Cinemads

Translation — the German version is binding. Read the German original

Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
MechanX UG (haftungsbeschränkt)
Kolonnenstr. 8
10827 Berlin
Deutschland
Email: hello@cinemads.app

2. Hosting and delivery

We operate Cinemads on the infrastructure of Cloudflare, Inc., headquartered in the USA (Cloudflare Workers). Cloudflare delivers our pages via a worldwide content delivery network and stores the videos and working files generated by our service in Cloudflare R2.

When you access our pages, Cloudflare technically processes server log data (IP address, time of access, URL accessed, browser or user agent used). This serves security, the delivery of our pages, and the prevention of misuse; the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and functional operation).

Transfers to the USA take place on the basis of the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses.

3. Account and sign-in

We use Supabase, Inc., headquartered in the USA, for sign-in. Our database is operated in the EU (Frankfurt am Main). We process your email address as well as the times of account creation and sign-ins. We send sign-in emails (magic link and one-time code) via Brevo (see section 6).

The legal basis is Art. 6 (1) (b) GDPR (performance of the usage contract).

4. Creation of the videos

When you create a video ad, we process the information you enter (website URL, chosen style, chosen languages, optional note) as well as the publicly accessible content of the website you specify, which our AI agent retrieves (text, images, logo, colours). This content may contain personal data of third parties that is depicted on the specified website. You are responsible for being entitled to use this content.

The legal basis is Art. 6 (1) (b) GDPR (performance of the usage contract).

We use the following processors to create the videos:

Transfers to these processors take place, where the respective provider is certified under the EU-US Data Privacy Framework, on that basis; otherwise (including BytePlus) on the basis of EU Standard Contractual Clauses.

We store the generated videos, still frames and working files in Cloudflare R2 (see section 2).

5. Payments

We use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, for payment processing. Stripe processes your name, your email address, your billing address, optionally your VAT ID, and your payment data. We ourselves do not receive complete card data.

The legal basis is Art. 6 (1) (b) GDPR (performance of the contract) as well as Art. 6 (1) (c) GDPR (tax-law retention obligations).

When you make a purchase, we also store the time, IP address and browser (user agent) of your consent to immediate performance of the contract (§ 356 (5) BGB, German Civil Code) as evidence. The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 6 (1) (f) GDPR.

6. Email dispatch

We send sign-in emails and notifications about your orders (your video is ready or could not be created) via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin) as a processor. Brevo processes your email address, the content of the email, and technical delivery data such as time and delivery status. We do not send marketing emails.

Our emails contain a tracking pixel, which Brevo uses to record whether and when an email was opened. We use this information only to check the delivery of our emails. You can prevent this by disabling the automatic loading of images in your email program.

The legal basis is Art. 6 (1) (b) GDPR (performance of the usage contract); for the tracking pixel, Art. 6 (1) (f) GDPR (legitimate interest in reliable delivery).

7. Cookies

We use only technically necessary cookies: Supabase session cookies to keep you signed in, and the cookie "lang", which stores for one year the language you read the site in. The legal basis is § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).

To suggest a suitable language on your first visit, we evaluate your browser's language setting and the country Cloudflare derives from your IP address. We store neither.

We do not use analytics, tracking or advertising cookies, nor advertising pixels. We serve fonts from our own server (no Google Fonts).

8. Contact

If you contact us by email, we process your details to handle your request. The legal basis is Art. 6 (1) (f) GDPR, or, where your request is aimed at concluding a contract, Art. 6 (1) (b) GDPR.

9. Storage period

We store account data, your orders and videos for as long as your account exists. On request by email, we delete your account and the associated data. We retain payment and invoicing records for 10 years for tax-law reasons (§ 147 AO, § 257 HGB, German Fiscal Code and Commercial Code). We store server log data only for a short time.

10. Your rights

Under Art. 15 to 21 GDPR, you have the right to information, rectification, erasure, restriction of processing, data portability and objection to the processing of your personal data. To exercise these rights, contact hello@cinemads.app.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.

11. Automated decision-making

Automated decision-making within the meaning of Art. 22 GDPR does not take place.

Last updated: October 2026