Privacy Policy

ToMotion is the AI video creation service operated by Assureme Technologies Private Limited, India (“we”, “us”, or “our”). This policy covers our website at www.tomotionai.com, accounts, video generation, uploaded assets, voice features, payments, and communications with us. Our privacy contact is founder@tomotionai.com.

We determine how account, billing, security, and website information is used. Where we process content for a business customer under a data processing agreement, that customer may determine the purposes of processing and be responsible for notices and permissions for people whose information it uploads. Contact us if you are unsure who handles a request about your information.

This policy explains our practices; reading it or using the website does not, by itself, give permission for optional advertising, marketing, or every use of personal information. Applicable privacy rights depend on your location, the processing, and the laws that apply.

We receive information directly from you, automatically when you use ToMotion, from a sign-in or payment provider, and from another user who includes your information in content. The categories below apply to the features you use.

• Account and sign-in information: email address, account identifier, display name, profile image, sign-in provider, authentication and session records, and account creation or update times. Email/password credentials are handled through Supabase authentication. Google sign-in supplies account and profile information made available for sign-in. We use these details to authenticate you, maintain your profile, and communicate with you.
• Onboarding, preferences, and usage: your selected background or role, video creation goal, language and creation settings, plan, credit balance and usage, email preferences, and privacy choices. We record account and product events such as sign-in, signup, a first video request, a credit purchase attempt, and a completed purchase, with identifiers and related metadata. These records support the service, product reporting, billing, and troubleshooting. After a purchase, you may optionally tell us where you first heard about ToMotion. We store your selected answer or skip choice with your account identifier and response time to understand discovery sources. This answer is separate from advertising conversion events; you can skip the question without affecting your purchase or access to the service.
• Content and brand assets: prompts, scripts, titles, reference images, logos, theme preferences, and other material you submit, together with generated scripts, scene descriptions, images, narration, transcripts, previews, videos, and associated files and metadata. We process these to generate, edit, store, display, and deliver your content and investigate generation problems.
• Voice information: uploaded or recorded audio samples; voice names, descriptions, language and gender labels you select; your permission confirmation; provider voice identifiers; cloned voice models; and generated speech and previews. These support voice creation, management, and narration. Audio can identify a speaker and contain information about other people. See the voice section below.
• Payment information: account and contact details, selected credit pack or plan, currency, amounts, order and payment identifiers, payment status, credit adjustments, and transaction responses or notifications from Razorpay. These can include payer email, phone number, payment method, and limited payment instrument details. Razorpay handles payment credentials; we do not store full card numbers, CVV codes, or UPI PINs in ToMotion. Transaction records support payment verification, credit allocation, support, fraud prevention, and accounting.
• Support and communications: your email, messages, bug reports, information you attach or include, the relevant page address, browser information, and correspondence about support, demos, billing, or privacy. We use these to respond and resolve issues.
• Technical and security information: IP address, browser and device information, request times, approximate country inferred from network information, page or referral addresses, errors, job status, and diagnostic logs. We store hashed signup IP and browser information and risk flags to detect repeated free-credit claims and abuse. Country information helps select pricing currency. Hashing does not necessarily make information anonymous.
• Optional measurement and advertising information: website activity, advertising click and browser identifiers, landing-page information, conversion events, and matching information described in the cookies section. These optional tools depend on your tracking choices and the regional defaults described below.

Account details are needed for an account; payment details are needed for a purchase; and generation inputs are needed for the features you request. You can browse public pages without an account and decline optional tracking. Avoid including passwords, government identification numbers, financial account credentials, health information, or other sensitive information in prompts or uploads unless necessary and lawful.

To create videos, we send relevant prompts, scripts, images, audio, and settings to AI providers. OpenAI supports text and image processing; Google Cloud / Vertex AI and ElevenLabs support speech generation; and ElevenLabs can process audio and text for speech alignment. The provider depends on the feature, voice, and configuration. Generated material and intermediate files may be stored with your project. Our team may access content and diagnostics for support, investigating failures or abuse, and checking generation quality.

Voice cloning sends your samples and relevant details to ElevenLabs to create a reusable voice model, in addition to generating individual audio files. The feature asks you to confirm that you own the voice or have permission to use it. This is not an independent verification of the speaker or their permission. Only submit someone else's voice or personal information with the necessary authority and after explaining the intended use. ToMotion does not use cloned voices to authenticate your identity.

