Privacy Policy

Last updated: October 9, 2026

This Privacy Policy describes how personal information is collected, used, stored and shared when You visit fylm.ai, use Our applications and services, or make a purchase.

Interpretation and Definitions

For the purposes of this Privacy Policy:

Company, We, Us or Our means G.T. GradeVision AI d.o.o., Novi Goljak 7/C, 10000 Zagreb, Croatia, OIB: 99767742988, trading as fylm.ai.
Account means an account created to access the Service.
Service means the fylm.ai website, applications and related services.
Website means https://fylm.ai, https://app.fylm.ai and https://lite.fylm.ai.
Personal Data means information relating to an identified or identifiable individual.
Usage Data means information collected automatically when using the Service.
Content means images, videos, files, colour grades, projects, comments and other information uploaded, created, stored or shared through the Service.
Service Provider means a third party providing services to the Company or processing Personal Data on its behalf.
You means an individual or legal entity accessing or using the Service.

Data Controller

The controller responsible for processing Personal Data relating to fylm.ai accounts, subscriptions, website visitors and customer relationships is:

G.T. GradeVision AI d.o.o.

Novi Goljak 7/C

10000 Zagreb, Croatia

OIB: 99767742988

Email: [email protected]

Where business customers upload or store Personal Data for which they are the controller, the Company may act as a data processor on their behalf. Such processing is governed by the Data Processing Addendum included in Our Terms of Service.

FastSpring acts as merchant of record for purchases made through Our Service. FastSpring and the Company may act as joint controllers for transaction-related processing, as described in FastSpring’s Privacy Policy and the applicable arrangements between the parties.

FastSpring is responsible for the merchant-of-record and payment-processing functions it performs, while We remain responsible for providing and supporting fylm.ai.

FastSpring’s Privacy Policy is available at https://fastspring.com/privacy/.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

When using Our Service, We may collect:

Email address.
First name and last name.
Account and organisation information.
Subscription and account access information.
Communications and customer support requests.
Information about projects, team members and collaborators.
Usage Data.
Other information necessary to provide the Service.

Usage Data

Usage Data is collected automatically when You access or use the Service.

It may include Your IP address, browser type, browser version, device information, pages visited, date and time of visits, unique identifiers, diagnostic information and interactions with the Service.

We use Usage Data to maintain, secure, analyse and improve the Service, subject to applicable law.

User Content and Project Data

When using fylm.ai, You may upload, create, store, process or share images, videos, colour grades, LUTs, presets, project files, comments and other Content.

Image editing, colour processing and AI-assisted image-editing functionality are performed locally on Your device.

Where You choose to save Content to the cloud, relevant files and project data are uploaded to and stored using Amazon Web Services (AWS), including Amazon S3. Cloud storage, retrieval, synchronisation and sharing may involve server-side handling necessary to provide the requested functionality.

Cloud storage constitutes data processing even where image editing and colour calculations take place locally.

We process and store Content as necessary to provide the Service, including project management, storage, retrieval, collaboration, sharing and exporting.

We do not claim ownership of Your Content.

Content may contain Personal Data relating to You or other individuals, including identifiable people appearing in photographs or videos.

You are responsible for ensuring that You have the necessary rights, permissions and lawful basis to upload, store, use and share such Content, including providing required privacy notices and obtaining consent where legally necessary.

Content is made available to other users or collaborators according to the permissions and sharing settings You select.

Where We process Personal Data on behalf of a business customer, that processing is governed by the Data Processing Addendum included in Our Terms of Service.

Comments and Communications

When You leave comments or communicate through the Service, We may collect the information You provide together with associated Account and technical information necessary for moderation, security and support.

Where Gravatar is enabled, a hash derived from Your email address may be provided to Gravatar to retrieve a profile image. Its Privacy Policy is available at https://automattic.com/privacy/.

Tracking Technologies and Cookies

We use cookies and similar technologies to operate Our websites and applications, maintain sessions, remember preferences, measure performance and provide certain features.

Cookies may be session cookies, which expire when You close Your browser, or persistent cookies, which remain until they expire or are deleted.

Necessary Cookies

Necessary cookies enable essential functionality, including authentication, account security, session management, fraud prevention and the operation of features requested by users.

These cookies do not require prior consent where they are strictly necessary for providing the requested Service.

Cookies on app.fylm.ai and lite.fylm.ai

The applications at https://app.fylm.ai and https://lite.fylm.ai use only cookies and similar storage technologies that are strictly necessary for their functionality, including authentication, sessions and security.

