Privacy Policy

This Policy explains what Dimensionleap Technologies Private Limited ("Kraftflix," "we," "us") collects when you use Kraftflix in India, why we collect it, how it is shared and retained, and the rights and controls available to you under applicable law, including India's Digital Personal Data Protection Act, 2023 (DPDP Act). Kraftflix currently supports individual accounts only; organisation workspaces are not available.

1. Information we collect

• Account information — name, email, password (hashed), and authentication details. If you use Google sign-in, we receive your name, email address, Google account identifier, and profile picture.
• Usage & device data — product and workflow events, credits consumed, IP address, browser/device type, and technical logs used to operate, secure and debug the Service. PostHog is self-hosted and uses only a pseudonymous user_id for analytics.
• Payment data — Razorpay processes payments. Kraftflix retains payment metadata such as plan, transaction, invoice and credit information, but not full card numbers.
• Your content — prompts, scripts, briefs, images, videos, documents, project data and generated outputs, which may contain personal data such as a person's name, likeness or voice.
• Contact information — name, email address and mobile number when you submit a contact enquiry.
• Communications — support requests, feedback and correspondence with us.

2. Creative content & ownership

You retain rights in the content you bring to Kraftflix. We do not sell your content or use it to train Kraftflix's own AI models. For script, text and prompt-planning generation, we may use Azure OpenAI models sold by Azure or Anthropic Claude through Microsoft Foundry, and model versions may change over time. Microsoft's published terms for models sold by Azure say prompts and outputs are not used to train, retrain or improve foundation models without customer permission. Claude is an Anthropic-operated Marketplace offering, even when hosted on Azure; Anthropic's Commercial Terms prohibit training on customer content and also apply to Claude. For image and video generation, Kie.ai has confirmed to us by email that it does not use prompts, uploaded inputs or generated outputs to train or fine-tune AI models in its own handling. Requests also pass through paid upstream model-provider accounts, whose applicable terms govern their handling; Kie.ai's confirmation does not cover those providers. For audio, voice and music/sound generation, ElevenLabs' published terms make training opt-out-based. Kraftflix has disabled the ElevenLabs account's "Improve the models for everyone" Data use setting; the opt-out is not retroactive. ElevenLabs' terms also say its customer retains rights in Input and Output as between them. Generated outputs are private by default and are not public unless you choose to share them. Authorized staff and service providers may access content to provide, support, secure or moderate the Service as described in this Policy. Separate written consent is required before public marketing, testimonials, screenshots, case studies or customer logos. See the Terms of Service for how AI-generated output ownership works.

3. How we use information

We process personal data to provide and maintain the Service; authenticate accounts; process payments and manage credits; run product and workflow analytics; secure the platform and detect abuse; respond to support requests; send service-related communications; administer consent and privacy requests; and meet legal and tax obligations.

4. Legal basis & consent

Where the DPDP Act applies, we process personal data on the basis of your consent (for example, when you create an account) or as otherwise permitted by law — such as compliance with a legal obligation, or "legitimate uses" like responding to a request you've made. You can withdraw consent at any time from account settings or by contacting us, without affecting processing already carried out lawfully before withdrawal. Withdrawing consent for data we need to run the Service may mean we can no longer provide it to you.

5. Data sharing

• Service providers — cloud infrastructure and storage; Cloudflare Turnstile to verify that website forms are submitted by a person; Razorpay for payments; Azure OpenAI models sold by Azure and Anthropic Claude models offered through Microsoft Foundry for script, text and prompt-planning generation; Kie.ai for image and video generation, as an aggregator providing access to third-party generation models; and ElevenLabs directly for audio, voice and music/sound generation. Microsoft may apply safety filters and review flagged Azure OpenAI prompts and completions; Anthropic operates Claude, applies its own safeguards and may review flagged content under its terms. Kie.ai and ElevenLabs may moderate content under their own terms.
• Legal & safety — where required by law, court order, or to protect the rights, property or safety of Kraftflix, our users, or the public.
• Business transfers — as part of a merger, financing, or asset sale, subject to this Policy continuing to apply to your data.

