Effective date: 15 October 2026. Version: 1.
1. Who is responsible for your data
SCENRA, Southeast Asia ("SCENRA") decides why and how your personal data is used and is responsible for it under this policy. Contact for privacy: support@scenra.us. We have not appointed a data protection officer.
This policy explains what we collect, why, who receives it, how long we keep it, and what you can do. It is written to meet the data protection laws that apply to our users, including the EU/UK GDPR where it applies to you.
2. What we collect
| Data | When | Why | How long |
|---|---|---|---|
| Google account details: Google account ID, email, name, profile photo | When you sign in | Create and recognise your account; show your name and photo; contact you about your account | While the account exists, then as in section 6 |
| Session and security data: session cookie, security token, time and place (IP address, device and browser details) of requests and sign-ins, security events | While you use the Service | Keep you signed in, prevent fraud and abuse, investigate problems | 14 days (application logs on the server: 7 days) for logs |
| Your inputs: prompts, chosen model and settings, pictures you add | When you generate | Run your generation; show history; "Generate again" | Prompts and settings: while the account exists. Pictures: 24 hours if unused, otherwise as long as the result they produced |
| Private voices: voice descriptions, preview scripts, uploaded recordings, saved voice metadata and your permission confirmation | When you use Voice Creation | Create private voices, show previews and reuse the voices you select | Unsaved previews expire after 24 hours. Saved voice profiles remain until you delete the voice or account; deletion is retried with the provider if temporarily unavailable. Existing generated recordings follow their own retention period. |
| Your results: videos and images, posters, size, length, checksum | When a generation succeeds | Show, play and let you download them | Retention period of the package (7, 10, 15 or 20 days), then the files are deleted |
| Generation records: model, cost in credits, state, error code, dates | Each generation | History, billing, support, accounting | While the account exists, then as in section 6 |
| Credits and payments: packages bought, credit balance and movements, order and payment status, referral code and use | When you buy or use credits | Provide credits, accounting, tax, fraud prevention, refunds | Payment records for 5 years |
| Wallet data (optional): public address, network, the signed proof, wallet app name | When you link a wallet | Show your linked wallet, support wallet features | Ordinary wallet links: until unlinking or account deletion. Permanent Robinhood binding: a minimal record of the public address, account ID, email fingerprint (not the email text), binding time and policy reference remains to prevent reassignment after deletion. Public blockchain data cannot be removed. |
| Messages to us: support or abuse reports | When you write to us | Answer and keep a record | 12 months |
| Notifications: that a generation finished, or that a result expires soon | Automatically | Tell you what happened to your jobs | While the account exists |
We do not collect passwords (sign-in is through Google). We do not receive your wallet private keys or seed phrase. We do not use advertising or tracking cookies, and we do not sell your personal data. We use Google Analytics 4 to measure how the Service is used, only after you accept the analytics consent prompt; it receives no prompts, generated content, passwords or payment details, and your IP address is anonymised.
3. Why we use it, and on what basis
- To provide the Service you asked for (account, generations, credits, downloads): needed to perform our agreement with you.
- To keep the Service secure, prevent abuse and fraud, fix problems, and meet legal duties (tax, law enforcement requests): our legitimate interests and legal obligations.
- To send service messages (job finished, results expiring, changes to terms): needed for the Service and our legitimate interests.
- For anything beyond that, for example publishing a result on Explore, we ask for your consent, which you can withdraw.
4. Who receives your data
| Recipient | What they get | Why |
|---|---|---|
| AI model provider (currently Kie.ai) | Your prompt, settings, pictures you added (through a temporary link). Not your name or email | To generate your result. Their own terms apply Our AI provider is Kie.ai (kie.ai/privacy-policy). To create a result, your prompt and images are sent to Kie.ai, which may pass them to the company that makes the chosen model and may store data in the United States. Kie.ai keeps media files for 14 days and log data for 2 months, then deletes them, and its terms let it use submitted content to operate and improve its service. |
| That you sign in; Google sees the sign-in | Sign-in | |
| Reown / WalletConnect, and your wallet app | Connection data needed to link a wallet | Optional wallet connection |
| ElevenLabs | Voice descriptions, preview text and recordings you submit, and text and selected voice for speech generation | Design, clone and use voices at your request. We request provider deletion when you delete a private voice or your account. |
| Payment providers | Order details needed to take payment | Payments. They handle card or bank details; we do not store card numbers |
| Cloudflare and hosting provider | Traffic and stored files, as our infrastructure | Deliver and host the Service |
| Authorities, advisers | What the law requires or what is needed to protect our rights | Legal compliance |
| A buyer or successor | Data may pass to a successor if SCENRA is reorganised or sold, under this policy | Business continuity |
We do not sell your data. We ask providers to protect data and to use it only to serve us, but a provider's own terms govern what it does with the requests it processes.
5. Where your data goes
The Service runs on servers in Malaysia, with Hostinger; images and videos are delivered through Cloudflare, and AI requests are processed by our AI provider, which may store data in the United States, and providers such as Google, Kie.ai and Cloudflare operate in other countries. Your data may therefore be processed outside your country. We use providers that apply safeguards and share only what each needs.
6. How long we keep data, and deleting your account
- Results and pictures: as in section 6 of the Terms and section 2, then permanently deleted.
- Records of generations and credits: kept while your account exists.
- When you delete your account (or we close it): within 30 days we delete your files and your prompts, remove or anonymise your profile data, and remove ordinary wallet links. A minimal permanent Robinhood binding record remains as described in D.2; deleting the account does not allow wallet reassignment. We keep what the law requires or what we need to protect our rights, for example payment and tax records and security logs, for the time stated in D.2.
- Inactive accounts. If an account has no sign-in, generation or active credits for 12 months, we may close it after notifying you by email, and delete its data as above.
- Backups are overwritten on a regular schedule (backups are kept for 30 days).
7. Cookies and local storage
We use only what the Service needs to work, plus Google Analytics 4 for anonymous usage analytics once you accept the consent prompt. We do not use advertising cookies.
| Item | Where | Purpose |
|---|---|---|
scenra_session | Cookie (secure, not readable by scripts) | Keeps you signed in; ends after a limited time (currently 8 hours) |
| Security token (CSRF) | Memory of the page | Protects actions from being triggered by other sites |
scenra.signed-in | Browser storage | Remembers you are signed in so public pages draw the right header |
scenra.generation.draft.*, active job id, "Animate this" hand-over | Browser storage | Keep your unfinished prompt, settings and running job after a reload |
| Pending wallet link record | Browser storage | Lets you finish linking a wallet after a reload |
Browser storage stays on your device. You can clear it; the Service will work but forget your drafts.
8. Your rights
Depending on where you live, you can ask us to: tell you what data we hold and give you a copy; correct it; delete it; limit or object to how we use it; withdraw consent you gave; and transfer your data to another service where that applies. You can also complain to your data protection authority. To use a right, write to support@scenra.us. We may ask you to confirm it is you, and we answer within the time the law sets (usually within 30 days). Rights do not reach data we must keep by law.
Right now the Service has no self-service button to delete an account or export data; write to us and we do it for you [remove this sentence when the feature exists].
9. Security
Private files are not publicly addressable and are shown only to your signed-in session; temporary links are signed and expire; sessions are limited in time and bound to a security token; sensitive actions can require signing in again; pictures are re-encoded and metadata such as location is removed. No system is perfectly secure. If a breach affects your personal data we will tell you and the authorities as the law requires (we report a breach that must be reported to Singapore's PDPC no later than 3 calendar days after we assess that it must be reported, and we tell affected users without undue delay).
10. Children
The Service is not for people under 18. If we learn that a child has an account we close it and delete its data.
11. Changes
We will post changes here with a new date and tell you of significant ones before they apply. Contact: support@scenra.us.