Skip to content

Privacy Policy

Last updated: October 11, 2026

1. Overview

SceneSteller ("we," "us," or "our") operates the SceneSteller platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using the Service, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

Key Principle: We collect only the minimum data necessary to provide our services. We never sell your personal data to third parties.

2. Information We Collect

2.1 Information You Provide

Account Information

Email address, name, profile picture when you create an account via our authentication provider

Payment Information

Payment details processed securely through our payment provider (Polar.sh). We do not store credit card numbers. Purchases also include how you first arrived at SceneSteller (campaign tags, referring website and landing page), when we have it.

User Content

Images you upload for AI processing, prompts, and generated images

Communications

Feedback, support requests, and other communications you send to us

2.2 Information Collected Automatically

Device Information

Browser type, operating system, device identifiers, IP address

Usage Data

Pages visited, features used, time spent, generation history, error logs

3. How We Use Your Information

3.1 Legal Bases for Processing (GDPR)

We process your personal data under the following legal bases:

  • •
    Contract Performance

    To provide and maintain our Service, process transactions, and manage your account

  • •
    Legitimate Interests

    To improve our Service, prevent fraud, ensure security, and send service-related communications

  • •
    Legal Obligation

    To comply with applicable laws, regulations, and legal processes

  • •
    Consent

    For marketing communications and optional features (you may withdraw consent at any time)

3.2 Specific Uses

  • • Provide, operate, and maintain the Service
  • • Process AI image generation requests
  • • Process payments and manage credits
  • • Send transactional emails and service updates
  • • Respond to support requests and inquiries
  • • Analyze usage to improve our Service
  • • Detect and prevent fraud or abuse
  • • Comply with legal obligations

3.3 Google and YouTube User Data

SceneSteller uses YouTube API Services to let you connect your YouTube channel and publish videos to it. By using SceneSteller's YouTube features, you agree to be bound by the YouTube Terms of Service. Google's use of your information is governed by the Google Privacy Policy.

Connecting your YouTube channel to SceneSteller is optional. When you connect, Google asks you to authorize access to your YouTube account. SceneSteller receives authorization credentials and reads your channel ID, channel name, and channel thumbnail to identify and display the channel you connected. We store the connection's granted permissions, credential expiry information, and encrypted access and refresh tokens so we can carry out publishing you request, including publishing you schedule.

When you choose to publish, SceneSteller sends your selected video, title, description, tags, visibility setting, and applicable synthetic-content disclosure to YouTube. We may also send the video's custom thumbnail and a separate subtitle track created from your SceneSteller captions. We retain the resulting video ID, video link, and upload-stage status to show the outcome of your publishing request. Google's youtube.force-ssl permission also permits broader YouTube account management; SceneSteller uses it only to identify the connected channel, upload the videos you publish through SceneSteller, set their thumbnail, and add subtitle tracks, and does not use it to delete videos, edit your other videos, manage playlists, or read your viewing history.

We use Google user data only to provide these clearly disclosed, user-facing channel connection and publishing features. We do not sell Google user data, use it for personalized advertising or retargeting, determine creditworthiness or lending eligibility, or use it to develop, train, or improve AI or machine-learning models. Google user data obtained through your YouTube authorization is not sent to our AI-generation providers.

We transfer Google user data only as necessary to provide or improve these user-facing features with your consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent. Our service providers may process this data only for the permitted purposes and subject to appropriate confidentiality and security protections. Human access is limited to cases where you affirmatively agree to access to specific data, access is necessary for security or legal compliance, or the data is aggregated and anonymized and used for internal operations as permitted by applicable law and Google's policy.

SceneSteller's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect YouTube in SceneSteller at any time. Disconnecting marks the connection as revoked in SceneSteller and stops SceneSteller from starting new uploads with that connection, including scheduled uploads; an upload that is already in progress may still finish. When you disconnect, SceneSteller deletes the encrypted access and refresh tokens we stored for that connection and attempts to revoke the token with Google. Revocation with Google is best-effort, so if it does not complete, Google may continue to list SceneSteller as having access until you revoke it in your Google Account. To request deletion of Google user data stored by SceneSteller, contact privacy@scenesteller.com. In addition to these options, you can revoke SceneSteller's access to your data at any time through your Google Account permissions page at https://myaccount.google.com/permissions. Removing a connection or requesting deletion from SceneSteller does not delete videos already uploaded to YouTube; you control those videos through YouTube.