Provider storage, abuse monitoring, and any permitted use for model improvement depend on the service and contractual settings. This policy does not promise that every provider has zero retention or excludes model improvement. Contact us before submitting content if you need a particular processing restriction.

Deleting a saved voice through voice management requests deletion of the provider voice and cleanup of its stored samples and preview. Existing videos or audio made with that voice are separate files and are not deleted by removing the voice. If your voice or likeness has been used without permission, contact our privacy email with the relevant account, video link, or voice details. You do not need an account to report a concern.

The creation form currently has “Publish to Public Gallery” selected by default.Clear that option before creating a video you want to keep private. You can also change an existing video's visibility using its sharing controls.

A public video can expose the video, audio, thumbnail, title, original prompt, narration transcript, creation date, and settings such as language, theme, and voice label. It may appear in the gallery, public watch pages, search results, and link previews. Anyone who can access it may copy or redistribute it. Changing visibility or deleting a video does not recall copies made by others or immediately remove search-engine caches. Review both the content and its source prompt before making it public.

Essential cookies and browser storage support sign-in, security, checkout, preferences, and remembering privacy choices. Optional Vercel and Google Analytics website analytics and Google Ads and Meta advertising tools are off until you enable the corresponding category, except for the transitional India default described below. Use Cookie settings here, in the footer, or in account Settings to accept, reject, or change these choices. Declining optional tracking does not prevent use of the core service.

For visits identified as originating in India by our hosting provider's IP-based country signal, analytics and advertising are enabled by default without an initial cookie popup. This is a regional default, not a record that you clicked Accept or gave affirmative consent. You can turn either category off through Cookie settings without signing up. Existing saved rejections or partial choices are not overridden; signed-in account choices are checked before applying a new India default. Other countries and unknown locations use the opt-in popup. India defaults are not used for requests with a Global Privacy Control signal, and the transitional default stops before 13 May 2027 unless reviewed and replaced. IP-based location is approximate and can be affected by VPNs; it does not establish nationality or determine all laws applicable to a person.

Vercel analytics measures website usage. Google Analytics 4 measures page visits, referring websites, campaign sources, device and approximate geographic information, and verified purchases (transaction identifier, credit quantity, value and currency). Analytics uses browser identifiers and cookies. Our explicit Analytics events exclude email addresses, account IDs, private video titles, prompts and arbitrary URL query parameters. Automatic form and site-search measurement is disabled. Learn how Google uses information from sites that use its services. When advertising is enabled through your choice or the India regional default, Google Ads and Meta (Facebook/Instagram) receive information for conversion measurement, attribution, ad matching, and personalized advertising. Depending on the event, this can include page and landing URLs, click IDs, browser IDs, IP address, user agent, signup or purchase events, transaction value and currency, and hashed email and account identifiers. Meta and Google Ads conversions can be sent from our servers as well as your browser. Our Google Ads server integration uses saved ad click identifiers; it does not upload your email address or mark India regional defaults as affirmative consent. Hashed identifiers remain personal information and may be matched to information the provider already holds.

We remember a tracking choice for up to 180 days and keep a server record of its identifier, choices, notice version, creation and expiry times, withdrawal, and associated account where available. The record distinguishes an actual user choice from an India default, and India-default records also include the country code and expire no later than the transitional policy cutoff. Meta attribution cookies have a maximum configured lifetime of 90 days. Eligible clicks linked to your account can be used for attribution for up to 90 days, including a later purchase on another device. These limits describe cookie lifetime or attribution eligibility, not automatic deletion of every related server record.

When advertising is enabled, we store Google ad click identifiers (gclid, gbraid or wbraid), campaign, ad group and ad identifiers where provided, keywords and campaign tags, and the landing-page address without its arbitrary query string. An optional first-party cookie links this visit to your account after sign-in. We retain first and latest eligible ad visits for up to 90 days or until the associated permission expires or is withdrawn, whichever is earlier. Conversion-delivery audit records without raw click identifiers or email addresses are retained for up to 180 days. Without eligible identifiers we do not invent a Google ad source for a direct or organic visit.

