Privacy.
Updated 17 May 2026 · Gurugram, India
We collect your email when you buy or contact us — that's it. Plugin API keys and project files never leave your machine. Your prompts go straight to your AI provider; we never see them. India's DPDP Act & GDPR rights are honored.
Who we are
Gillu Studio — operated by Sagar Soni from Gurugram, Haryana, India. For purposes of the DPDP Act (India) and GDPR (EU), Sagar Soni is the data fiduciary / controller. Reach us at namaste@gillu.studio.
What we collect
When you buy a plugin
- Email address — for delivering your license, receipts, support
- Name — for invoicing
- Billing address & country — for GST / tax compliance
- Payment metadata (last 4 digits, method, country) — from our processor. We never see your full card.
- Order details — number, plugin, amount, date
When you email us
- Your email, name, and message content
When you visit the site
- Server logs (IP, browser, pages, timestamps) — kept 30 days
- Analytics events (page views, scroll depth) — anonymous, no fingerprinting
What we do not collect
- Your AI API keys — they live in your OS keychain
- Your prompts, chat history, or AI outputs
- Your source footage, audio, or project files
How we use it
- Deliver the product — license, updates, security notices
- Answer your support emails
- Tax & accounting compliance under Indian law
- Aggregate analytics on feature usage
- Product updates by email (only if you opt in)
We never sell, rent, or trade your personal data.
Legal basis
- Contract — purchase, license, support
- Legal obligation — tax, accounting, fraud prevention
- Consent — marketing emails, optional analytics
- Legitimate interest — security logs, abuse prevention
AI providers & data flow
Motion Bridge and Video Bridge use AI providers via keys you supply. Data flows directly from your machine to the provider — not through us.
- Prompts & comp metadata → your chosen AI provider
- Audio files → OpenAI Whisper, or local Whisper (offline)
- 720p JPEG frames → Gemini or chosen vision model (Vision / B-roll modes)
Review each provider's policy: Anthropic, OpenAI, Google.
Third-party services
- Polar.sh / Razorpay / Stripe — payments (email, name, billing, card metadata)
- WordPress hosting — site (server logs, IP)
- Email provider — transactional email (email, message)
- Plausible / privacy-friendly analytics — usage (anonymous, no IP storage)
We sign data-processing agreements with these providers where required.
Retention
- Order records — 8 years (Indian tax law)
- Support email threads — 2 years from last reply
- Marketing list — until you unsubscribe
- Server logs — 30 days
- Analytics events — 12 months
Your rights
Under DPDP & GDPR, you may access, correct, erase, or export your data, object to processing, and withdraw consent at any time. Email namaste@gillu.studio — we respond within 30 days.
Children
Our products are intended for adults (18+). We do not knowingly collect data from children. If we discover any, we delete it.
International transfers
We're based in India. If you're in the EU/EEA, your data is transferred and processed in India. We rely on standard contractual clauses (SCCs) or your explicit consent for such transfers.
Security
HTTPS everywhere, hashed credentials, encrypted backups, restricted admin access. In the event of a breach affecting your data, we notify you within 72 hours as required by DPDP & GDPR.
Changes
Material updates are notified via email or a banner on this site. The date at the top reflects the current version.
← Back to Legal