This Privacy Policy forms an integral part of the Depth Studio Terms of Use and describes how we process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national data protection law. How we access, use, share, store, protect and delete the data we receive when you sign in with Google is set out in section 14 (Google User Data).
1. Controller
Depth Studio AI is operated and supplied by Gamze Kamile Akgül, a sole proprietor registered in the Czech Republic under IČO 22435735, with a registered business address at Pod novým lesem 137/52, Veleslavín, 162 00 Praha 6, Czech Republic. Gamze Kamile Akgül is the data controller for the personal data processed in connection with the Platform. For any privacy matter, including the exercise of your rights, contact [email protected].
Data needed to take and administer a payment is also processed by the payment service providers involved in the transaction, which act for their own purposes in relation to that payment — see section 5.
2. Data We Process
Identification and account data: name, email address, avatar, job title, team membership and role. If you sign in with Google or Microsoft, see section 14 for exactly what we receive from them.
Technical data: IP address, browser and device type, session tokens, security and audit logs, and error and diagnostic logs (what went wrong, on which page, in which browser and app version — these contain no IP address and none of the content you work on).
Product improvement data: the options you choose during project setup and the answers you write yourself to Focus's questions. They are stored without your name, email address, IP address or project, with the date only (no time of day), and are not linked to your account.
Content data: uploaded images, video and audio; prompts; generated outputs; LLM conversations; projects, tasks, messages, files and their metadata.
Billing data: plan, credit balance, subscription status and a reference to the transaction held by the payment provider. We never receive or store your full card details.
Consent records: the version, timestamp, language and clauses of the AI usage terms you accepted, retained as proof of consent.
Communication and support data: the content of messages you send us, for example to the support address, and our replies.
Data about people who do not have an account: (a) people invited to a Team or project — their email address, who invited them, to which Team or project, and the status of the invitation; (b) clients invited to a client session or delivery — their name, email address, one-time verification codes (stored only in hashed form and valid for 15 minutes), access times, and the comments and approvals they leave; (c) people who appear in images, video or audio uploaded by Members. This data comes from the Member who sends the invitation or uploads the material, and in case (b) partly from the client.
3. Purposes and Legal Bases
Providing the Platform and its AI features, and performing our contract with you — Art. 6(1)(b) GDPR (performance of a contract).
Platform security, abuse prevention, fraud detection and enforcement of the Terms — Art. 6(1)(f) GDPR (legitimate interests).
Detecting, diagnosing and fixing errors in the Platform — Art. 6(1)(f) GDPR (our legitimate interest in a working, reliable service). When something fails, we record what went wrong, the page, the browser and device type, the language and the app version, linked to your account if you are signed in. Error logs do not contain your IP address or the content you work on, and nothing is stored on your device for this purpose.
Improving the Platform — Art. 6(1)(f) GDPR (our legitimate interest in building the features our users need). To see which options are chosen most and which requests we do not offer yet, we record the options you choose during project setup and the answers you write yourself to Focus's questions. The record contains no name, email address, IP address or project and carries the date only; emails and links in what you write are removed before saving. If you type someone's name into an answer, it is stored as written, so please don't include personal details. You can switch this off at any time in Settings → Product improvement; from then on nothing is recorded. Because the records are not linked to you, earlier records cannot be found and deleted individually; they are deleted automatically after 90 days. Nothing is stored on your device for this purpose.
Content moderation, and reporting content whose reporting is legally mandated — Art. 6(1)(c) and 6(1)(f) GDPR.
Compliance with accounting, tax and other statutory obligations — Art. 6(1)(c) GDPR (legal obligation).
Service and product communications you have opted into — Art. 6(1)(a) GDPR (consent), withdrawable at any time.
Sending invitations, running client sessions and processing material that shows people other than the Member, so that Members can work together — Art. 6(1)(f) GDPR (the legitimate interest of Members and of us in enabling collaboration). Where a business uses the Platform for its own crew or clients, the business decides on this processing and we act as its processor (section 20).
4. We Do Not Train AI Models On Your Content
We do not use your uploaded images, video, audio, voice or prompts — or those of third parties that you upload — to train or improve AI models. We do not sell your content, and we do not licence it to anyone for training purposes. Your content is transmitted to an AI provider only to produce the output you requested, and only for the model you selected. Once transmitted, it is processed by that provider and by our AI gateway provider under their own terms and retention rules, as described in section 5.