Rejecting advertising while signed in withdraws older advertising permissions linked to that account and blocks later server uploads relying on them. Changing choices removes optional first-party tracker cookies we control and reloads the page when necessary to stop loaded tools. Choices may need to be set again on other browsers or devices. Withdrawal stops future processing based on that permission; it cannot recall events already sent. Contact us about deletion of previously shared data.

Cookie settings control optional trackers. Account activity, payments, generation diagnostics, security logs, and consent records are collected separately as described above. Global Privacy Control prevents application of the India automatic default; it does not currently override a saved affirmative choice. The website does not automatically interpret browser Do Not Track. Use Cookie settings or contact us to communicate your choice. These limitations do not remove rights under applicable law.

Provider notices: Google, Meta, and Vercel.

We use email for account and service messages, replies, video-ready notifications, and product or marketing updates according to your preferences. You can change marketing and video-ready email preferences separately in account Settings, or contact us to stop marketing. Necessary account, security, payment, and privacy communications may still be sent. Email providers receive recipient details and message content, which may include a video title or link.

These services receive information relevant to their role when the corresponding feature is used. Not every provider receives every category of information.

• Supabase: authentication, account and application database records.
• Amazon Web Services (AWS): uploads, voice samples, generated media, processing jobs, and operational logs for storage and video processing.
• Vercel: website hosting and delivery, request and diagnostic information, and optional website analytics.
• OpenAI, Google Cloud / Vertex AI, and ElevenLabs: relevant AI inputs, outputs, and voice information for the processing described above.
• Google: authentication when you choose Google sign-in, and Google Analytics when analytics is enabled, separately from speech and optional advertising services.
• Razorpay: checkout, payment processing and verification, and related transaction information.
• Resend: email addresses, delivery information, and messages sent through our email service.
• Google Ads and Meta: advertising and conversion information when advertising is enabled.
• Other people: information in public content or content you share, as explained above.

Information may also be disclosed to advisers and authorities where necessary for accounting, legal obligations, valid legal requests, protecting rights and safety, investigating abuse, or resolving disputes. A merger, acquisition, or transfer of the service may involve relevant records, subject to applicable protections and notice duties. Some providers also determine their own uses, such as payment fraud prevention or advertising, under their own terms and privacy notices.

Advertising disclosures can constitute “sharing” or a “sale” under some US privacy laws even without a cash payment. Turn off Advertising in Cookie settings to stop the optional disclosures described here.

We operate from India and use providers with international infrastructure. Information may be processed outside India or your country, including in the United States, depending on the provider and configuration. We do not promise storage only in India or your country. Privacy protections in other countries may differ.

Transfer requirements depend on the data, recipient, and jurisdiction. Where required, transfers need an appropriate legal mechanism, such as an adequacy decision or approved contractual safeguards. Contact us for the locations and safeguards relevant to your data, or a copy of applicable safeguards. Agreeing to this policy does not itself supply a missing transfer safeguard.

Retention depends on the purpose of the record, your account and deletion choices, outstanding transactions or disputes, legal obligations, and provider or backup arrangements. There is currently no single automatic deletion period for all ToMotion data.

• Account and project records: retained to maintain your account, library, preferences, assets, and requested services. Contact us for account closure or a complete deletion request.
• Videos and voice assets: remain available until removed through the relevant controls or a deletion request is handled. Removing a video record does not automatically erase every stored media file or processing artifact. Voice sample cleanup can require follow-up if a provider or storage operation fails.
• Billing and transactions: retained as needed for reconciliation, refunds, disputes, fraud prevention, and applicable tax or accounting retention requirements, including where an account is closed.
• Support, security, and diagnostics: retention depends on resolving the issue, investigating misuse, protecting the service, and required legal or security-log retention.
• Consent and advertising: browser choice and Meta attribution limits are described above. Consent evidence and transaction-linked records may remain after a permission or attribution window expires; expiry alone is not an erasure request.

Complete deletion can require separate handling of database records, media, voice providers, backups, and other recipients. Some records may need to remain for a legal obligation or specific dispute. Ask us to explain retained categories and reasons when requesting deletion. Copies held independently by other people, search engines, or providers acting for their own purposes may require a separate request to them.

ToMotion uses authentication, ownership checks for private resources, restricted server credentials, and payment-signature verification as part of its safeguards. No internet service can guarantee absolute security. Contact us promptly if you suspect unauthorized access, disclosure, or misuse. Required breach notifications are governed by the law applicable to the incident.

