Privacy Policy

1. Data Controller & Operator

For privacy purposes, RTAS Digital Marketing Company acts as the data controller for account, billing metadata, and Service usage data described below. RTAS Digital Marketing Company never stores full payment card details. Payment card data is processed by our authorized third-party payment provider (which may act as Merchant of Record where applicable), as an independent controller or processor for checkout. Privacy inquiries: privacy@rtasstudio.com. General contact: contact@rtasstudio.com.

2. Personal Data We Collect & Lawful Bases

We collect only data necessary to operate a global SaaS platform. Lawful bases under GDPR include contract performance, legitimate interests (security, fraud prevention, product improvement), legal obligation, and consent where required (for example, non-essential cookies).

• Account data: name, email address, authentication identifiers (including OAuth tokens from Google sign-in).
• Subscription & billing metadata: plan tier (Tester, Standard, or Premium), Credit balance, transaction IDs, tax jurisdiction — not full card numbers.
• Studio content: prompts, lyrics, uploaded images, voice references, and generation parameters you submit.
• Generated outputs: video files, thumbnails, share links, and export history associated with your account.
• Technical & security logs: IP address, device type, browser, timestamps, and diagnostic events.

3. Data Retention & AI Models

We retain personal data only as long as necessary for the purposes described in this Policy. Account profile data is kept while your account remains active and for a reasonable period thereafter to resolve disputes or comply with law. Studio uploads and generation parameters are retained to deliver the Service, enable re-downloads, and maintain Authorized Identity Preservation continuity across projects unless you delete them or close your account. Aggregated, de-identified analytics may be retained indefinitely. AI model providers engaged as subprocessors may temporarily cache inputs for inference; their retention schedules are governed by their own enterprise data-processing terms. You may request deletion subject to billing records, fraud-prevention, and statutory retention requirements (typically up to seven years for tax and accounting records where applicable).

4. How We Use, Share & Process Personal Data

We use personal data to authenticate users, allocate Credits, render AI video, provide customer support, send service announcements, detect abuse, and comply with legal requests. We do not sell personal data. We never store full payment card details on our servers. We share data with subprocessors under contractual safeguards, including cloud hosting, email delivery, AI inference providers, analytics (if consented), and our authorized third-party payment provider for payments, tax calculation, invoices, and refunds where Merchant of Record applies.

5. International Transfers & Cross-Border Safeguards

Because RTAS Studio AI serves users globally and RTAS Digital Marketing Company operates from Pakistan, data may be processed in the United States, European Union, United Kingdom, Pakistan, and other countries where we or our subprocessors maintain infrastructure. Where required, we implement Standard Contractual Clauses (SCCs), UK International Data Transfer Addenda, or equivalent mechanisms, and assess transfer risks in line with Schrems II guidance.

6. Your Global Privacy Rights

Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing or automated decision-making. California residents may have rights to know, delete, and opt out of "sale" or "sharing" (we do not sell personal data). EU/EEA and UK users may lodge complaints with their local supervisory authority. Signed-in users may download a personal-data export and submit an account-deletion request from Privacy settings (/profile/privacy). You may also email privacy@rtasstudio.com (or contact@rtasstudio.com) with sufficient identity verification. We respond within applicable statutory timelines (typically 30–45 days). Deletion is subject to billing records, fraud-prevention, and statutory retention.

7. Security Measures & Incident Response

We implement administrative, technical, and organizational measures including access controls, encryption in transit (TLS), authenticated sessions, and monitoring for anomalous activity. No method of transmission or storage is completely secure; you are responsible for safeguarding credentials. If a personal-data breach poses risk to your rights, we will notify you and regulators as required by applicable law.

8. Children's Privacy

The Service is not directed to children under 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal data from children without verifiable parental consent. If you believe a child has provided data, contact privacy@rtasstudio.com or contact@rtasstudio.com and we will delete it promptly.

9. Policy Updates, Cookies & Contact

Material changes to this Policy will be posted on this page with an updated effective date and last-updated date. Non-essential cookies and similar technologies are described in our Cookie Policy (/cookies). Privacy: privacy@rtasstudio.com · Support: support@rtasstudio.com · General: contact@rtasstudio.com · RTAS Digital Marketing Company · Operating from Pakistan.