We do not sell personal data or use user content to train Kraftflix's own AI models. For text generation with Azure OpenAI models sold by Azure, Microsoft's published terms say prompts and outputs are not used to train or improve foundation models without customer permission; content filtering and abuse monitoring may still apply. When Anthropic Claude is selected through Microsoft Foundry, Anthropic independently processes prompts and outputs and its Commercial Terms say it may not train models on customer content. Microsoft's Claude data-privacy guidance says Claude may be hosted on Azure or Anthropic infrastructure and that Anthropic's terms and safety practices apply in either case. We may change text-model versions; the selected model and deployment determine the applicable provider terms and processing. We send only scene-level image and video generation prompts, not full scripts, to Kie.ai. Kie.ai has confirmed to us by email that it does not use prompts, uploaded inputs or generated outputs for model training or fine-tuning in its own handling. Its Terms of Use and Privacy Policy do not include that assurance as a published contractual commitment. Kie.ai says requests use paid upstream-provider accounts governed by those providers' applicable terms; we cannot make a blanket no-training promise for them. Kie.ai does not offer a separate DPA or enterprise agreement with stronger commitments. Audio, voice and music/sound generation goes directly to ElevenLabs. Its Terms of Service allow training use unless the account opts out through the Data use setting. Kraftflix has disabled that setting for its ElevenLabs account; the opt-out applies to new content after the request is processed, not retroactively. A provider notice is shown before third-party generation. Some processing may occur outside India; see Section 6 for transfer details.

6. Cross-border data transfer

Kraftflix is based in India and is currently available only in India. Script, text and prompt-planning content may be processed by Azure OpenAI models sold by Azure or by Anthropic Claude through Microsoft Foundry. Azure OpenAI processing location depends on deployment settings. For Claude, Anthropic is the independent operator and processing may take place on Azure or Anthropic infrastructure depending on the deployed option; the selected location may be outside India. Scene-level image and video prompts go to Kie.ai, operated by US-based companies, and may be processed outside India. Audio, voice and music/sound content goes directly to US-based ElevenLabs, whose Privacy Policy lists hosting or server locations in the United States, the Netherlands and Singapore, and says personal data is transferred to the United States for storage. We provide notice before third-party generation. Provider terms and technical safeguards apply to these transfers, but Kie.ai does not offer a separate DPA or enterprise agreement.

7. Data storage & security

We use encryption in transit and at rest, role-based access control, access logging and monitoring, backups, vulnerability patching, incident logging, restricted administrator access, separate user-data environments and disaster-recovery measures. See the Security page for current controls. We will handle personal-data breaches and notices as required by applicable law.

8. Cookies & analytics

The landing site does not use non-essential cookies. Kraftflix product analytics are enabled by default: self-hosted PostHog records product and workflow events using only a pseudonymous user_id. There is currently no disable option.

9. Data retention

Project deletion has a 7-day recovery period. Account deletion has a 7-day cancellation period. Permanent deletion from active Kraftflix systems occurs within 30 days. Kraftflix backups are retained for 90 days and removed through rotation. Contact enquiries are retained for up to 12 months. PostHog analytics data is retained for 12 months and then aggregated or deleted. These Kraftflix timelines do not guarantee the same deletion timing for copies processed by AI providers. When Claude is used through Microsoft Foundry, Anthropic's commercial retention guidance generally describes backend deletion of API inputs and outputs within 30 days, with exceptions for safety, legal requirements and certain features or models; the deployed model's applicable terms and settings govern. Kie.ai has confirmed by email that it currently retains generated files for 14 days and logs and task records for two months; prompt text stored in task records is deleted with the associated logs after two months. These are operational periods, not contractual guarantees. Kie.ai says account access and deletion are available to its account holders in India, but Kraftflix's own deletion controls and timelines do not establish the same timing for Kie.ai or upstream providers. ElevenLabs' published Data Processing Addendum does not promise self-serve customer-content deletion within 30 days; it reserves the right, without an obligation, to delete after 180 days of inactivity. We cannot guarantee identical deletion periods at upstream model providers.

10. Your rights

Subject to applicable law, including the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it's being processed.
• Correct or update inaccurate or incomplete personal data.
• Request deletion of personal data, including through project and account deletion controls, subject to legal retention requirements.
• Export your available account and project data using self-service controls.
• Withdraw consent at any time, as described in Section 4.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Register a complaint with us, and if unresolved, with the Data Protection Board of India.

Self-service controls are available for access, correction, export, project deletion, account deletion and consent choices. For other requests, use authenticated access or email verification. We acknowledge grievances within 2 business days and target resolution within 30 days. ElevenLabs' own Privacy Policy also recognizes India-specific nomination and grievance-redressal rights for personal data it processes.

11. Children's data

Direct Kraftflix accounts are for users aged 18 and over. If you believe a person under 18 has provided us data, contact us and we will take appropriate steps.

12. Grievance Officer & contact

Grievance Officer: Ravi Kumar Venkat. Email support@kraftflix.com with the subject line "Privacy request". Registered address: 6-25, Opp. IDPL Project, Balanagar, Hyderabad, Telangana, India - 500037.

13. Changes to this Policy

We may update this Policy as our practices, the product, or the law evolve. Material changes will be notified by email and in-product notice. This Policy is governed by the laws of India.