Privacy Policy
Last updated: 11 September 2026
1. Who we are
MovieMaster (previously released as Cronicle) is an AI filmmaking service operated by Innolope LLC, a limited liability company organised under the laws of the State of Delaware, United States (“Innolope”, “we”, “us”, “our”). Innolope LLC is the data controller for the personal data described in this policy.
This Privacy Policy explains what we collect when you use the MovieMaster website and application (the “Service”), why we collect it, who we share it with, and the choices and rights you have. It applies to everyone who visits our site or holds a MovieMaster account.
Questions, requests or complaints about privacy go to [email protected], and we answer them ourselves.
2. Information we collect
2.1 Information you give us
- Account details. Your email address, and a password if you do not sign in with Google. Authentication is handled by Google Firebase Authentication; we never see or store your password in readable form.
- Project content. Scripts and narrative text you paste or type, project titles, character descriptions and attributes, shot descriptions, image and video prompts, location and style notes, and any reference photographs you upload.
- Collaboration data. Email addresses you enter to invite collaborators, and the roles you assign them.
- Support correspondence. Anything you send us by email, including the contents of bug reports.
2.2 Information we generate about you
- Generated media. Portraits, shot images and video clips produced from your prompts, together with the prompt text, model name and timestamp used for each generation.
- Credits and usage. Your credit balance and a ledger of credit deductions and refunds, recording which action was taken, on which project, and when.
- API keys. If you create a key for the MCP integration, we store a cryptographic hash of it — never the key itself — along with its label and last-used time.
2.3 Information collected automatically
- Technical and diagnostic data. IP address, browser and device type, pages visited, and error reports including stack traces and the request that failed. Error monitoring is provided by Sentry.
- Security data. Rate-limiting counters tied to your account or IP address, used to detect and stop abuse.
- Cookies and local storage. See section 8.
We do not ask for, and ask that you do not submit, special categories of personal data (such as health, biometric, political or religious information) or the personal data of children.
3. How we use your information
We use personal data only for these purposes:
- To provide the Service — storing your projects, splitting scripts into shots, generating portraits, images and video, and making your work available to you and to collaborators you have invited.
- To operate accounts and billing — authenticating you, tracking credits, processing purchases and subscriptions, and issuing refunds where a generation fails.
- To keep the Service secure and reliable — diagnosing errors, enforcing rate limits, investigating abuse and preventing fraud.
- To support you — answering your emails and resolving issues you report.
- To comply with law — meeting tax, accounting and legal obligations, and responding to lawful requests.
- To improve the Service — understanding which features are used and where generation fails, in aggregate.
We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your scripts, prompts or generated media to train our own models.
4. Legal bases (EEA and UK users)
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:
- Performance of a contract — to give you the Service you have signed up for, including generation, storage and billing.
- Legitimate interests — to secure the Service, prevent abuse, diagnose faults and improve the product, balanced against your rights.
- Legal obligation — to keep financial records and respond to lawful requests.
- Consent — where we ask for it separately; you may withdraw it at any time.
5. Service providers and disclosure
We share personal data with the following processors, only as needed to run the Service, and under contracts that restrict their use of it:
- Google (Firebase Authentication) — account creation, sign-in and password reset.
- Google (Gemini API, including the Nano Banana image models and Gemini Omni video models) — receives your prompts, character reference images and location reference frames in order to return generated media.
- Cloudflare (Images, Stream and network services) — stores and delivers generated and uploaded media, and fronts the Service.
- MongoDB — stores account records, projects, characters, shots and the credit ledger.
- Creem and Stripe — payment processing. Card details are entered on their systems and are never received or stored by us; we retain only the transaction reference, amount and status.
- Sentry — error and performance monitoring.
- Unsplash — when you search for a character reference photograph, your search term is sent to Unsplash to return results.
- Hetzner Online GmbH — hosting of the application servers.
We may also disclose personal data: to comply with law, regulation or a valid legal request; to enforce our Terms of Service; to protect the rights, property or safety of Innolope, our users or the public; and to a successor entity in connection with a merger, acquisition or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy.
If you invite a collaborator to a project, that person can see the project’s content according to the role you gave them, and will see the email address of the account that invited them.
6. AI generation and your content
Generating media requires sending your prompts — and, where relevant, your character portraits and previously generated frames — to Google’s Gemini API. Google processes this input to return a result and under its API terms does not use it to train its models. Generated media is written to Cloudflare Images or Cloudflare Stream and referenced from your project.
Generative models are probabilistic. Output may be inaccurate, unexpected, or resemble existing people or works, and identical prompts can produce different results. You are responsible for reviewing what you generate before you publish or distribute it, and for the rights in anything you upload as a reference.
The curated persona library shipped with the Service consists of fictional characters generated by us; the people depicted do not exist.
7. International transfers
Innolope LLC is based in the United States and our providers operate globally, so your personal data is processed outside your country, including in the United States and the European Union. Where personal data is transferred out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, as applicable. You may request details of the safeguards in place by writing to [email protected].
9. Data retention
We keep your account record, projects and generated media for as long as your account is open. Deleting a project removes its records and the associated images and video from our storage. Deleting your account removes your account record and your projects; residual copies may persist in encrypted backups for up to 30 days before being overwritten.
We retain transaction and credit-ledger records for as long as tax and accounting law requires (generally seven years), and security and error logs for up to 90 days.
10. Your rights
Depending on where you live, you may have the right to access a copy of your personal data; to correct inaccurate data; to delete your data; to restrict or object to certain processing; to receive your data in a portable format; to withdraw consent; and not to be discriminated against for exercising these rights.
California residents have the rights described in the CCPA/CPRA, including the right to know what personal information is collected and disclosed. As stated above, we do not sell personal information or share it for cross-context behavioural advertising.
To exercise any right, email [email protected] from the address on your account. We will respond within 30 days. You may also use an authorised agent, and you have the right to lodge a complaint with your local data protection authority.
11. Security
We protect the Service with encryption in transit (HTTPS everywhere), access controls limited to the people who need them, hashed API keys, per-account rate limiting, and continuous error monitoring. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.
12. Children
The Service is not directed to anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.
13. Changes to this policy
We may update this policy as the Service changes. The “Last updated” date above always reflects the current version. If a change materially affects your rights, we will notify you by email or in the app before it takes effect. Continuing to use the Service after a change means you accept the updated policy.
14. Contact us
Innolope LLC
State of Delaware, United States
Email: [email protected]