Privacy policy

Who processes your data, which data, why, for how long and with whom. On one page, no surprises.

1. Controller

Shadai Iborra Cardó (DNI 45962709S), C/ Major 23, bajos, 08397 Pineda de Mar (Barcelona), Spain. Privacy contact: sha@amediastory.com.

2. What data we process

Account: your email, your name if you give it to us (or your Google account name if you choose to sign in with Google), your language, your open sessions (type, computer name for the app and last activity date) and the version of the terms you accepted.

Payments: handled by Stripe as merchant of record. We receive the amount, the pack bought and an order identifier; never your card details.

Content you send for processing: the audio of your sources as FLAC, the script, technical metadata of the material and a very light copy of the video (480p, muted) used to review the cut if something fails. The original video does not leave your machine.

Usage: job identifiers, minutes processed, credits quoted and charged, app version and error codes. Chat messages and script requests go through our relay to the AI provider (see section 5).

3. Why, and on what basis

Providing the service (performance of the contract): giving you access to your account, processing your sends, returning the cut, charging your credits and giving support.

Improving the engine (consent, optional, given on each job with «Help improve» and withdrawn any time in «Your jobs» in the app): reviewing that job (its audio and a light copy of the video) and keeping it as an engine test case for 90 days at most; if we no longer need it, we delete it sooner. Withdrawing the permission deletes that copy right away and we stop using the job for this.

Security and accounting (legitimate interest and legal obligation): technical logs to detect abuse (for example, limiting sign-in links by email), and purchase amounts kept without identity as required by accounting rules.

4. For how long

Audio and script of each job: 7 days (within that time it can be edited again at a discount; after that, it is sent again). The resulting cut: 30 days. What you let us use to improve the engine: 90 days at most, or until you withdraw the permission. Technical records of jobs and credits (numbers, not content): 24 months. Purchases and their accounting entries are kept for the period required by commercial and tax law (up to six years) and, after you close your account, with no data that identifies you.

When you close your account from "My account" or from the app, it is deactivated the same day: jobs are cancelled, sessions are closed and your material is deleted from the server. If you sign in again within the next 30 days the account is restored; after that your personal data is erased for good (email, name, language, the names of your machines, sign-in links and codes). Of the purchase and credit records we keep what tax and accounting rules require, with no data left that identifies you.

5. Who else sees them (processors)

Anthropic (United States): the AI model that writes scripts and answers the chat, and the one that cuts when you choose the AI levels. Standard contractual clauses; does not train on your data; keeps requests for up to 30 days.

Google: only if you choose “Continue with Google”, to verify your identity (we receive your email and name). OVH (France, EU): the server where what you send and the result are stored, with the retention periods above. Brevo (EU): sign-in and notification emails. Stripe: payments and invoices.

Our analysis team: the assembly is done by our engine on our own machines in Spain (EU), which download your material from the server encrypted in transit; each job's folder is deleted when it finishes.

6. Your rights

Access and portability (download your data from “My account”), rectification, erasure (the “Close my account” button, with the 30-day period described above), objection and restriction. Write to sha@amediastory.com; we answer within a month. If you disagree, you can complain to the Spanish data protection authority (aepd.es).

7. Minors

The service is for people aged 18 or over.

8. Security

TLS encryption on every connection, passwordless sign-in with single-use links that expire, sessions you can close from your account, encrypted backups and an incident plan: if an incident affected your data we would tell you and, where required, the authority within 72 hours.

9. Changes

Every version of this policy is dated; the consents you give are recorded with the version you accepted. Relevant changes are announced by email.

Last updated: 2026.