Privacy Policy

How we protect your personal data.

Last updated:: 21 October 2026

Scenivia is committed to transparency about how it collects and uses personal data. This Privacy Policy explains what data we process when you use the Scenivia website (scenivia.com) and the application it hosts, why we process it, how long we keep it, and the rights available to you. It is written to comply with the GDPR and the French Data Protection Act (Act No. 78-17 of 6 January 1978), as overseen by the CNIL.

1. Data controller

The controller responsible for processing your personal data is:

Data controller:: Scenivia
Contact email:: contact@scenivia.com

Full identification of the controller, including its registration numbers and registered office, appears in the Legal Notice. For any question about this policy or about your personal data, write to us through the contact form at https://scenivia.com/contact. No Data Protection Officer has been appointed; data protection questions go to the same place.

2. Data we process

We only collect the data needed to provide the service. We process the following categories:

Account and subscription data: name, username, email address, login credentials, your plan (free access or a paid subscription, whichever the pricing page lists), and, if your account was created from an invitation, that invitation.
Billing and payment data: processed securely by our external payment provider.
Project inputs you provide: URLs you submit, screenshots and images you upload, and the briefs you write to generate a video.
Generated content: the animated launch videos, editable scenes, project files, and HD MP4 exports created from your inputs.
Usage and credits data: your credit balance and export history.
Navigation and audience data: analytics about how the site and app are used (pages viewed, time spent, device type, traffic source, actions taken in the editor such as adding a shot or starting an export, how long they took and the errors they met). Our analytics provider, hosted in the European Union, receives them through our own domain, discards IP addresses on arrival and never stores them; a visitor is identified by a random identifier held in your browser. If you are signed in and have accepted audience measurement, that identifier is linked to your account's internal identifier, never to your name or email address, so we can measure the journey from visiting the site to using the service; signing out breaks that link in your browser. If you refuse audience measurement, only anonymous visits are counted, with no cookie and no identifier stored in your browser: our provider groups them with a fingerprint computed on its side and renewed every day, which cannot follow you from one day to the next. Withdrawing your analytics consent stops the identified measurement, but the identifier already set stays in your browser until you clear your site data. We never collect the text of your briefs, your scripts or your messages to the assistant, the names of your projects, the content of your scenes, or the full address of the sites you import: only their domain and whether reading them succeeded.
Email delivery data: whether an email we sent you was delivered, bounced or was reported, as our sending provider tells us. We do not measure whether you open an email or which links you click: no invisible image is placed in our messages.
Technical connection data: your IP address and your browser's user agent, which we keep in our own systems for session security, rate limiting, anti-abuse and the audit log of administrative actions.
Messages you send us through the contact form: the subject you choose, your email address and the content of your message.
Waitlist and referral data, if you joined the waitlist: your email address, the use case you may describe, your referral code and the one you were referred by, how many people you referred, fingerprints derived from your email address and IP address, and the resulting anti-abuse risk signals and review status.
Session recording, only if you accept it in the banner: a reconstruction of your screens, mouse movements and clicks that shows us where the journey gets stuck. Everything you type into a field is masked, and so are the text, pictures and videos of your films in the editor, and the content of your account, billing, two-factor authentication and legal pages is never recorded. A recording is linked to your account the same way audience measurement is.

An email address and account credentials are necessary to create an account and to enter into the contract: without them no account can be created and the Service cannot be used. The use case field on the waitlist is optional. The URLs, screenshots and briefs you submit are not needed to hold an account, but no video can be generated without one of them.

3. Purposes and legal bases

Each processing activity relies on a legal basis under Article 6 of the GDPR:

Performance of a contract (Article 6.1.b): to provide the service, generate and export your videos, and manage your subscription and credits.
Legal obligation (Article 6.1.c): to issue invoices and keep accounting records as required by the French Commercial Code.
Legitimate interest (Article 6.1.f): securing the platform, preventing abuse and improving our services, including anonymously counting the visits of people who refuse audience measurement.
Consent (Article 6.1.a): sending marketing communications, setting non-essential cookies and recording your sessions, where applicable.

4. Recipients and sub-processors

We share personal data only with the service providers needed to operate Scenivia, each acting on our instructions under a data processing agreement. By role:

Cloud hosting and infrastructure, which store and serve the application and your files.
Payment and billing.
Transactional email delivery.
Audience measurement, analytics and session recording, hosted in the European Union.
AI processing used to generate videos, which receives the URLs, screenshots, briefs and assistant messages you submit. These providers do not use that content to train their models and keep it for at most thirty days, for abuse detection.
Error tracking, which receives the technical details of a failure so we can diagnose it.
Edge protection and anti-bot filtering, which sees the IP address of every request to the Service.
Background job execution, which runs video generation and export work on your project data.
Social sign-in, where you choose to sign in with a third-party account.

