This version is under review by an attorney and may be revised — a few points are still being decided. If anything here bears on a decision you are making, email hello@octoflick.com and we will tell you where it stands.
Octoflick — Privacy Policy
Effective date: 2 September 2026 Last updated: 2 September 2026
1. Who we are
Octoflick LLC, a California limited liability company, 1720 South Fairfax Avenue, Los Angeles, CA 90019, operates the Octoflick web application at octoflick.com.
Questions, requests or complaints: hello@octoflick.com
2. The short version
- We collect what we need to run your account and the app, and not much else.
- We do not use your screenplays or your generated work to train AI models.
- We do not sell your personal information or share it for cross-context behavioural advertising.
- Your content is transmitted to the AI providers whose keys you connect, so their privacy terms apply to that content too. Section 6 explains this.
- You can export or delete your data at any time.
3. What we collect
3.1 Information you give us
| Category | What it is |
|---|---|
| Account | Name, email address, password (stored hashed), plan, organisation and seat membership |
| Billing | Handled by [Stripe]. We receive your subscription status, billing country, and the last four digits and brand of your card. We do not receive or store full card numbers. |
| API keys | Keys you connect for Anthropic, Google, OpenAI and Replicate, stored encrypted at rest |
| Your Content | Screenplays and scripts you upload (PDF, .fdx or pasted text), project names, scene breakdowns, shot lists, asset descriptions, prompts and any edits you make |
| Output | Generated reference images, storyboard frames, animatics, stitched video and export files |
| Support | Anything you send us by email |
3.2 Information collected automatically
| Category | What it is |
|---|---|
| Usage | Features used, projects created, generation requests initiated, storage consumed, timestamps |
| Device and log | IP address, browser type, operating system, referring page, error logs |
| Cookies | See section 9 |
3.3 What we do not collect
We do not collect biometric data, precise geolocation, government identifiers, or special category data under GDPR. We do not knowingly collect information from anyone under 18.
4. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service — running breakdowns, generation and exports | Performance of a contract |
| Managing your account, seats and subscription | Performance of a contract |
| Taking payment and preventing payment fraud | Performance of a contract; legitimate interests |
| Enforcing storage limits and plan entitlements | Performance of a contract |
| Security, abuse prevention and debugging | Legitimate interests |
| Product analytics in aggregate | Legitimate interests |
| Service emails — receipts, renewal reminders, deletion warnings, outages | Performance of a contract |
| Marketing emails | Consent; opt out at any time |
| Complying with law | Legal obligation |
5. What we do not do with your work
We do not use Your Content or Output to train, fine-tune, evaluate or improve any artificial intelligence model.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under California law.
We do not read your screenplays except where you specifically ask us to help with a support issue and give permission, or where we are legally required to.
6. Where your content goes
To do what you ask, we transmit content to the AI providers whose keys you have connected. This is the core mechanic of the app and it is worth understanding.
| Provider | What we send | When |
|---|---|---|
| Anthropic | Screenplay text, scene data, prompts | Breakdowns, shot lists, prompt refinement |
| Prompts and reference images | Image generation | |
| OpenAI | Prompts and reference images | Image generation |
| Replicate | Prompts and images | Video generation |
Requests are made using your API key, under your account with that provider. The provider's own privacy policy and terms govern what they do with that content, including whether they retain it and whether they use it for training. We have no control over this and it is not something our commitments in section 5 can cover.
If your script is under a non-disclosure obligation to a client, studio or employer, review the relevant provider's terms before uploading, and consider whether their retention practices are compatible with that obligation.
Only providers whose keys you have connected receive anything. Free accounts can connect an Anthropic key only, so free-plan content goes to Anthropic and nowhere else.
7. Service providers we use
| Who | What for | Where |
|---|---|---|
| Google Cloud Platform | Hosting, database and file storage | [United States] |
| [Cloudflare] | [CDN and asset delivery] | [Global] |
| Stripe | Payment processing | United States |
| [Resend / Postmark] | Transactional email | [United States] |
| [Analytics vendor] | Product analytics | [ ] |
These vendors process data on our behalf under contract and may not use it for their own purposes. This list will be kept current.
We may also disclose information to comply with law, to respond to valid legal process, to enforce our Terms, or in connection with a merger, acquisition or sale of assets — in which case we will give notice before your information becomes subject to a different privacy policy.
8. How long we keep things
| Data | Retention |
|---|---|
| Account information | While your account is open, then [30] days after closure |
| Screenplays, breakdowns, shot lists and project metadata | While your account is open, or until you delete them |
| Generated media, after downgrade from a paid plan to Free | Read-only for 90 days, then permanently deleted, after at least three email warnings |
| Generated media, on account closure | Deleted within [30] days |
| API keys | Until you remove them or close your account, then deleted immediately |
| Billing records | [7] years, as required for tax and accounting |
| Server and security logs | [90] days |
| Backups | Expire on our ordinary backup cycle, within [35] days |
9. Cookies
We use cookies that are strictly necessary to run the Service — keeping you signed in, remembering your preferences such as dark mode, and securing forms.
[We also use [analytics vendor] to understand how the app is used. You can decline these without losing any functionality.]
10. Security
We take reasonable measures to protect your information, including:
- Encryption in transit (TLS) and at rest
- API keys encrypted at rest with keys held separately, and [not displayed in full after entry]
- Access to production systems limited to those who need it
- Regular dependency and infrastructure updates
No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and any regulator as required by law.
We recommend scoping and budget-limiting the API keys you connect, and rotating them periodically.
11. Your rights
11.1 Everyone
You can access, export and delete your projects and content from within the app at any time, and delete your account from settings. Email hello@octoflick.com for anything the app does not cover.
11.2 California residents (CCPA/CPRA)
You have the right to know what we collect and why, to access and to receive a portable copy, to correct inaccuracies, to delete, and to limit use of sensitive personal information. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of. We will not discriminate against you for exercising these rights.
To exercise them, email hello@octoflick.com. We will verify your identity through your account email before acting. An authorised agent may act for you with written permission.
11.3 EEA, UK and Switzerland (GDPR)
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where we rely on it. You may lodge a complaint with your supervisory authority.
Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds.
12. International transfers
We are based in the United States and store data there. If you use the Service from outside the US, your information is transferred to and processed in the US.
13. Children
The Service is for users aged 18 and over. We do not knowingly collect information from children. If we learn we have, we will delete it. Contact hello@octoflick.com if you believe a child has provided us information.
14. Changes
We may update this policy. If a change is material we will notify you by email or in the Service at least [30] days before it takes effect, and update the date at the top.
15. Contact
Octoflick LLC 1720 South Fairfax Avenue, Los Angeles, CA 90019 hello@octoflick.com