Privacy Policy

This explains what [legal entity name] collects when you use Arka, why, and what control you have. We have tried to write it in plain language.

What we collect

• Account — your name, email address and country. A password hash if you sign up with email; a Google account identifier if you use Google.
• Content — the titles, prompts and settings you submit, and the videos generated from them.
• Usage — which pages you visit and which features you use, through PostHog analytics.
• Billing — payment records and invoices. Card details go directly to our payment provider; we never see or store them.
• Technical — IP address and browser user agent, in server logs and session records.

Why we collect it

• To run the service: generate your videos, store them, and show them back to you.
• To operate credits and billing, and to prevent abuse of free credits.
• To understand which features are used, so we build the right things.
• To meet legal and tax obligations.

Who we share it with

Only the processors we need to run Arka:

• fal.ai — receives your scene descriptions, reference pictures and narration lines to draw the pictures, animate them and voice them. fal runs some models itself and passes requests for others to the company that makes the model (for example Google for pictures, Kuaishou or Alibaba for animation, ElevenLabs or MiniMax for voices, Beatoven for music).
• Anthropic — receives your story to write the script and shot list, and the lines you ask the script assistant to rewrite.
• OpenAI — when enabled, reads the title, story and narration you submit, and the pictures and frames of the film that were generated, to check them against our content rules.
• Cloudflare R2 — stores the generated files.
• Neon — hosts our database (your account, projects and billing records).
• Resend — sends our emails, such as sign-up and “your film is ready”.
• Razorpay — processes payments.
• Vercel — hosts the application.
• PostHog — product analytics.
• Google, TikTok, Meta — only if you connect an account to publish to it: the video and the title, description and settings you choose.

We do not sell your personal data, and we do not share your prompts or videos with advertisers.

Several of these companies process data outside India, including in the United States. We send them only what each needs for its part of the work.

Model training

We do not use your prompts or generated videos to train our own models — we do not train models. Third-party providers have their own policies on whether submitted prompts may be used for training; check the current policy of the provider handling your render if this matters to you.

How long we keep it

• Videos — until you delete the project, or until your account is closed.
• Project records — retained after deletion in reduced form, so our credit and cost history stays consistent. The video files themselves are deleted.
• Billing records — retained as long as tax law requires, typically eight years in India.
• Server logs — [retention period].
• Reminders and notifications — at most one email about a film you planned but did not make (every one has a one-click link to stop them for good), and, only if you turn them on, browser notifications when a film is ready. For those we keep the address your browser's push service gives us, and forget it when you turn notifications off or the browser stops accepting them.
• Complaints made through our complaint form — kept as the record that they were answered. Your name, email and message are stored encrypted. If you close your account, they are removed from complaints you filed while signed in, once they are closed.

Your rights

You can access and correct your details in Settings, and delete any project from its page. To request a copy of your data or deletion of your account, write to [privacy email address]. We respond within 30 days. You can also make the request through our complaint form, which gives it a reference number.

Depending on where you live, you may have additional rights under India’s Digital Personal Data Protection Act, the GDPR, or similar laws.

Cookies

We use a session cookie to keep you signed in. That one is essential and cannot be turned off while you are logged in. Analytics cookies are used only if PostHog is enabled for your session.

Security

Passwords are hashed, API keys are stored only as hashes, and generated videos are served through short-lived signed links rather than public URLs. No system is perfectly secure; if we discover a breach affecting you we will notify you promptly.

Children

Arka is not intended for anyone under 18. We do not knowingly collect data from children.

Contact

Data protection contact: [privacy email address], [registered address].

This is a starting template, not legal advice. Have a lawyer review it against your actual data flows and jurisdiction before launch.