Where we state that we process data to "improve the service", this refers to aggregate technical and usage metrics — never to the training of generative models on your content.
5. Recipients and Sub-processors
To deliver the service we rely on the following recipients. The full list of our sub-processors, with their location, is kept in the annex to our Data Processing Terms at depthstudio.ai/dpa.
Infrastructure and database: Supabase, Inc. (authentication, database, edge functions).
Storage and content delivery: Cloudflare, Inc. (R2 object storage, hosting, CDN, security and bot protection).
AI model providers, used only for the model you select: providers of image, video, language, speech and music models. Most models are reached through our AI gateway provider, NexusAI Services LLC (kie.ai, USA); speech-to-text transcription is performed by Groq, Inc. (USA). Your prompt and input files are transmitted solely to produce your output. Our AI gateway provider has confirmed to us in writing that it does not use what we send — prompts, input files, outputs or its task logs — to train or improve its own AI models. It cannot give that commitment for the upstream model providers, whose identity and processing locations it does not disclose; they process the input under their own terms and retention rules.
Transactional email delivery: Resend (Plus Five Five, Inc., USA), for account, security, invitation and notification messages.
Payments and billing: third-party payment service providers involved in your purchase. They receive the data needed to take and administer the payment — including your email address, billing and location details, payment method data and transaction records. Complete payment card details are not stored on our servers.
GIF search in chat: only the search term is passed through our server to GIPHY; your IP address is not sent to it.
Other users: members of the Teams and projects you work in, and clients you invite to a client session, see your name, email address and the content you share with them.
Public authorities, courts and professional advisers bound by confidentiality (such as lawyers and accountants), where this is necessary to comply with the law or to establish, exercise or defend legal claims.
A payment service provider does not act only on our instructions. For the payment itself it determines by itself how it processes the data required for payment handling, sales tax and VAT, invoicing, statutory record-keeping, fraud prevention and regulatory compliance, and for those purposes its own privacy notice applies. The provider that applies to your order is identified during checkout and on your receipt.
Our AI gateway provider deletes generated files after 14 days and keeps task logs — which can include your prompt and links to your input files — for 2 months. It does not delete them earlier, even on request. We copy finished results to our own storage, and we do not add your name, email address or account details to requests sent to AI providers; only what you write in a prompt or upload yourself is sent.
6. International Transfers
Some of our processors — in particular certain AI model providers, content delivery infrastructure and payment and billing providers — operate outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision, together with technical measures such as encryption in transit and minimisation of the data transmitted. Transfers carried out by a payment service provider for your purchase are governed by that provider's own privacy notice and safeguards. Our AI gateway provider (NexusAI Services LLC, USA) does not offer a data processing agreement, Standard Contractual Clauses or EU–U.S. Data Privacy Framework certification, so transfers to it are not covered by these safeguards. We limit what we send to it to what the generation you request needs, and we plan to move features that process images, video or voices of real people to providers that offer these safeguards. You may request further information about the safeguards in place.
7. Retention
Account and profile data: for as long as your account exists, and deleted within 30 days of account closure, subject to statutory retention obligations.
Content, prompts and generated outputs: until you delete them. Deleted items are first soft-deleted and remain recoverable from your history; the underlying stored file is permanently erased once no remaining record references it.
At our AI gateway provider: generated files for 14 days, and task logs — including prompts and links to input files — for 2 months; these cannot be deleted earlier. Model providers keep inputs under their own rules, which we do not control (section 5).
Invitations and client-session access: kept while the invitation or access is active and deleted together with the Team, project or client session they belong to, or earlier on request. One-time verification codes are stored only in hashed form and expire after 15 minutes.
Security, session and audit logs: up to 12 months.
Error and diagnostic logs: 30 days, then deleted automatically. We may keep aggregated error statistics that do not identify anyone for longer.
Product improvement records: 90 days, then deleted automatically. We may keep aggregated counts that do not identify anyone (for example, how often an option was chosen) for longer.
Billing and accounting records: for the statutory retention period applicable to accounting documents.
Consent records for the AI usage terms: for the duration of the account and for the limitation period thereafter, as evidence of consent.
8. Deleting Your Account
You can close your account yourself from Settings → Security → Delete Account. Before you confirm, we show you exactly what will be removed, together with anything you must resolve first — in particular, a team you own that still has other members must have its ownership transferred, because deleting your account would otherwise destroy their workspace.
