Legal

This English version is provided for convenience. Only the German version is legally binding; in case of any discrepancy, the German version prevails.

Star Media GmbH Nottebohmweg 18 59494 Soest Germany Email: info@clipstage.tv Represented by the managing directors Dieter Bleicher and Jens Twesmann.

Personal data is any data by which you can be personally identified. We collect data that you provide to us — when you sign in, in your conversation with the director and when you upload photos or videos — as well as technical data when you visit the website (e.g. IP address, browser, operating system, time).

We use your data to create and deliver your film (your input is turned into the script, character, voice, music, images and videos), for billing and for emails relating to your order. The legal basis is the contract with you (Art. 6(1)(b) GDPR). We retain invoice data because tax and commercial law require us to (Art. 6(1)(c) GDPR). To ensure secure and error-free operation, we process technical data on the basis of our legitimate interest (Art. 6(1)(f) GDPR). For your own avatar, we need your express consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), see section 8 — likewise if someone invites you to take part in a film, see section 9.

The website is delivered via Vercel Inc. (USA): vercel.com/legal/privacy-policy. In the process, Vercel processes technically necessary access data such as IP address, time of access and page requested. Film production runs on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in the Falkenstein data centre (Germany): hetzner.com/de/legal/privacy-policy. This is where your conversations with the director, scripts, uploads, films, saved characters and — if you create one — your avatar are stored, as well as the images of contributors (section 9). Files that you have checked for a ClipStage AI label at clipstage.tv/en/pruefen are processed only there and only for the check: we delete the file immediately afterwards and store neither the file nor the result. To prevent misuse, we keep your IP address for one hour (no more than ten checks per hour). The legal basis is our obligation to make AI-generated content identifiable (Art. 50(2) AI Act, Art. 6(1)(c) GDPR) and your interest in the check (Art. 6(1)(f) GDPR).

You sign in without a password: you enter your email address and receive a code by email. Sign-in is handled by Supabase, which stores your email address and sign-in data in its EU region. Supabase sends the email with the code via Resend.

For film production, we use processors and give them only the data that the respective step requires: – Anthropic (Claude): conversation with the director and script – Google (Gemini API): images, voices, music, moving scenes and the automated checking of results, avatar recordings and recordings of contributors – fal.ai: lip movement matching the voice, and sound effects – ElevenLabs: your own voice for your avatar (see section 8) – Resend: sending emails Some of these providers are based in the USA. The transfer is based on the EU-US Data Privacy Framework or on standard contractual clauses of the EU Commission. Your data is processed there solely to create your film or avatar.

Only upload photos and videos of people if they have agreed to it. We do not show children in moving AI scenes. We do not recreate real people as characters — except yourself as your own avatar (section 8) and contributors who have recorded themselves live and given their consent (section 9).

Where offered, you can create your own avatar with your face and voice from a live recording in the app. The recording is made only live, never from a file, and shows only you. You must be at least 18 years old and give your consent by ticking a box and speaking a consent statement with a personal code in the recording. After the recording, we automatically check whether the consent, image and sound are in order; for this purpose, the sound and image are transmitted to Google (Gemini API). If the recording is rejected, we delete the image and sound immediately and keep only the reason for the rejection, and that too for no more than 90 days. If the check fails for technical reasons, we keep the recording for no more than one day for a new attempt. If you do not buy an avatar from a checked recording, we delete the recording 90 days after the check, but no earlier than 90 days after the avatar package has become available; we remind you by email 14 days beforehand. Optionally, directly after the recording, you can add a head-to-toe photo, likewise taken only live in the app — using the self-timer or by someone else. This ensures that your avatar’s build and clothing are right in the film; your face always comes from the recording. You give your consent to this by ticking a separate box. We transmit the photo to Google (Gemini API) to check it (only one person, head to toe) and to match it with your portrait. We do not store a rejected photo; we remove metadata such as the location where it was taken. You can delete the photo on its own at any time. The recording, portrait, full-body image and voice profile are stored on our server in Germany. For your own voice, we create a voice clone at ElevenLabs. It is kept there only as long as you use it: after 14 days without use, we delete it from the voice service and, if needed, create it again from your recording. You can withdraw your consent at any time with effect for the future and delete the recording, voice and images in the app — including the voice clone at the voice service. If you delete your account, your avatar is deleted along with it.