4. Third-Party Services

We use the following third-party services to operate SceneSteller. Each service has its own privacy policy governing the use of your information:

Clerk (Authentication)

Handles user authentication, account management, and session security.

View Clerk Privacy Policy →

Convex (Database)

Stores user data, generation history, and credits in a real-time database.

View Convex Privacy Policy →

Polar.sh (Payments)

Processes credit purchases and manages payment transactions securely. Each purchase also carries how you first arrived at SceneSteller (campaign tags, referring website and landing page), when we have it.

View Polar Privacy Policy →

Google Gemini (AI Processing)

Processes images and generates AI content. Uploaded images are sent to Google's API for processing.

View Google Privacy Policy →

Vercel (Hosting)

Hosts our web application and processes web requests.

View Vercel Privacy Policy →

Cloudflare R2 (Storage)

Stores generated images for faster delivery.

View Cloudflare Privacy Policy →

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Service.

Types of Cookies We Use

Essential Cookies (Required)

Necessary for authentication, security, and basic site functionality. Cannot be disabled.

To prevent signup-bonus abuse, we use a signed, HttpOnly first-party security cookie (ss_signup_device, up to one year). Our server stores keyed hashes of the connection IP and opaque device identifier, eligible verified email domains and bonus decisions for security auditing, not raw IPs or device identifiers. These event records are retained for 30 days, then removed by scheduled daily cleanup batches. Anti-abuse limits may withhold promotional signup credits but do not block account creation or remove purchased credits. Clearing cookies does not remove IP or email-domain limits.

Functional Cookies

Remember your preferences and settings to enhance your experience.

Analytics Cookies

Help us understand how visitors use our Service to improve it. This includes a first-party cookie that remembers, for 90 days, how you first arrived (the campaign tags in the link you clicked, the website you came from and the page you landed on) so we can tell which channels bring people to the Service. When you create an account, that same information is saved to your account, and it is sent to our payment provider, Polar.sh, with any purchase you make. It never contains your name, email address or IP address. Browsers that send a Global Privacy Control or Do Not Track signal are not given this cookie, and their purchases carry no acquisition information.

Managing Cookies: You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy:

Account Data

Retained while your account is active, and for up to 30 days after account deletion

Generated Images

Retained while your account is active. Deleted upon account deletion.

Transaction Records

Retained for 7 years as required by applicable tax and financial regulations

Usage Logs

Retained for up to 90 days for security and debugging purposes

7. Your Privacy Rights

7.1 Rights Under GDPR (European Users)

If you are located in the European Economic Area (EEA), you have the following rights:

Access - Request a copy of your personal data

Rectification - Correct inaccurate or incomplete data

Erasure - Request deletion of your data ("right to be forgotten")

Portability - Receive your data in a portable format

Restriction - Limit how we process your data

Objection - Object to certain processing activities

7.2 Rights Under CCPA (California Users)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • • Right to Know: Request information about data collection and sharing practices
  • • Right to Delete: Request deletion of your personal information
  • • Right to Opt-Out: Opt out of the "sale" of personal information (we do not sell your data)
  • • Right to Non-Discrimination: Equal service regardless of privacy choices

How to Exercise Your Rights: Contact us at privacy@scenesteller.com. We will respond within 30 days (or 45 days for CCPA requests).

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our service providers are located.

When we transfer data internationally, we implement appropriate safeguards including:

  • • Standard Contractual Clauses (SCCs) approved by the European Commission
  • • Data Processing Agreements with all service providers
  • • Technical and organizational security measures

9. Children's Privacy

Age Requirement: SceneSteller is not intended for use by children under the age of 13 (or 16 in the EEA).

We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@scenesteller.com. We will promptly delete such information.

10. Data Security

We implement industry-standard security measures to protect your personal data:

Encryption: All data transmitted via HTTPS/TLS. Sensitive data encrypted at rest.

Access Control: Strict access controls and authentication for all systems.

Monitoring: Continuous monitoring for security threats and vulnerabilities.

Important: No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

  • • Posting the updated policy on this page with a new "Last updated" date
  • • Sending an email notification for significant changes
  • • Displaying a notice within the Service

12. Contact Us

For questions, concerns, or to exercise your privacy rights:

Privacy Inquiries: privacy@scenesteller.com

General Support: support@scenesteller.com

Response time: We aim to respond to all privacy-related inquiries within 30 days.