A 30-day grace period applies. Nothing is destroyed during it, and you can cancel by signing in and choosing to keep your account. Signing in alone does not stop the countdown.
After the grace period an automated job permanently deletes your account, profile, projects you own, budgets, generated content, prompts, conversations and stored files.
Content you contributed to other members' projects remains with those projects but is detached from your identity, so their work is not destroyed by your departure.
Remaining credits are forfeited and are not refundable.
Copies held by our AI gateway provider cannot be deleted early; they are removed automatically within 2 months (section 7).
Billing and accounting records are kept for the statutory retention period, and the record of your deletion request is retained as evidence that the erasure was carried out.
You can also ask us to erase your data by writing to us; the self-service route exists so you do not have to wait for a response.
9. Security
We apply row-level access control at the database layer, encryption in transit, scoped and time-limited access to stored files, secret management outside the application source, multi-factor authentication for accounts that enable it, and audit logging of sensitive operations. No system is perfectly secure; we will notify you and the competent supervisory authority of a personal data breach where the GDPR requires it.
10. Your Rights
Access the personal data we hold about you and obtain a copy.
Rectification of inaccurate or incomplete data.
Erasure ("right to be forgotten"), subject to our legal retention obligations.
Restriction of processing, and objection to processing based on legitimate interests.
Data portability in a structured, commonly used, machine-readable format.
Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact [email protected]. We respond within one month, extendable by two further months for complex requests.
Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR); we then stop unless we demonstrate compelling legitimate grounds or need the data to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time and without giving reasons — every news email contains an unsubscribe link.
11. Complaints
If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or of the place of the alleged infringement. We would nonetheless appreciate the opportunity to address your concern first.
12. Changes
We may update this Policy. Material changes will be notified by email and through the Platform before they take effect. The date at the top of this document indicates the version in force. We archive previous versions and, on request, send you the version that applied at a given time.
13. Cookies and Local Storage
We do not use analytics, advertising or tracking cookies. The Platform stores only what it needs in your browser (cookies and local storage):
Necessary (always on): your sign-in session, account security and bot protection (Cloudflare Turnstile), and preferences you choose yourself, such as language, theme and layout. The Platform cannot work without them, so they do not require consent (Art. 5(3) ePrivacy Directive).
What is stored and for how long: your sign-in session in local storage, until you sign out or the session expires; your cookie and consent choice, for 12 months; interface preferences such as language, theme and layout in local storage until you change or clear them, and the open or collapsed state of side panels in a first-party cookie for 7 days; temporary working state of editors in local storage until cleared. Cloudflare Turnstile may set a short-lived security cookie on Cloudflare's own domain to check that a visit is not automated.
Payment: checkout opens on the payment provider's own page (Stripe / Link), which sets its own cookies under its own privacy policy. We do not load payment scripts on our pages.
External media (only with your consent): embedded YouTube videos. Until you allow this category, no YouTube player is loaded; you can still open the video on YouTube. When allowed, YouTube may set its own cookies under its own privacy policy.
Location (only with your consent): to show the weather for your city on the dashboard, your IP address is sent through our server to our weather provider (WeatherAPI.com). Without this consent no weather request is made.
Fonts, images and scripts are served from our own servers; we do not load fonts from Google or any other third-party font service. The only third-party resource loaded on every page is Cloudflare Turnstile (bot protection, necessary).
Your choice is stored in your browser for 12 months at most, together with the date of the decision. You can change it at any time via "Cookie settings" at the bottom of this page or of the home page.
14. Google User Data (Sign in with Google)
This section applies to the information Depth Studio receives when you choose "Continue with Google" (and, where enabled, "Continue with Microsoft"). It explains what Google user data we access, how we use it, with whom we share it, how we store and protect it, and how long we keep it.
Data we access: only the basic sign-in scopes — openid, email and profile. From them we receive your name, your email address and whether it is verified, your Google account identifier, and the address (URL) of your Google profile picture. We do not request access to Gmail, Google Drive, Calendar, Contacts, YouTube or any other Google service, and we do not keep an access or refresh token for calling Google APIs on your behalf.
How we use it: only to create your Depth Studio account, sign you in, link the sign-in to an existing account with the same verified email address, show your name inside the Platform (including to members of teams you join), and send you account and security emails at that address. We do not display your Google profile picture; your Depth Studio avatar is only one you upload yourself.
