Privacy Policy

This Privacy Policy explains how Scenelith collects, uses, shares, and retains personal information when you visit our public pages, create an account, use the visual canvas, import media, generate content, subscribe to a plan, or contact support.

Scenelith is the controller of information used to operate your account and workspace. Some providers process information on our behalf or independently under their own terms.

Account and identity

Name, email address, authentication method, verified status, and profile details. For password accounts we store a one-way password hash, never the plain-text password. Google sign-in provides an account identifier, verified email, and profile name, but not your Google password.

Workspace content

Projects, nodes, connections, notes, prompts, imported URLs, uploaded images and videos, reusable identities, references, generation settings, generated outputs, and related metadata.

Billing and usage

Plan, billing interval, credit balance and ledger, checkout and transaction identifiers, subscription state, generation usage, and refund or dispute status. Payment card details are collected by Whop or the displayed payment provider and are not stored by Scenelith.

Technical, safety, and support data

Session records, timestamps, IP-derived security signals, browser and device information, request logs, errors, provider responses, safety or policy rejection signals, abuse reports, enforcement decisions, and messages you send to support.

We use information to authenticate users; keep workspaces separated; save and synchronize projects; execute imports and generation jobs; manage plans and credits; prevent fraud and abuse; apply our Terms of Service; investigate safety, abuse, and intellectual-property reports; diagnose errors; communicate service and account information; provide support; and improve reliability and product experience.

Where applicable, we rely on performance of our contract, legitimate interests in operating and securing the service and protecting users and third parties, consent where requested, and compliance with legal obligations.

When you run a workflow, Scenelith sends the selected provider only the prompts, references, media, settings, and technical identifiers needed to complete that request. Different models may use different providers, which can change as availability, quality, safety, and pricing evolve.

Providers may process submitted material under their own terms and privacy notices, apply automated or human safety measures, and return policy classifications, rejection reasons, errors, or generated output to Scenelith. Provider safeguards vary by model and do not guarantee that every prohibited request or output will be identified.

Do not upload sensitive personal information, confidential client material, biometric data, health data, or other regulated information unless you have authority to process it and have assessed the selected provider for that use.

We do not routinely have personnel review every private project or generated asset. When we receive a credible report, provider safety rejection, suspected abuse signal, or valid legal request, authorized personnel may review the relevant account information, prompts, references, outputs, provider responses, technical records, and complaint evidence only as reasonably necessary to investigate, enforce our terms, protect users or third parties, and comply with law.

We may use the results to block or remove content, restrict generation, suspend or terminate an account, preserve evidence, respond to a rights holder, or make a legally required disclosure. Where appropriate, we may notify the affected account holder unless prohibited by law or necessary to protect an investigation or another person.

We share information with infrastructure and service providers that support hosting, storage, email, authentication, payment processing, analytics, security, media import, and AI generation. We may also disclose information when required by law, to protect users or the service, during a corporate transaction, or with your direction.

We do not sell personal information. With your advertising permission, configured Meta, Google Ads and TikTok integrations can measure visits, registrations and confirmed purchases. We share campaign click identifiers, advertising cookies, sanitized page addresses, browser information, IP address and a one-way hashed account identifier or email through PostHog and the configured advertising platform. We exclude prompts, private media, names and raw email addresses. You can decline or withdraw advertising permission using Privacy.

Scenelith uses essential cookies and similar storage to keep you signed in, protect OAuth flows, remember the last authentication method, preserve checkout intent, and secure requests. These are required for the service to function.

With your permission, we use PostHog (US hosting) and Google Analytics to measure page visits, feature use, generation outcomes, subscriptions and credit purchases. We link these events to a pseudonymous account identifier after sign-in. Product analytics excludes your name, raw email, prompts and private media. If you separately allow advertising, PostHog also processes the limited advertising matching data described above. Some visits have session recordings with text masked and media and input fields blocked. Console logs, request bodies and headers are excluded. You can reject optional analytics or change your choice using the Privacy control at any time. Essential account, security and transaction records remain necessary to operate the service.

Account and workspace information is retained while your account is active and for a reasonable period afterward to support recovery, security, billing, dispute handling, safety enforcement, and legal obligations. Our analytics delivery journal is retained for up to 90 days, separate from required billing records. Masked PostHog recordings are retained for 30 days. Analytics event retention follows the configured service retention; contact us to request deletion of account-linked analytics data.

Deleted data may remain temporarily in encrypted backups until normal backup rotation completes. We may retain limited transaction, provider rejection, abuse-report, enforcement, intellectual-property, or legal records where required or permitted, including when necessary to prevent repeated violations or resolve a dispute.

We use reasonable administrative and technical safeguards designed for the nature of the service, including hashed passwords, random server-side session tokens, HTTP-only cookies, server-side workspace authorization, encrypted transport, and restricted production access.

No system is completely secure. If you believe your account or data is at risk, contact support@scenelith.com promptly.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, and appeal or complain to a data protection authority. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

Send a request to support@scenelith.com from the email associated with your account. We may verify your identity and may retain information where an exception or legal obligation applies.

Scenelith and its providers may process information in countries other than your own. Where required, we use recognized transfer mechanisms and contractual protections. Provider locations depend on the model and infrastructure selected for a workflow.

Scenelith is not directed to children under 13 and we do not knowingly collect their personal information. If you believe a child has provided information to the service, contact us so we can review and remove it where appropriate.

We may update this policy as Scenelith, its providers, or applicable requirements change. We will publish the revised version here and update the date above. Material changes may also be communicated in the product or by email.

Privacy requests and questions can be sent to support@scenelith.com.