An account of what is written down

1. What is written down here, and how long does it remain?

The list is shorter than the length of this page suggests, and it is worth setting out in full. Your account yields a name, an email address, a hashed password, the secrets and recovery codes behind two-factor authentication, and the record of which teams you belong to and who invited you there. The work made here yields prompts, scripts, storyboards, scenes, anything you upload, the brand kits you keep, and the images, narration, subtitles and finished videos drawn out of them. The running record yields credit movements, generation and render tasks, project history, and the usage figures without which no quota can be enforced and no support question sensibly answered. Payment yields a billing name, what each transaction was worth and in what currency, the invoices we issue, the gateway’s verdict on an authorisation, and the deliberately narrow card identifiers described three sections below. Technical data yields an IP address, browser and device information, timestamps and error logs, gathered for security, for fraud prevention and for working out why something broke. And correspondence yields whatever you put to us by the contact form or by email, together with our answers.

Nothing on that list is kept for its own sake. Projects and the media inside them remain until you remove them, or until the account itself is closed and carries them off with it. Account data lasts the life of the account and is afterwards erased or stripped of anything identifying. Payment, invoice and tax records are held for the period accounting and tax law fixes, and for as long after that as a card dispute might still be raised against the transaction. Security and access logs are ordinarily kept for 12 months, and longer only where an investigation is genuinely open. Closing an account removes the projects, the media and the personal details; the financial record behind a payment already made outlives the account, for the reason just given.

2. Whose hands is it in, and where do those hands sit?

Coveo AI is operated by Coveo AI. Coveo AI decides why and how the personal data described here is processed, and is therefore its controller in the sense the data protection law gives that word. The notice governs the Coveo AI site, the software behind the log-in, and the billing and support that go with them; it applies alike to a visitor who reads and leaves, to a registered user, and to the finance contact of a business account.

Those who process data on our behalf are not gathered in one country. They work in the United Kingdom, the European Economic Area, the United States and the United Arab Emirates. Where personal data travels out of the EEA or the UK it does so under an adequacy decision or under the European Commission’s Standard Contractual Clauses, and a copy of whichever safeguard covers a given transfer will be sent to anyone who asks for it through the contact form.

3. What becomes of a card number once it is entered?

It passes through; it does not stay. Payment is carried end to end by Mastercard Payment Gateway Services, so that the number you type on the payment page crosses an encrypted TLS connection and arrives at the gateway to be authorised. Your full card number and your security code (CVV/CVC) are never stored on our servers. Once the transaction is authorised the number has lived inside a single request and does not survive it. What stays attached to your account is the little that lets you recognise which card paid and lets us keep the records we are obliged to keep: the brand of the card, its first six and last four digits, and the date it expires. Where you have asked us to hold a card for another time, a token issued by the gateway is held with it — worthless anywhere but against our own merchant account, and never handed to the browser or to anyone else.

The handling of cardholder data answers to the Payment Card Industry Data Security Standard, and to the operating regulations Visa and Mastercard impose. Of the gateway’s answer we keep the verdict and the reference, and nothing within it that could serve to authenticate the card a second time. Where your issuing bank asks for it, a payment is additionally authenticated by 3-D Secure, an exchange conducted between you, your bank and the gateway, at which we are simply not present.

4. On what lawful footing does any of this rest?

Four purposes, each resting on something. We process your data to run the service — opening the account, generating and rendering your videos, keeping your projects where you left them, and answering when you write — because that is the agreement you entered into, and it cannot be performed on any other footing. We process it to take payment — top-ups, subscriptions and renewals, invoices, refunds, chargebacks and disputes — on that same agreement, and on the tax law which obliges us to keep the paperwork afterwards. We process it to keep the place in order — automated moderation of prompts, abuse and fraud prevention, rate limiting and security monitoring — because we hold a legitimate interest in not becoming a vehicle for harm, and because part of it is required of us in any event. And we process it to write to you — service notices, billing and renewal messages, and product news only where it was asked for and with a way out at the foot of every one — on the agreement between us, or on your consent where consent is what the message needs. Two things do not happen at all: your work never becomes training material for a model of ours, and personal data is never sold, to anyone, for anything.

5. Where does a submitted prompt travel, and who reads it?

A sentence becomes a video only by leaving the building. The prompt, together with the script, storyboard and scene descriptions drawn out of it, goes to the AI model providers we work with, Anthropic among them, who act as processors under contracts forbidding them to train on your material; before any of that, the prompt passes automated moderation. What returns is held so that the finished piece may be assembled and reopened later, and for no other end whatever.

The wider company of those who touch any part of your data is small, and each of them is bound by a written data processing agreement. Cloud hosting and object storage providers run the application and hold your media. An email provider carries the transactional messages. The gateway named above keeps a card on file where you have asked for that, conducts the 3-D Secure check, and returns the authorisation. The model providers just described generate the work. Beyond the processors, our accountants, auditors and legal advisers see what their office requires of them, as do an authority or an acquiring bank where the law obliges us to answer — most often over a card dispute.

6. What is left in the browser, and how is the remainder defended?

Three cookies are set and all three are necessary. One remembers how you prefer the interface arranged. One keeps you signed in from page to page. One carries the token that prevents a form on somebody else’s site being submitted as though it were yours. There is no advertising cookie, nothing here follows a reader onto another site, and no analytics house is given a tag on these pages — so there is nothing to consent to and nothing trailing behind you afterwards. Refuse the three and signing in will not work.

As to the remainder: everything travels over TLS; passwords are held hashed and salted, never in readable form; two-factor authentication is offered to every user and required of administrators; production data is reachable only by the staff whose work needs it; secrets are held encrypted; the card endpoints are rate limited. No system is perfectly secure. Should a breach reach your personal data, you and the competent supervisory authority will hear from us within the time the law allows.

7. What may a reader require of us, and by what route?

You may see the personal data held about you, correct whatever is wrong in it, export it, or have it deleted — most of which is done from account settings without writing to anybody. Subject to the law that applies to you, you may also object to a use or ask that it be restricted, withdraw a consent given earlier, and complain to a supervisory authority, which for a reader in the EEA means whichever data protection authority covers your country of residence. Such a request is answered inside 30 days, and the first one costs nothing.

Coveo AI is not meant for children. You must be at least 18, or of full age where you live, to hold an account or to pay for anything, and an account we discover belongs to a child is closed.

Revisions are published on this page and dated at the head of it; where a revision is material we write to you by email at least 14 days before it takes effect, so that leaving first remains open to you. Questions on any of the above reach Coveo AI through the contact form, which stands open whether or not anything else on this page is filled in.