Privacy policy

Short version: we collect what we need to run your account, shoot your scenes and understand how the site is used. We never sell data or use it for advertising, and we do not train AI models on what you give us.

What we collect

• Account: your email address, the sign-in method you used (an email link, or GitHub or Google where offered), your plan and the seats on it.
• Country: worked out from your IP address or your billing details, to show prices and taxes, and to decide which models and features are available where you are.
• Brand inputs: what you type and upload in the studio: brand name, what you do, colours, copy, a logo and images for the first frame. These may include a person's face if you upload one.
• Takes and footage: the takes you try, the footage and stills we shoot, and the site source we build. Files are stored privately and reached only through links that expire.
• Credits ledger: every grant, hold, charge, expiry and refund of credits on your account, with the time and the action it was for. Entries are never edited, only added, so the balance can always be checked.
• Purchases: our payment provider sells plans and top-ups as merchant of record and is the controller for your card and billing details under its own privacy policy; we never see your card. We receive the order, the amount, the country and a customer reference.
• Emails: sign-in links, receipts and studio emails (your scene is ready, a shoot failed with no charge) are sent to your address because the service needs them. The weekly roundup is sent only if you ask for it, with one-click unsubscribe.
• Usage and analytics: how the site is used, described under analytics below.
• Error reports and server logs: technical details of errors, and the standard request logs kept for security and debugging.

Analytics and cookies

We measure how people find and use the site so we can make it better: pages visited, the site or campaign that sent you, the studio steps you reach (brand, take, shoot, download) and the type of device and browser, with your country worked out from your IP address.

• Without your consent we only count. Our own counts use an anonymous code that changes every day, store no IP address and leave out browsers that send Do Not Track or Global Privacy Control. Nothing is set on your device and, unless you are signed in, you are not identified across days. We read these counts in PostHog, hosted in the EU. When you are signed in, they are linked to your account number, never your email, so we can see whether people come back.
• With your consent: we set no analytics cookies today. If we add a tool that sets cookies or similar identifiers to recognise a returning browser, or records how pages are used, we will ask you first, where the law asks for it, with form fields and uploaded images hidden. You can say no, and change your answer at any time.
• Browsers that send Global Privacy Control are treated as having said no to analytics cookies.
• Events tied to your account (signing up, starting a shoot, buying credits) are recorded for every account, because the service and the ledger need them. When your browser sends Do Not Track or Global Privacy Control, they carry no anonymous code and no country, and we keep them out of PostHog, except credit, download and export records and the results of takes and shoots, which reach it for every account.
• Other cookies and browser storage: the sign-in session (a cookie the site needs to work), and your theme and the prompts you copied (kept in your browser's localStorage, never sent to us). We set no advertising cookies.

Analytics data is used only by us, never sold and never used for advertising.

What we use it for, and why we may

• Running your account, your credits and your shoots: needed to perform our contract with you.
• Working out your country: our legitimate interest in offering only the models allowed where you are, and a legal duty to charge the right tax.
• Keeping the ledger and receipts: a legal duty (tax and accounting).
• Screening requests for misuse and answering complaints: our legitimate interest in a safe service.
• Cookieless analytics and fixing errors: our legitimate interest in a working site.
• Analytics cookies and the weekly roundup: your consent, which you can withdraw at any time.
• Sending your brand inputs and any face you upload to a company that runs the models and may train on them: your consent, asked for when you upload an image of a person, which you can withdraw by deleting the image.

Who receives your data

We use other companies to run the service. Most receive only what their job needs and process it for us. The companies that run the models may also use what they receive for their own purposes, described below:

• hosting, database and file storage;
• the companies that run the AI models, and the companies that make those models, which receive the prompts and images needed for each take and shot;
• a screening service that reads the description of the character you ask for, to catch misuse;
• our email provider;
• error reporting and analytics, as described under analytics.

The companies today, each with what it does for us. We add a company here before it receives any data.

• Vercel: hosting and server logs.
• Supabase: accounts, the credits ledger and the database.
• Cloudflare: storage of takes and footage (R2), email routing and page view counts.
• Higgsfield: image and video generation, with models made by Kuaishou (Kling), xAI and OpenAI.
• fal.ai: upscaling.
• Anthropic: screening studio requests for misuse.
• Lemon Squeezy: payments, as merchant of record.
• Brevo: sign-in, studio and roundup emails.
• Sentry: error reports.
• PostHog: reading our usage counts, hosted in the EU; when you are signed in they are linked to your account number, never your email.

Some companies that run the models may use what they receive to improve their own models, under their own terms. Our payment provider receives your purchase details as the seller, under its own privacy policy, not on our behalf.

Screening is automated

Before anything is shot, an automated check reads your request and may refuse it, for example when it names a real person or another business's brand. No credits are charged for a refused request. If you think a refusal is wrong, write to us and a person will look at it.

What you must give us

You need an email address to have an account, and brand inputs to shoot a scene. Without them we cannot provide those parts of the service. Everything else is optional.

International transfers

Some of these companies process data outside the European Economic Area and the UK, mostly in the United States. Where data leaves the EEA or the UK, we use safeguards such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses where the company offers them. Higgsfield does not yet offer a transfer safeguard; we are working to put one in place. Write to us for a copy of the safeguards.

How long we keep it

• Account data: while your account exists.
• Takes you did not pick: 30 days.
• Brand inputs, delivered footage, stills and source: while your account exists, so you can download them again, and deleted with it. You can delete any scene you made from your account at any time.
• Credits ledger and purchase records: 7 years, as tax records, even after your account is deleted.
• Analytics data: at most 25 months.
• Server logs and error reports: at most 90 days.

Email support@nightmarquee.com to delete your account. We remove your data and files within 30 days, except the records we must keep. Copies already sent to the companies that run the models are deleted under their own rules.

The Chrome extension

The NightMarquee extension for Chrome needs no account and keeps no id. It loads the scenes and the free prompt text from nightmarquee.com and the previews from media.nightmarquee.com. We count which prompt was asked for and for which editor, with no account or device id. The editor you pick and the last list of scenes are kept in Chrome on your device.

Your rights

Where GDPR or a similar law applies to you, you can ask for access to, correction, export or deletion of your data, ask us to restrict how we use it, object to our use of it, or withdraw consent, at the address above. Withdrawing consent does not affect what we did before. You can also complain to a data protection authority.

Changes

We may update this policy. The date at the top shows the current version. If a change affects how we use data you have already given us, we tell you on the site or by email. See also the terms.