Privacy Policy

Last updated: July 9, 2026

This policy explains what personal data Meyandy LLC (Phoenix, Arizona, United States) collects when you use X-Celant, why, who processes it, and the rights you have — including under the GDPR if you are in the European Economic Area and under applicable African data-protection laws.

1. Data we collect

Account data — email address, name, password (stored hashed by our authentication provider), language preference and plan.
Content — media you upload, projects, timelines, prompts you write, and the scripts, voiceovers, images, music and clips generated for you.
Billing data — subscription status, invoices and a customer reference handled by Stripe. We never see or store your card number.
Usage data — campaign production activity, exports, feature usage and technical logs (IP address, browser type) needed for security and rate limiting.

2. Why we process it

to provide the service and fulfil your generation requests (contract);
to bill subscriptions and extra campaigns (contract, legal obligation);
to secure the service, prevent abuse and enforce limits (legitimate interest);
to send service emails such as receipts and important changes (contract);
to improve the product using aggregated, de-identified usage statistics (legitimate interest).

We do not sell your personal data and we do not use it for third-party advertising.

3. Processors we rely on

Your data is processed by these providers, under their own data-protection commitments:

Supabase — database, authentication and file storage.
Vercel — application hosting and delivery.
Stripe — payments and billing.
AI providers — when you request a generation, the relevant prompt or media is transmitted to the provider that performs it: our language-model provider (scripts), ElevenLabs (voice, music, sound effects and voice studio) and fal.ai (images and video clips). We send only what is needed to fulfil the request.

4. International transfers

We are a US company and our providers process data primarily in the United States and the European Union. Where required, transfers are protected by safeguards such as the EU Standard Contractual Clauses implemented by our processors.

5. Retention

Account and active content data: kept while your account is active.
Incomplete uploads: removed after their 24-hour operational window.
After account deletion: active media and personal data are deleted immediately, followed by a storage reconciliation sweep within 24 hours.
Provider backups may remain until their rotation, with a 90-day maximum target.
Billing ledger entries may be kept for up to seven years where tax or accounting law requires it, after removing identity and free-form metadata.
Security and error logs are kept for up to 12 months without prompts or tokens.

6. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, or African data-protection laws such as those of UEMOA member states), you may have the right to access, correct, delete, export or restrict the processing of your personal data, and to object to processing based on legitimate interest. You can exercise most of these directly in your account settings, or by writing to hello@contact.x-celant.com. You also have the right to lodge a complaint with your local supervisory authority.

7. Security

Data is encrypted in transit, storage buckets are private with per-user access rules, database access is protected by row-level security, and payment webhooks are signed and verified. No system is perfectly secure; notify us immediately at the address above if you suspect unauthorized access to your account.

8. Children

The service is not directed to children under 16 and we do not knowingly collect their data.

9. Cookies

We only use cookies that are strictly necessary to sign you in. See the Cookie Policy.

10. Changes and contact

We will notify you of material changes to this policy by email or in-app before they take effect. Data controller: Meyandy LLC, Phoenix, Arizona, United States — hello@contact.x-celant.com.