Skip to main content
HeyMotion
PrivacyVersione italiana

Privacy Policy

In plain words: what we collect when you use HeyMotion, why, who helps us process it, how long we keep it and what you can ask us at any time. This notice is given under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

Last updated: 16 October 2026

1. Who is responsible for your data

The data controller is Growth Marketing S.r.l., Via Ponte di Tappia 47, 80133 Napoli (NA), Italy, P.IVA 09899971213, PEC growthmarketing@pec.it.

Our Data Protection Officer (DPO) can be reached at dpo@growthmkt.it. Write to the DPO for any question about your data or to exercise your rights.

2. What we collect

  • Account data: your name, email address and sign-in details when you create an account.
  • Billing data: plan, invoices and payment status. Card details are entered on Stripe and never reach our servers.
  • Your content: the videos and links you upload and what we generate from them—transcripts, clips, captions, voiceovers, translations, written guides and editor timelines—plus the narration settings you save (brand name, greeting, sign-off, writing rules). If a video shows or records other people, their images and voices are part of your content too.
  • Usage and technical data: minutes used, job status and technical logs linked to your account.
  • YouTube data: only if you connect your channel, the access needed to publish the videos you choose. Access tokens are stored encrypted.

3. Why we use it, and on what legal basis

  • Providing the service you signed up for—processing your videos and delivering the results: performance of a contract (Art. 6(1)(b) GDPR).
  • Billing and accounting, and meeting tax obligations: contract and legal obligation (Art. 6(1)(b) and (c)).
  • Service emails—when your clips or tutorials are ready (you can switch these off in your settings) and when you have used 80% and 100% of your monthly minutes: contract (Art. 6(1)(b)).
  • Security, preventing abuse and fixing errors: our legitimate interest in running a safe and reliable service (Art. 6(1)(f)).
  • Handling reports of illegal content and requests from authorities: legal obligation (Art. 6(1)(c)), under the EU Digital Services Act.

Account data and your content are necessary to provide the service: without them we cannot process your videos. We do not sell your data, we do not use it for advertising, and neither this website nor the app uses advertising or analytics trackers. We take no decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). The scores the AI gives to your clips describe the clips, not you.

4. How the AI processing works

  • To analyse a video we send a compressed copy without its audio track to Google’s Gemini API, together with the transcript and script text needed to write narration, translations and YouTube metadata. We use Gemini’s paid service: Google does not use this content to improve its products, and keeps prompts and outputs for 55 days only to detect abuse. We delete the uploaded video copy right after the analysis; any copy left behind expires automatically within 48 hours.
  • To transcribe speech we send only the audio to Regolo.ai, which processes it in the EU.
  • Screen tracking and some voice steps may run on GPU services provided by RunPod.
  • We do not use your content to train AI models.

5. Who processes data for us

These providers act on our behalf as data processors, under contracts that bind them to the GDPR. Each one only receives what it needs for its task:

  • Google Cloud: App hosting, database and file storage. Where: EU — Belgium (europe-west1). Safeguard: Google Cloud data processing terms.
  • Google Gemini API (paid tier): Video understanding, script writing, translation, AI voices and YouTube metadata. Where: Google's global infrastructure, including outside the EU. Safeguard: Google data processing terms; EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Regolo.ai (Seeweb S.r.l.): Speech-to-text transcription. Where: EU — Italy. Safeguard: No transfer outside the EU.
  • RunPod: GPU processing for screen tracking and voice generation. Where: Data centers worldwide, including the United States. Safeguard: Standard Contractual Clauses.
  • Stripe (Stripe Payments Europe, Ltd.): Payments and subscription billing. Where: Ireland, with transfers to the United States. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Clerk: Sign-in and account authentication. Where: United States. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Resend: Transactional emails (e.g. “your video is ready”). Where: United States. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Google / YouTube API: Publishing to your channel, only if you connect YouTube. Where: Google's global infrastructure. Safeguard: Google data processing terms; EU-US Data Privacy Framework.

For fraud prevention and its own legal obligations, Stripe also acts as an independent controller under its own privacy policy. We may also disclose data to public authorities when the law requires it.

6. Where your data is stored and transfers outside the EU

Your files and our database are stored in the European Union, on Google Cloud in Belgium (europe-west1). Some of the providers above process data outside the European Economic Area, mainly in the United States. In those cases the transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for certified providers, and on the Standard Contractual Clauses approved by the Commission (Art. 45 and 46 GDPR). You can ask the DPO for a copy of the safeguards.

7. How long we keep it

  • Videos, generated files and library: until you delete them, or until you delete your account. Deleting a job deletes its files.
  • Account deletion: when you delete your account, we automatically erase your files, jobs, library, connected YouTube access, API keys and settings.
  • Invoices and accounting records: 10 years, as required by Italian law (Art. 2220 of the Civil Code), also after the account is deleted.
  • Copies sent to Gemini: deleted right after use, at the latest within 48 hours; Google’s abuse-monitoring records, 55 days.
  • Technical logs: up to 30 days, unless they are needed longer to investigate a security incident.

8. Your rights

You can ask to access your data, correct it, delete it, receive it in a portable format, restrict its processing or object to processing based on legitimate interest (Articles 15–22 GDPR). Write to the DPO at dpo@growthmkt.it or to our PEC. We answer within one month, which can be extended by two further months for complex requests, as the GDPR allows.

If you think we are processing your data unlawfully, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of the EU country where you live or work.

9. Age

HeyMotion is for adults: you must be at least 18 years old to create an account.

10. Cookies and changes to this policy

See our Cookie Policy. When this policy changes, we publish the new version on this page and update the date at the top; if the change matters for how we use your data, we also tell you by email.