What we keep,
and why.

01 / WHO IS RESPONSIBLE

Who is responsible

Tarkovsky AI LLC, a Delaware limited liability company, is responsible for the personal information in Tarkovsky (in EU and UK law, the “controller”). You can reach us at hello@tarkovsky.ai.

When you invite people to a project or to your account, you decide what they see. If you put other people’s personal information into a project, for example names in a script or faces in a photo, you must have the right to do so.

02 / WHAT WE COLLECT

What we collect

What you give us

• Account: your name, your email address and whether it is verified. Auth0 gives us these when you sign in; Auth0 may get them from Google or another sign-in you choose. We give your account an identifier.
• Agreements: the version of the Terms of Service and this notice you accepted, and when; every “Improve Tarkovsky for everyone” choice you make, and when.
• Projects: scripts, briefs, notes, prompts, directions, your chats with the assistant, uploaded images, video, audio and documents, and the history of a project (drafts, decisions and edits).
• Collaborators: the email addresses and roles of the people you invite to a project or to your account. We use them to send the invitation and to give access.
• Provider keys: the API keys you add for model providers. We store them encrypted and show only their last four characters.
• Messages: what you send us through the contact form or by email (name, email address, subject and message), and the questions you ask the help assistant.
• Payments: your plan, your credit balance and history, and your orders. Stripe collects your card and billing address at checkout. We receive a customer reference and the result of the payment, not your card number.

What the studio makes and records

• Generations: what each one asked for (model, prompt, settings and references), its result and status, its cost, and the credits held and charged.
• Outputs: the stills, takes, voices, music, checks, edits and films the studio makes for you.
• Activity: when your account was created, when you were last seen and the days on which you used the studio.
• Technical data: your IP address and browser details in our server and firewall logs, used for security and rate limits.
• Customer notes: if you work with us as a customer or partner, our team may keep notes about the account, such as your company and our next follow-up.

Cookies and browser storage

• We use one sign-in session cookie. The studio needs it to work. It lasts up to 7 days.
• The studio keeps a few settings in your browser, such as the light or dark theme and how a view is laid out.
• We use no advertising or analytics trackers. Stripe’s checkout page sets its own cookies, under Stripe’s policy.

Sensitive information

We do not ask for sensitive information, such as health, beliefs or biometric data. A face or a voice in your media is used only to make what you ask, for example to keep a character the same from shot to shot. We never use it to identify a person.

03 / WHY, AND OUR LEGAL BASES

Why we use it, and our legal bases

The law in the European Union and the United Kingdom asks us to name a legal basis for each use. They are in the right-hand column.

Improving Tarkovsky

We want the studio to make better films for everyone, so a Director learns which model suits which kind of shot, what made a retake necessary and which checks were right. We have weighed this interest against your rights:

• a lesson is abstract and keeps no script text, no names of characters or people, no faces, no voices and none of your media;
• you are told about it before you make your first film, in the welcome box;
• you can opt out at any time, with one click, by unticking “Improve Tarkovsky for everyone” in Account. From then on your films are never used;
• a shared project is used only if its owner and every collaborator who can edit it have left the choice on.

The ticked box in the welcome box is a notice with an opt-out. It is not a request for your consent, and we do not treat it as consent.

Consent

If we ever ask for your consent, we will ask in a separate, clear step. You can withdraw it at any time, and withdrawing does not affect what we did before. At present the studio relies on consent for nothing.

Automated decisions

We do not make decisions about you that have legal or similarly significant effects by automated means alone.

04 / WHO WE SHARE IT WITH

Who we share it with

We share personal information with the service providers that help us run Tarkovsky, under contracts that limit what they may do with it, and in the cases listed below. We do not sell personal information, and we do not share it for targeted advertising.

A model provider receives only what a request needs, uses it to make the result and handles it under its own terms. Some providers keep requests for a limited time, for example to detect abuse.

