Privacy Policy

1. Controller and contact

The controller is Alexander Bojarski — Level Higher, trading as LEVEL HIGHER. For privacy questions, requests or complaints, email [email protected] or use the contact page.

2. Data we process

• Account data: email address, user ID, plan, Render Point balance and account status.
• Project data: project settings, timelines, effect choices, uploaded audio, artwork, GIFs and other assets needed to provide the service.
• Render data: render choices, job status, output metadata, cost and operational diagnostics.
• Payment data: Stripe customer, checkout, subscription and transaction identifiers. We do not receive or store your full card number.
• Technical data: IP address, browser and device information, security events, server logs and consent choices.
• Usage data: pages and product actions measured through Google Analytics only in accordance with your consent choices.
• Account acquisition: for a new registration, we retain privacy-limited first-touch and last-touch labels such as campaign source, medium, referring domain and landing-page path. We do not retain the full referring URL, advertising click ID or search query in this record.

3. Why we use it and our lawful bases

• Contract: creating your account, saving projects, rendering videos, supplying downloads, managing plans and providing support.
• Legal obligation: accounting, tax records, responding to valid legal requests and protecting statutory rights.
• Legitimate interests: service security, fraud prevention, reliability, troubleshooting and aggregated product improvement where those interests do not override your rights.
• Legitimate interests: understanding which campaigns and referring websites lead to genuine account registrations, using limited first-party attribution data rather than cross-site profiling.
• Consent: non-essential analytics, advertising storage, personalised advertising and related Google technologies. You can change this choice at any time.

4. Uploads, projects and ownership

You keep ownership of your music, images, logos and other source material. We use uploads only to operate the editor, save your project when requested and create your video. We do not sell uploaded content or use it to train generative AI models.

5. Service providers and recipients

We disclose data only as needed to operate Music Motion, including:

• Supabase for authentication, database and account services;
• Stripe for checkout, billing, fraud prevention and receipts;
• Google for consent management, Analytics and, where enabled, AdSense/advertising;
• Cloudflare for DNS, traffic delivery and security; and
• our hosting and GPU-render infrastructure for application and video processing.

We may also disclose information where required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards. We do not sell personal data.

6. Google Analytics, AdSense and cookies

Google Analytics helps us understand whether public pages and product journeys work. Google AdSense may serve advertisements on public content pages after Google approves the site; ads are excluded from Studio, admin, authentication and account surfaces. Google and its advertising partners may use cookies or similar identifiers to serve and measure ads, including personalised ads only when your consent permits it. See our Cookie Policy.

7. International transfers

Some providers process data outside the UK or EEA. Where required, transfers rely on an adequacy decision, the UK International Data Transfer Agreement/Addendum, EU Standard Contractual Clauses or another legally recognised safeguard. Provider privacy terms may supply additional transfer details.

8. Retention

• Account and saved-project information is kept while the account is active and then deleted or anonymised when no longer required.
• Uploaded source assets and finished render downloads are temporary processing materials; finished render files are normally removed within 48 hours.
• Billing and transaction records are retained for the periods required by accounting, tax and legal rules.
• Security and operational logs are kept only for a limited period appropriate to investigating abuse, outages and fraud.
• Account acquisition labels are retained with the account so we can understand the original registration source, then deleted when the account record is deleted.
• Consent choices are retained for the duration configured in Google's certified consent platform and can be changed sooner by you.

9. Your rights

Depending on the law that applies, you may request access, correction, deletion, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may also complain to the UK Information Commissioner's Office at ico.org.uk. We may need to verify your identity before completing a request.

10. Security, children and changes

We use access controls, encrypted transport and operational safeguards designed to protect information, but no online system is risk-free. Music Motion is not directed to children under 18. We will update this notice when services or legal requirements materially change and will show the new date at the top.