How we share it: we do not sell, rent or trade Google user data. It is disclosed only to (a) Supabase, which hosts our authentication service and database and stores it on our behalf; (b) our transactional email delivery providers, which receive your email address to deliver account and security messages — and news emails only if you opt in; (c) our payment provider (Stripe), which receives your name and email address only if you start a purchase of a paid plan or credits; (d) members of teams you join, who see your name and email address; and (e) public authorities where we are legally required to. It is never passed to AI model providers, advertisers or data brokers.
How we store and protect it: it is stored in your account record in our database hosted by Supabase. It is protected by row-level access control at the database layer, encryption in transit (HTTPS/TLS), secret management outside the application source, multi-factor authentication for accounts that enable it, and audit logging of sensitive operations (section 9). Only you and authorised Depth Studio administrators, for support and account administration, can view your account record.
Retention and deletion: kept for as long as your account exists and deleted within 30 days of account closure (sections 7 and 8). You can delete your account in Settings, ask us to delete your data at the contact address in section 1, or remove Depth Studio's access at any time in your Google Account (Security → Third-party apps & services).
What we never do with Google user data: sell it; use it for advertising, retargeting or interest-based ads; transfer it to data brokers or information resellers; use it to determine credit-worthiness or for lending; or use it to develop, improve or train AI or machine-learning models.
Depth Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
15. Sign in with Microsoft or Apple
If you sign in with Microsoft, we receive the same basic information as from Google — your name, email address and account identifier (scopes openid, email and profile) — and use, share, store and delete it under the same rules as in section 14. Sign in with Apple is shown as "coming soon" and is not yet active. When it is enabled, Apple may give us your name and either your email address or a private relay address created by Apple, which we will treat in the same way.
16. Automated Decision-Making
We do not take decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The safety systems of AI providers automatically refuse individual generation requests; such a refusal concerns only that request. Decisions to remove content or to suspend an account are taken by a person (Terms of Use, section 15).
17. Do You Have to Provide Your Data?
Your email address and the data needed to sign in are necessary to conclude and perform the contract; without them we cannot open an account.
Billing and address data are needed by the payment provider to complete a purchase and to meet tax obligations; without them a purchase is not possible.
Everything else — a profile photo, job title, news emails, location for the weather — is optional. If you do not provide it, only the related feature is unavailable.
You are under no statutory obligation to provide personal data to us.
18. Children and Minors in Content
Account holders must be at least 16 (Terms of Use, section 1). We do not knowingly process the account data of children under 16; if we learn that a child under 16 has registered, we close the account and delete its data. Parents and guardians can contact us at the address in section 1.
Members may upload material in which an identifiable minor appears only with the written consent of the minor's parent or legal guardian, and never in a sexual, violent or degrading context. Sexualised depictions of minors are prohibited and are reported to the authorities (Terms of Use, section 6).
Kagami, which alters real footage, asks for a separate confirmation of these rules before its first use.
19. Faces, Voices and Sensitive Data
Some features change the face, body or voice of a person in an image, video or audio recording (for example Kagami), or produce speech in a voice. We process this material only to produce the output the Member requests, not for the purpose of uniquely identifying a person, and not to infer health, ethnic origin, political opinions or any other special category of data.
Please do not upload special categories of personal data (Art. 9 GDPR) — such as health data or data revealing ethnic origin, religion or sexual orientation — unless this is necessary for your project and you have a lawful basis for it, such as the explicit consent of the person concerned.
For material showing other people, the Member who uploads it decides why and how it is processed and is responsible for having a lawful basis and the consent of the people shown (Terms of Use, section 4). Where the Member is a business, we process that material as its processor (section 20).
20. Business Customers
When a business uses the Platform for its own work — for example to manage its crew, cast or clients in a Team or a client session — the business is the controller of the personal data it places on the Platform, and we process that data on its behalf as processor under our Data Processing Terms (depthstudio.ai/dpa). People whose data is held in such a workspace should direct requests about it to that business; we pass on any request we receive and help the business to answer it. We remain the controller of the account, security and billing data of every person who has an account.
21. Transfer of the Business
If the operation of the Platform is transferred to a successor — for example a company set up to operate it — your personal data will be transferred to that successor, which will continue to process it under this Policy. We will inform you in advance.