Others

• People you share with: the members of a project or of your account see what is in it, including your name and email address as a member.
• Advisers: our lawyers, accountants and auditors, who must keep it confidential.
• Authorities: when the law requires it, or to protect the safety of people, our users or Tarkovsky. For example, we report child sexual abuse material to the National Center for Missing & Exploited Children.
• A buyer: if Tarkovsky AI LLC merges, is bought or sells its business, personal information may pass to the new owner, which must respect this notice. We will tell you.

05 / INTERNATIONAL TRANSFERS

International transfers

Tarkovsky AI LLC is based in the United States. We store the Service’s data in the European Union: in Frankfurt, and in Stockholm while a film renders. Some providers process it in the United States or other countries, for example Auth0, Stripe, OpenRouter and the model companies behind it, ElevenLabs, Lambda, Resend and Google.

When personal information from the EU, the UK or Switzerland goes to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework, its UK Extension or the Swiss–US Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (with the UK Addendum), with extra safeguards where they are needed. Email us for a copy of the safeguards that apply.

06 / HOW LONG WE KEEP IT

How long we keep it

• Account and projects: while your account is open. Archiving a project does not delete it.
• When you ask us to delete your account, we delete your account, projects and media within 30 days, except what we must keep, below.
• Backups: copies in backups are removed as those backups expire on their normal cycle, usually within 35 days after deletion.
• Payment and credit records: 7 years after the end of the year of the transaction, for tax and accounting.
• Agreement records (what you accepted, and your Improve choices): while your account is open and for 6 years after it closes, so we can show what was agreed.
• Activity records: while your account is open. Server and firewall logs: up to 12 months, unless we need them longer to investigate abuse.
• Messages to us: as long as we need them to answer and follow up, and no more than 3 years after our last exchange.
• Model providers keep what we send under their own terms.
• Lessons the Director has learned are kept. They hold nothing that identifies you or your work.

07 / YOUR RIGHTS

Your rights, and how to use them

Depending on where you live, you can ask us to:

• give you a copy of your personal information (access);
• correct it;
• delete it;
• restrict how we use it;
• stop using it for something you object to. This includes improving Tarkovsky: untick “Improve Tarkovsky for everyone” in Account and it applies at once. You can object in the same way to anything we do on the basis of legitimate interests;
• give you the data you gave us in a portable format. The Export tab already gives you each project as a file and its media in a ZIP;
• let you withdraw a consent you gave.

How: email hello@tarkovsky.ai from the address of your account, so we can check it is you. We answer within one month. If a request is complex, we may take up to two more months, and we will tell you why. Using your rights is free, unless a request is clearly unfounded or excessive.

Complaints: you can complain to a data protection authority: in the EU, the authority where you live or work; in the UK, the Information Commissioner’s Office. Please write to us first, so we can try to help.

In the United States, depending on your state (for example California, Colorado or Virginia), you may have the right to know, access, correct and delete your personal information, and to opt out of its sale, of targeted advertising and of profiling. We do not sell personal information, share it for cross-context behavioural advertising, or use it for profiling with legal effects. An authorised agent may make a request for you. We will not treat you differently for using your rights.

08 / SECURITY

Security

We use encrypted connections, private file storage, encrypted API keys, restricted database access, rate limits and a web application firewall, and we keep backups. No system is perfectly secure. If a breach affects your personal information, we will tell you, and the authorities, as the law requires.

09 / CHILDREN

Children

Tarkovsky is for people aged 18 or over, or the age of majority where they live if that is higher. We do not knowingly collect personal information from children. If you think a child has given us personal information, email us and we will delete it.

10 / CHANGES

Changes to this notice

We may update this notice. Each version has a number and a date at the top. If a change is material, we will tell you before it takes effect, by email or in the studio, and the studio will ask you to accept the new version before you continue. Your choice about improving Tarkovsky stays as you set it.

11 / CONTACT

Contact

Tarkovsky AI LLC · hello@tarkovsky.ai

For a privacy question or request, email us and put “Privacy” in the subject line.