We never sell your personal data to third parties.

5. Transfers outside the European Union

We host the application in the European Union and store your account data, your project inputs and the videos generated from them within the European Union / EEA. Some sub-processors operate outside the EU, in particular the providers of the AI models used to generate videos, and what is sent to them for that purpose leaves the EEA. Those transfers are governed by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or, where it applies, its adequacy decision for the EU-US Data Privacy Framework. Ask through the contact form at https://scenivia.com/contact and we will tell you which safeguard applies to which sub-processor.

6. Retention periods

We keep personal data only for as long as necessary:

Account and subscription data: for the duration of your account, then archived for the legal limitation period.
Project inputs (URLs, screenshots, briefs) and generated content: kept on our secure servers while your account is active or until you delete them. An exported video is removed from our servers three years after it was rendered; download it before then if you want to keep it.
Invoices and accounting records: 10 years, as required by the French Commercial Code.
Marketing and prospecting data: up to 3 years from your last contact with us.
Cookies and trackers: up to 13 months, and the record of your choice for that same period. Session recordings: 30 days at most.
Technical connection data: session records for as long as the session lasts, rate-limiting counters for up to 24 hours after their last use, and the audit log of administrative actions for 12 months.
Messages sent through the contact form: 2 years from receipt.
Waitlist and referral data: an entry is deleted three years after the last contact that came from you, meaning the later of the date you joined and the date you confirmed your email address, or sooner if you ask us to remove it. While an account exists under the same email address, the entry is kept with that account; the three-year period applies again once that account no longer exists.

7. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), strict access controls, secure European hosting, and audience measurement configured so that our analytics provider discards IP addresses rather than storing them.

8. Cookies and trackers

We use five categories of cookies and trackers, the same five the consent banner lets you decide on:

Necessary: session, security, and language preferences. Essential for the site to work, always on, and exempt from consent.
Audience measurement: pseudonymised analytics that show how the platform is used, so we can improve the user journey. If you refuse it, anonymous visits are still counted, with no cookie and no identifier.
Session recording: the reconstruction of your screens and clicks described in section 2, without what you type or the content of your films. Only with your consent, and only if you also accept audience measurement.
Personalization: remembers your choices so the experience matches your preferences. Placed only with your consent.
Marketing: measurement of our own campaigns and conversions. Placed only with your explicit consent.

You can accept, refuse, or change your cookie choices at any time through our consent banner.

Our emails carry no tracker: no invisible image measuring opens, no tracking links. Every marketing email includes an unsubscribe link, and that is what stops the sending.

A second thing does not go through the banner, and it is not a cookie either: our servers record the events the service needs to run, such as an account being created, a payment succeeding, or a video export failing. They are recorded under our legitimate interest (Article 6.1.f) whatever you choose in the banner, because they describe what the service did, not how you browse. They are not audience measurement: page views, sessions, and browsing behaviour are measured only in your browser and only if you accept audience measurement above. If you are signed in and have accepted audience measurement, your browsing is linked to your account's internal identifier, the same one these events are recorded under, and these events carry the identifier of your browsing session, so the two can be read together.

9. Your rights

Under Articles 15 to 22 of the GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data
Restrict processing
Receive your data in a portable format
Object to processing
Withdraw your consent at any time, without this affecting the lawfulness of the processing carried out on the basis of that consent before it was withdrawn
Give directives on the fate of your data after your death

To exercise these rights, write to us through the contact form at https://scenivia.com/contact. We will respond within one month, extendable by two months for complex requests. If you believe your rights are not respected, you may lodge a complaint with the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

The right to object is stated here on its own. You may object at any time, on grounds relating to your particular situation, to the processing we base on our legitimate interest, which is securing the platform, preventing abuse and improving our services. You may also object at any time, and without giving a reason, to the use of your data for direct marketing, including the measurement of whether our emails are opened.

10. Automated processing and profiling

Scenivia uses automated processing to generate animated videos from the URLs, screenshots, and briefs you provide. This processing produces creative output only and has no legal or similarly significant effect on you within the meaning of Article 22 of the GDPR. We do not use profiling to make automated decisions about you.

11. Changes to this policy

We may update this Privacy Policy from time to time. Any material change will be communicated through the site or the application, and the "Last updated" date above will be revised.

Back to home