with the account). Purpose: providing the Service and the contract (Art. 6(1)(b) GDPR).
Purchases – order and invoice data. Purpose: the contract and accounting obligations (Art. 6(1)(b) and (c)). Card details are processed only by the payment provider, never by us.
Security – the hosting’s server logs (IP address, time, requested address) and limits on sign-in attempts. Purpose: protecting the Service (legitimate interest, Art. 6(1)(f)).
Statistics – only counts per day: visits and where they came from, the pages viewed, how far a page is scrolled and how long the site or the app stays open, which app features are used and which steps towards an export are reached, whether people come back to the app (only if you accept: your browser keeps the day you first used the app and sends just the number of days since then), the type of browser, operating system and device, exports. A visitor is counted with a daily changing pseudonymous code (a keyed hash of the IP address and the browser that changes every day – the IP address itself is not stored, and the code cannot be linked across days); keep only a few values in the browser tab's session storage (gone when the tab is closed) and use no third-party analytics or advertising services. Purpose: understanding what helps and what stops visitors (legitimate interest, Art. 6(1)(f)).
Visit recordings – to find what does not work for visitors, we record how the pages of this website and the app are used: the page layout, mouse movements, clicks and scrolling, a small low-resolution picture of the app’s 3D view about once a second, and when a click had no effect or an error appeared. Your video files are never recorded or uploaded. Everything you type is masked and never recorded, the account pages are recorded with all text masked, and no IP address or cookie is used – a visit is linked only by the daily changing pseudonymous code above. The recordings stay on our own server (no third party) and only we can view them. Only with your consent (Art. 6(1)(a) GDPR): a small bar asks before anything is recorded, and your choice is kept in your browser. You can change it any time: change my recording choice. Nothing is recorded if your browser sends Do Not Track or Global Privacy Control. Purpose: fixing bugs and making the Service easier to use.
E-mails – messages about your account (confirmation, password reset, purchases), and rarely a short e-mail about new features of the Service (our legitimate interest in telling existing users about the Service they use, Art. 6(1)(f)). Every such e-mail has a one-click „Don’t send me news“ link; after it you get only messages about your account. We do not track whether such an e-mail is opened. You can also turn these e-mails off when you create your account or any time in My account.
Sign in with Google (optional) – when you choose it, Google sends us your Google account ID, name and e-mail address. Purpose: signing you in (Art. 6(1)(b)). Google LLC is the provider of that sign-in under its own privacy policy.
Error reports – when the app or the website fails, the error message, the page and the browser type (no IP address, no project content). Purpose: fixing bugs (legitimate interest, Art. 6(1)(f)); kept for up to 90 days.
Animation from video – technical facts – when you turn a video into an animation, the app sends us only its technical facts: the video’s size, length and frame rate, how well the person was found in it, whether it worked or the error, how long it took and quality numbers of the motion. Never the video itself, a picture from it or its name. Purpose: finding and fixing what goes wrong (legitimate interest, Art. 6(1)(f)); kept for 90 days.
Animation from text – technical facts – when you make an animation from text, the app sends us only: whether it worked or the error, which of our prepared motion descriptions your words matched and how closely, the quality and length you chose, how long it took, the type of graphics card and the device. Never the words you typed. With analytics accepted, also how many animations this browser has made and how many days since its first one. Purpose: improving the feature (legitimate interest, Art. 6(1)(f)); kept for 90 days.
Feedback – when you send a note through „Feedback“ in the Studio (what you would improve or add), we keep its text, your account if you are signed in, the e-mail address if you add one for a reply, where it was sent from (the button or after an export), your device type, browser and the app version – never your IP address. Only we read it, to improve the Service (our legitimate interest, Art. 6(1)(f), and your choice to write); we reply only if you leave an e-mail. Kept up to 24 months.
Live camera – when you use your phone or webcam as a live camera in the Studio, the camera turns on only after your browser asks you and you allow it. The picture goes directly from your phone to your own computer (a peer-to-peer WebRTC connection) and is never sent to, passed through or stored on our server. Our server only passes the two short technical connection descriptions between the phone and the computer (network addresses for the connection) and deletes them within 10 minutes. To find a way through home routers, both devices also ask Google’s public STUN server (stun.l.google.com) for their own network address; that server sees the two devices‘ IP addresses, nothing of the picture. A recording you make stays in your browser until you turn it into an animation. Purpose: providing the feature you asked for (Art. 6(1)(b)).
Assistant – only if you use the AI assistant mode, the text you type is sent to our AI provider (Anthropic PBC) to turn it into editing commands; it is not used to identify you. The basic assistant works in your browser and sends nothing.
Uploaded characters – if you upload your own 3D character for export, the file is stored in your account’s private folder on our render server (at our hosting provider in the EU) until you delete it, or 90 days after you last used it. Purpose: the export you asked for (Art. 6(1)(b)).
Projects in your account – when you are signed in and save a project to your account (or export, which keeps your last work there automatically), we store the project’s settings and the motion of the animations it uses (the joints‘ movement over time) so you can open it on another device. Never your video, a picture from it or its file name. Kept until you delete the project or your account. Purpose: the service you asked for (Art. 6(1)(b)).
Support requests – what you write to us or in your account’s request form, until the request is settled and your account is deleted.

Your animations and projects stay in your browser; we do not store them on our servers unless you save them to your account (above), except uploaded characters and the small 3D view pictures of visit recordings (above).

Who receives the data

Our hosting provider (HostCreators, Slovakia, servers in the EU), Paddle.com (our reseller, only when you buy – below), Google (only if you sign in with Google, and its public STUN server if you use the live camera), our AI provider Anthropic (only the text you type into the AI assistant mode), and public authorities where the law requires it. We do not sell personal data. Google and Anthropic are in the USA; such transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. A payment provider may transfer data under the same GDPR safeguards.

Purchases: Paddle.com is our reseller and Merchant of Record and processes your name, e-mail, country, payment and tax details as an independent controller under its own privacy policy. We receive from Paddle only what we need to give you the credits or the plan: your Paddle customer number, what you bought, the amount and the subscription state – never your card details. We keep these purchase records as long as the accounting and tax laws require (up to 10 years), also after the account is deleted.

How long

Account data until you delete the account (My account → Delete my account); invoices for 10 years (accounting law); server logs as kept by the hosting (usually up to 30 days); daily statistics codes are deleted after 35 days; visit recordings after 30 days; feedback notes after 24 months at the latest.

Your rights

You may ask for access, correction, deletion, restriction, data portability and object to processing – write to info@kinemiq.app. You may also file a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. We make no automated decisions with legal effect about you.

Cookies

We use only cookies that are necessary for the Service: signing in (WordPress login cookies) and, when buying, the shopping cart. The app keeps your projects and settings in your browser’s storage. No tracking or advertising cookies – that is why there is no cookie banner. The visit recordings above use no cookies; your answer to the recording question is kept in your browser’s storage (only „yes“ or „no“).