Anyone who orders a film from ClipStage can invite other people — such as colleagues or friends — to take part in that film. Star Media GmbH (section 1) is the controller for this as well. If you are invited, you receive an email with a personal link; you do not need an account. We process your name and email address (provided by the person inviting you), a short live video of your face lasting a few seconds in which you turn your head, three still images taken from it, a short description of your hair and glasses (so that you appear in the right place in the group picture) and the text of your consent together with the time it was given. The video is made only live with the camera of your device, never from a file. We do not use your voice; if your device records sound, we discard it. The sole purpose is to show your face in exactly one film of the person who invited you. We do not use your images for other films or other customers. The legal basis is your express consent (Art. 6(1)(a) GDPR and, insofar as images of your face count as special categories of personal data, Art. 9(2)(a) GDPR). You must be at least 18 years old and give your consent by ticking two boxes and recording yourself. We send the invitation at the request of the inviting person; the legal basis for this is our legitimate interest and that of the inviting person (Art. 6(1)(f) GDPR). After the recording, we automatically check whether the video was made live and shows only you, and select the still images; for this purpose, the video is transmitted to Google (Gemini API). For the scenes of the film, the service providers listed in section 6 process the still images to the extent that the respective step requires them, above all Google (Gemini API) for images and moving scenes; the information given there applies to the transfer. The video, still images and consent are stored on our server in Germany (section 4); we send the emails via Resend. The finished film is received by the person who invited you. We delete the video immediately after the check. We delete the still images 30 days after the film is completed, or immediately if you withdraw your consent. An invitation that is not used expires after 14 days. We store your name, email address and the proof of your consent with the film until the inviting person removes you or deletes the film or their account. You can withdraw your consent at any time with effect for the future: via the link in your invitation or by email to info@clipstage.tv. We then delete your images immediately, and you are no longer included in any scene. We cannot retrieve copies of the finished film that the inviting person has already received. We do not make any automated decision within the meaning of Art. 22 GDPR; if the automated check rejects your recording, you can simply record yourself again.

We do not use tracking or marketing cookies. To keep you signed in, the website stores your session in your browser’s local storage, and the app stores it on your device. In addition, the website remembers whether you have already closed a notice, and both the website and the app remember the name under which you last invited contributors. This is technically necessary (§ 25 Abs. 2 Nr. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)).

We use Stripe (stripe.com) for payments. You enter your payment details directly with Stripe; they are processed exclusively by Stripe and never stored on our servers. Stripe is PCI DSS Level 1 certified. On your first purchase, Stripe stores your payment method with your consent (card, including via Apple Pay or Google Pay, or Link) so that you can pay for further test videos and the finished film with one click. We store only the identifiers under which Stripe holds you as a customer and your payment method, plus the brand and last four digits, so that you can see in your account which card is on file. The legal basis is the contract with you (Art. 6(1)(b) GDPR). You can remove the stored payment method at any time in your account under “Payment methods”. We then detach it from your customer account at Stripe and no longer use it; on your next purchase, you enter payment details again. We keep the identifier of your customer account at Stripe for our records. More on data protection at Stripe: stripe.com/de/privacy

We send you emails about signing in, after each purchase and when your test video or film is ready. The sender is film@clipstage.tv; replies go to info@clipstage.tv. Emails are sent via Resend. If you invite contributors, we send them an email at your request with your name and the title of the film. If you write to us, we use your message to handle your enquiry. Our mailbox info@clipstage.tv is hosted by Microsoft 365 (Microsoft Ireland Operations Ltd.) as a processor, with storage in the EU; insofar as Microsoft transfers data to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses. The legal basis is the handling of your enquiry (Art. 6(1)(b) or (f) GDPR).

We store films, uploads and saved characters until you delete them or your account. A purchased avatar without the “My Avatar” subscription is deleted twelve months after your last film with it, together with the recording, images and voice clone; we remind you by email one month beforehand. With a subscription, it remains stored until you delete it or your account. If you delete your account (under “Your account”), we delete your films, uploads, characters and avatar recordings immediately, and your sign-in data within a few days. As proof of the deletion, we keep a record with your email address and the time. A stored payment method remains on file with Stripe until you remove it or delete your account. We retain invoice data for as long as tax law requires. For contributors, the periods set out in section 9 apply.

You have the right at any time to obtain information free of charge about your stored data, its origin, recipients and purpose, as well as the right to rectification, erasure, restriction of processing and data portability. Where we process data on the basis of our legitimate interest, you can object. You can withdraw any consent at any time with effect for the future. To do so, write to us at info@clipstage.tv. You can also lodge a complaint with the competent supervisory authority: the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia).