Privacy policy

Updated August 1, 2026

This policy explains what Cineva collects when you use cineva.io, why we need it, who else sees it, and how long we keep it. Your scripts are the most sensitive thing you give us, so start with the section on training data.

Who is responsible

Cineva is a product of ReadyTake. ReadyTake is a sole proprietorship based in California, in the United States, operating under a fictitious business name. It is not a company, so the person responsible for your data is the individual who owns ReadyTake.

Privacy questions, and any request about your data, go to hello@cineva.io. That address reaches the operator directly, not a queue.

Cineva is offered in the United States, and everything described here is stored and processed in the United States. RolePilot is a separate product from the same operator, with its own privacy policy. This one covers Cineva only.

What we collect

Account details

Your email address, your password credential, your plan, and your credit balance and credit history. If you sign in with Google instead of a password, Google confirms the email address on that account and tells us it is yours. We never receive your Google password and we do not read anything else in your Google account.

Billing details

Stripe collects and processes your card details. We never see or store your card number. We keep the record of what you bought, what you paid, when, and the state you were billed in.

What you submit

The scripts, scene text, notes, prompts and reference images you put into a tool, and the project names you give them.

A script can contain anything, including personal details about real people and things the law treats as sensitive. Decide carefully what you paste in. Do not upload personal information about other people unless you have the right to, and do not upload a photograph of someone who has not agreed to it.

What the models generate

The images and text produced by your runs, stored so you can come back to them.

Usage and log data

Which tools you ran, when, whether a run succeeded or failed, and standard server logs including IP address, browser type and time of request. Logs exist so we can keep the service up and investigate abuse.

We also keep a security log of sign in attempts and of actions taken in our own operator console, recording the outcome, the IP address, and the country and region that address resolves to. That location is worked out from the IP address at our hosting provider, so no third party sees the request and nothing runs in your browser. This log exists so we can tell an ordinary sign in from someone trying to get into an account that is not theirs. It records sign ins and operator actions only. It does not record the pages you visit.

Why we use it

One row per purpose, so you can see exactly what each piece of data is for. We do not use your data for anything outside this table.

What we do	Data involved
Open your account and keep you signed in	Email, password credential, session cookie
Run the tools you ask for and store the projects and output	What you submit, what the models generate
Take payment, count credits, refund failed runs	Billing record, credit history
Send service email: receipts, failed payment notices, policy changes	Email, billing record
Answer your support messages and privacy requests	Email and whatever you tell us
Keep the service running, find bugs, stop abuse and fraud	Server logs, run history, IP address
Keep invoices and tax records	Billing record
Establish or defend a legal claim	Whatever the claim is about
Marketing email, if we ever send any	Email, and only if you opted in. Every one has an unsubscribe link

We do not run advertising on Cineva, so nothing here feeds an ad profile. We do not build a profile of you for any purpose beyond running your account.

Your scripts are not training data

We do not train models on the scripts, prompts or images you submit, and we do not permit the third party model providers to train on them either. Your material is sent to a model provider for one reason: to produce the output you asked for in that run. After the run it is stored in your account and nowhere else.

Each provider below is engaged on terms that exclude training on material submitted through their business or API tier. If a provider ever changed that, we would move off it rather than change this paragraph.

We also do not sell your material, publish it, or show it to other users. If we ever want to feature something you made, we will ask you first.

Who we share it with

Cineva is built on a small number of services. Each one works on our instructions, is bound by contract to use the data only to do the job we hired it for, and gets only what that job needs.

Service	What it does	What it gets
Stripe	Payments and subscriptions	Your email, your card details, what you bought
Supabase	Authentication and data storage	Your account details, your projects, your submitted material and your generated output
Vercel	Hosting and delivery	Request logs, including IP address
Google	Sign in with Google, if you choose it	The fact that you signed in, and your email address
fal.ai and Google Gemini	Generating images	The prompt, scene text and reference images for that run, and nothing that identifies you beyond them
Anthropic and OpenAI	Generating text	The prompt and script text for that run, and nothing that identifies you beyond them

Nobody else receives your data. We disclose it outside that list only where the law requires it, such as a valid subpoena, or where we have to in order to protect the service and its users from serious abuse. If Cineva is ever sold, the account data would move with it, and we would tell you by email before that happened so you could delete your account first.

We do not sell your information

We have never sold personal information and we have no plans to. We also do not share it for cross context behavioral advertising, which is the thing state privacy laws mean when they say sharing. There is no advertising network on this site and no data broker in the list above.

Because none of that happens, there is no opt out link to give you. If that ever changed, we would say so on this page first, and we would give you a working opt out before the change went live.

How long we keep it

What	How long
Account details	While your account is open
Projects, submitted material and generated output	While your account is open, then deleted 30 days after you delete the account. The 30 days exist so a deletion made by mistake can be undone
Server logs	90 days, then deleted
Payment records, invoices and tax records	7 years, because tax law requires it. These survive account deletion and cannot be deleted on request
Support email	2 years after the conversation ends

After deletion, copies can persist for a short time in provider backups until those backups roll over on their normal cycle. They are not used for anything while they sit there.

Your rights over your data

You can ask us to do any of the following, whichever state you live in.

Know. Find out what personal information we hold about you, where it came from, what we use it for, and who we shared it with.
Access. Get a copy of it.
Correct. Have anything inaccurate put right.
Delete. Have your account and its contents deleted. You can start this yourself from your account. Tax records are the one thing we have to keep.
Export. Take the material you submitted and the output you generated with you, in a machine readable format.
Opt out of any sale or sharing. We do not sell or share personal information, so there is nothing to switch off. If that ever changes, this is the right that covers it.
Say no to marketing. Unsubscribe from any marketing email at any time. Service email about your account and your receipts keeps coming while the account exists, because it is part of the service.

We will never treat you worse for using any of these rights. Your price does not change, your service does not degrade, and nothing gets slower.

How to make a request

Email hello@cineva.io and say what you want. There is no form and no fee. We answer within 30 days. If a request is genuinely complicated and we need longer, we will tell you inside those 30 days and say why.

We may ask you to confirm you control the account email before we send data anywhere, because handing an account export to the wrong person is its own privacy breach. Someone else can make a request for you if they show us written permission signed by you.

If we turn a request down, we will tell you why, and you can reply to ask us to look again. A person reads the appeal, and we answer it within 45 days.

Why you get these rights

Most US state privacy laws only bind businesses above a revenue or customer volume threshold, and a new product like this one does not meet them. We grant these rights to every user anyway. They cost nothing to honor and it would be strange to hold your data on worse terms just because the law has not caught up with us yet.

Cookies

Cineva sets one cookie, and only when you sign in. It is called cineva_session, it holds a signed token that says who you are, and it is what keeps you signed in as you move between pages. Scripts running in your browser cannot read it, and it expires when the session does.

That cookie is strictly necessary for a service you asked for, so there is no consent banner and nothing here to opt out of. If you block it, you cannot sign in.

We run no advertising cookies and no third party tracking on this site. We do count page views, and we do it ourselves rather than handing you to anyone else. There is no analytics cookie, nothing is stored on your device, and no other company sees that you were here.

Here is exactly how the counting works, because the mechanism is the only thing that makes the promise meaningful. When you open a page we record the path, the site you arrived from, the country and region your connection resolves to, whether you are on a phone or a desktop, and which browser family you use. To tell one visitor from another we take your IP address and browser string, mix them with a secret that we replace every day, and keep only the result. Your IP address itself is never written down. The next day the secret is different, so the same person becomes an unrelated value and yesterday cannot be joined to today. We could not follow you across two days if we wanted to, and we designed it that way on purpose.

What that costs us is worth naming: we cannot tell a returning visitor from a new one, so we cannot do the retention reporting most companies do. We think that is the right trade for a product people hand unproduced screenplays to. We do not record the query string of any page, the full address you arrived from, your exact screen size, or your browser version. Page view records are deleted after twelve months. If you turn on your browser's do not track setting we record nothing at all, which is not required of us and is why we do it.

If we ever add a third party analytics service or any cookie that is not strictly necessary, we will update this page before it goes live and give you a way to say no that does not cost you the service. A short lived cookie is also set during a Google sign in to protect that round trip from tampering, and it is deleted the moment the sign in finishes.

We do not currently respond to browser Do Not Track or Global Privacy Control signals, because we do not do the tracking those signals turn off. If we ever start, we will honor them.

Profiling and automated decisions

AI models produce your output, which is the whole point of the service. That is not profiling. It decides nothing about you and creates no assessment of you.

We do not profile you for targeted advertising, and we make no automated decision that has a legal or similarly significant effect on you. Rate limits and abuse checks can block a request automatically, but a person reviews any account suspension or closure before it happens, and you can reply to the notice and reach that person.

Security

Passwords are hashed, sessions are signed, the site is served over TLS, and card details never reach our servers. The full picture, including what we do not claim, is in the security policy.

No service is perfectly secure. If a breach ever puts you at risk, we will tell you without unnecessary delay, and notify the authorities that state breach notification law requires us to notify.

Age limit

Cineva is for people aged 13 and over, and anyone under 18 needs a parent or guardian to accept the terms of service for them. We do not knowingly collect personal information from children under 13, and we do not direct the service at them.

If you are a parent and you believe your child under 13 has an account, email hello@cineva.io and we will close it and delete the data in it.

Changes to this policy

When this policy changes in a way that affects you, we email the address on your account before the change takes effect. Smaller corrections take effect when they are published. The date at the top of this page always shows the current version, and the current version always lives at this address.

How to reach us about privacy

Email hello@cineva.io. It reaches the person who runs Cineva, and it is the right address for an access request, a deletion request, a complaint, or a question about anything on this page. If you need a postal address, ask by email and we will give you the business address on the California fictitious business name filing.