AI generates content automatically. Automated abuse checks use signup network and browser information and may withhold free signup credits after repeated signups from the same network within 24 hours; email-domain controls may restrict registration. These checks can affect people sharing a network. Contact us if you believe a restriction is incorrect and want it reviewed. Advertising providers may use consented events to match or personalize advertising.

ToMotion currently does not impose an age restriction or verify age at signup, and it does not offer a verified parental-consent process. The absence of an age check is not permission to process a child's information where the law requires parental consent or other safeguards. Parents and guardians can contact us to report a child's account or information and request review or deletion.

If you include information about students, customers, colleagues, or others in a prompt, image, recording, or public video, you are responsible for the permissions and notices required for that use, including additional protections for children or sensitive information. Affected people can contact us directly even if they did not create the account that supplied their information.

Contact founder@tomotionai.com to request access to or a copy of your information, correction, deletion, account closure, withdrawal of consent, or help with an objection or complaint. Depending on applicable law, you may also have rights to portability, restriction, and information about recipients. Rights can have legal exceptions. There is currently no self-service account closure or complete data-export workflow.

Describe your request and, where possible, write from your account email. For content uploaded by someone else, include a link or enough information to locate it. We may need proportionate information to verify identity or a representative's authority before disclosing or changing records. Do not email passwords, full card details, or identity documents unless a necessary, secure verification process has been agreed. We will explain an applicable limitation or refusal and the available next steps.

Withdrawal does not affect the lawfulness of processing before consent was withdrawn. Withdrawing information or permission needed for a feature may prevent us from providing that feature. You can change cookie and email choices without closing your account.

Applicable Indian requirements include the Information Technology Act and the Sensitive Personal Data or Information Rules, 2011, where relevant. These include review and correction, choices about providing or withdrawing consent for sensitive information, and grievance handling. Where the SPDI Rules apply, grievances must be addressed within one month of receipt. Send privacy concerns to the contact below.

The Digital Personal Data Protection Act, 2023 and Rules, 2025 have phased commencement. As of this policy's update date, most substantive processing duties and individual rights are scheduled to commence in May 2027. As applicable, they include access to information about processing, correction and erasure, grievance redressal, and nomination of a person to exercise rights in the circumstances specified by law. Complaints to the Data Protection Board of India are subject to applicable commencement and grievance procedures. See the official commencement notification.

Where the EU or UK GDPR applies, processing to provide accounts, purchases, and requested generation relies on contractual necessity; optional tracking and consent-based marketing rely on consent; and necessary security, abuse prevention, troubleshooting, and business reporting may rely on legitimate interests, balanced against your rights. Legal obligations apply where the relevant law requires processing. Additional permission may be needed for special-category data; an account or upload is not blanket permission for that processing.

You may have rights of access, correction, erasure, portability, restriction, objection (including to direct marketing), and withdrawal of consent. The usual response period is one month, subject to permitted extensions with notice. You may complain to your local data protection authority or the UK Information Commissioner's Office. Contacting us first is optional for these regulatory complaints.

Where applicable state privacy law covers our processing, rights may include access, correction, deletion, a portable copy, and opting out of sale, sharing, targeted advertising, or certain profiling. Rights may also include limits on specified sensitive information uses, use of an authorized agent, and appeal of a denied request. We will not unlawfully discriminate for exercising a privacy right.

Our categories include identifiers, account and commercial information, internet activity, approximate location, audio/visual content, and information or inferences supplied through profiles and content. Sources, purposes, recipients, and retention criteria appear above. Advertising disclosures and the browser-signal limitation appear in the cookies and sharing sections. Disable Advertising in Cookie settings or email an opt-out request; an account is not required to contact us.

Covered California access, correction, and deletion requests generally have a 45-day response period, with permitted extensions explained. Other requests or states can have different deadlines. You or an authorized agent can email us; for an appeal, identify the request and decision to review. See the California Attorney General's privacy rights guidance.

We will update the date on this page when the policy changes. Where required, material changes will be brought to your attention and new consent obtained before a new consent-based use. Continued use is not a substitute for consent where it is required.

For requests, complaints, or concerns about a voice or public video, contact Assureme Technologies Private Limited, the operator of ToMotion, at founder@tomotionai.com. Use “Privacy request” or “Privacy complaint” in the subject so the purpose is clear.