Privacy Policy

The data controller for Motionly is Lumi Diamond, LLC, a limited liability company formed in the Delaware, United States, at 56 Broad St, Suite 14213, Boston, Massachusetts 02109, United States.

Privacy contact: hello@motionly.studio · +972 52-611-6025

Where we operate. Our team operates the Service from Israel, and our infrastructure runs in the United States and the European Union. Your data is therefore accessed from and stored in more than one country. Section 8 explains what that means for you.

Account information. Your email address and name. You can sign in with email and password or with supported providers such as Apple, Google and GitHub; authentication is handled by Supabase Auth. We never store your password — it is hashed and managed by Supabase — and Google sign-in shares only your basic profile (name and email) with us.

Business and brand data. What you tell us about your business — name, website URL, industry, audience, brand guidelines — plus any logos, images, footage, or copy you upload, and content we retrieve from a website URL you ask us to scan.

Content you create. Your briefs, prompts, messages to the editing agent, generated ad code, and rendered videos.

Usage data. Which features you use, ads generated, credits consumed, and interaction patterns, so we can see where the product fails people.

Technical data. IP address, browser and device type, approximate country (used to offer you the right language), and similar data collected automatically.

Payment data. Handled by Stripe. We receive your plan, subscription status, billing country, and the last four digits and brand of your card. We never receive or store your full card number.

App Store purchases. Apple processes purchases made through the iPhone app. We receive signed transaction records, product and transaction identifiers, purchase and expiry dates, subscription status, and renewal or refund events. An account token links a purchase to your Motionly account so we can verify access, allocate credits and restore purchases. We do not receive your Apple payment card details. Apple handles purchase information under its own privacy policy.

Support communications. Messages you send us and any attachments.

Meta Ads, when you connect it. With your authorization, we receive your Meta user identifier, the ad accounts available to you, and campaign, ad set, ad and performance data for the account you select. Reports include spend, impressions, clicks, CTR and purchase ROAS where available. We store your access token encrypted and cache reports in Supabase, refreshing them on a schedule to display performance in Motionly. The connector requests ads_read and does not create, edit or publish ads, change budgets or spend money. You can stop imports, revoke access and delete the stored connection and reports in Settings → Connectors. See Meta Ads data deletion instructions.

If you are in the EEA or UK, the GDPR requires us to state a lawful basis for each purpose. Here it is:

We do not sell your personal data, and we have not in the preceding twelve months. We share it only with the providers that make the Service run, each bound to process it solely on our instructions:

• Supabase — authentication and database hosting
• Vercel — website and application hosting
• Amazon Web Services — video rendering, file and asset storage
• DigitalOcean — the generation pipeline server
• Anthropic — AI processing of briefs and brand content for ad generation
• OpenAI — image generation for ad assets
• ElevenLabs — voiceover synthesis
• Stripe — payment processing and subscription management
• Apple — App Store purchases, subscription verification, renewals and refunds; Apple also handles Sign in with Apple when selected
• Resend — transactional email, such as ad-ready and billing notices
• PostHog — product analytics (see Section 6)

We may also disclose data where we are legally required to, to enforce our Terms, to protect rights and safety, or in connection with a merger or sale of assets — in which case we will notify you before your data becomes subject to a different privacy policy.

• Account and profile data — while your account is open, then deleted within 30 days of account deletion.
• Your ads, brands and generated content — while your account is open, then deleted within 30 days.
• Billing and tax records — up to 7 years after the transaction, because tax law requires it. This is the one category we cannot delete on request.
• Support messages — up to 2 years.
• Product analytics — up to 12 months in identifiable form, then aggregated.
• Server and security logs — up to 90 days.

We use essential cookies for sign-in, session management, and security; these cannot be switched off without breaking the service. We also use PostHog for product analytics, which stores an identifier in cookies and browser localStorage so we can see which pages are visited, which features are used, and where people get stuck.

We use this to improve the product, not to advertise to you: we do not use third-party advertising cookies and we do not share analytics data with ad networks. You can block cookies in your browser, or use its Do Not Track / Global Privacy Control signal, which we honor as an opt-out of non-essential analytics.

Data is encrypted in transit (TLS) and at rest. We use Supabase Row Level Security so that account data is reachable only by its owner, restrict internal access to what is needed to operate the service, and keep our dependencies patched. No system is perfectly secure, and we do not claim otherwise.

If there is a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where the law requires it, and notify you without undue delay where the breach is likely to present a high risk to you.

We operate from Israel and our providers run infrastructure in the United States and the European Union, so your data crosses borders.

For transfers of EEA and UK personal data, we rely on the European Commission’s adequacy decision for Israel, and on Standard Contractual Clauses with providers in countries without an adequacy decision, together with the technical safeguards in Section 7. You can request details of these safeguards at hello@motionly.studio.

Wherever you live, you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything inaccurate
• Delete your account and personal data
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent you previously gave, at any time

Email hello@motionly.studio. We respond within 30 days, free of charge, and we will not treat you differently for asking.

EEA and UK. These are your GDPR rights, and you may also lodge a complaint with your national data protection authority.

California. Under the CCPA/CPRA you have the right to know, delete, and correct your personal information, to opt out of sale or sharing, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of — but the request channel above is open to you regardless.

Israel. Under the Protection of Privacy Law, 5741-1981, you have the right to inspect the personal data we hold about you and to request its correction or deletion, through the same contact address.

Motionly is a business tool and is not directed to children. You must be at least 18 to use it, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, write to hello@motionly.studio and we will delete it.

We may update this policy. For material changes we will notify you by email or in the app before they take effect, and update the date at the top. Continued use after that date constitutes acceptance.

Lumi Diamond, LLC
56 Broad St, Suite 14213, Boston, Massachusetts 02109, United States
hello@motionly.studio · +972 52-611-6025