These strictly necessary technologies do not require a cookie consent banner under applicable law.

Cookies on fylm.ai

The main website at https://fylm.ai may use:

Necessary cookies: For essential website functionality and security.
Preference cookies: To remember user-selected settings.
Analytics cookies: To understand website traffic and improve performance.
Referral and marketing cookies: Where applicable, to attribute affiliate referrals and measure marketing activity.

Where required by applicable law, We obtain Your consent before using cookies or similar technologies that are not strictly necessary for providing the Service You request.

You may accept or reject non-essential cookies and withdraw or modify Your consent at any time through the cookie preference controls on the main Website.

Cookie information, including applicable purposes, providers and retention periods, is made available through the cookie preference controls or upon request at [email protected].

You may also manage cookies through Your browser settings. Disabling necessary cookies may affect the functionality of the Service.

Use of Your Personal Data

We may use Personal Data for the following purposes:

To provide and maintain the Service: Including account access, local editing functionality, cloud storage, project management, collaboration and sharing.
To manage Your Account: Including registration, authentication, permissions and subscription access.
To fulfil contractual obligations: Including providing purchased services and contractual support.
To contact You: Including service notifications, security information, support communications and product updates.
To provide marketing communications: Where You have consented or where otherwise permitted by applicable law.
To manage Your requests: Including customer support and data protection requests.
To maintain security: Including detecting misuse, fraud and unauthorised access.
To improve the Service: Including analysing performance and usage, subject to applicable consent requirements.
To comply with legal obligations: Including maintaining legally required records.
For legitimate business transfers: Subject to applicable data protection requirements.

Where We process Content on behalf of a business customer, We use that Content only for the purposes permitted by the applicable agreement and the customer’s documented instructions, including providing the requested cloud storage and collaboration functionality.

Legal Bases for Processing

We process Personal Data under the following legal bases, as applicable:

Performance of a contract (Article 6(1)(b) GDPR): To provide the Service, manage accounts, maintain access and fulfil contractual obligations.
Compliance with legal obligations (Article 6(1)(c) GDPR): To comply with applicable accounting, tax and legal requirements.
Legitimate interests (Article 6(1)(f) GDPR): To protect and maintain the Service, prevent fraud and misuse, respond to certain inquiries and establish or defend legal claims, where these interests are not overridden by Your rights and freedoms.
Consent (Article 6(1)(a) GDPR): For marketing communications, non-essential cookies, analytics and other activities where consent is required.

Where processing is based on consent, You may withdraw that consent at any time without affecting the lawfulness of earlier processing.

Information required for Account registration, authentication and contractual service delivery is necessary to provide the relevant Service. If You do not provide it, certain features or services may be unavailable.

For Personal Data contained in business customer Content, the customer is responsible for determining the applicable lawful basis where acting as controller, and We process such data on its behalf in accordance with the Data Processing Addendum.

Sharing Your Personal Data

We may share Personal Data with service providers and other recipients where necessary to operate, secure, deliver and support the Service.

FastSpring

FastSpring acts as merchant of record for purchases and subscription billing.

It processes transaction-related information, including customer details, payment information, billing information, applicable taxes and refunds.

FastSpring shares relevant order and subscription information with Us to enable delivery and administration of the Service.

Amazon Web Services (AWS)

We use AWS for cloud infrastructure, including Amazon S3 storage of customer Content and project data.

Google Analytics

We may use Google Analytics to analyse usage of the main Website, subject to applicable consent requirements.

Opt-out: https://tools.google.com/dlpage/gaoptout

Impact.com

We use Impact.com to manage Our affiliate program, including registrations, referral attribution, reporting and commissions.

Other Service Providers

We may use service providers for customer support, email delivery, security and related operational purposes.

Such providers receive or access Personal Data only to the extent necessary for their respective functions and subject to applicable data protection requirements.

We may also disclose information where required by law or necessary to establish, exercise or defend legal claims.

Where You share projects or Content with collaborators, We make the relevant information available according to Your sharing settings.

Payments

Purchases and subscriptions made through fylm.ai are sold and processed by FastSpring, acting as merchant of record.

FastSpring is responsible for payment processing, invoicing, applicable taxes, subscription billing, payment-related refunds and chargebacks.

We do not directly collect or store full payment card details.

Payment information is processed in accordance with FastSpring’s Privacy Policy at https://fastspring.com/privacy/.

Email Marketing

We may use Your name and email address to send newsletters, promotional communications and information about Our products where permitted by applicable law.

You may unsubscribe from marketing communications at any time through the unsubscribe link in those messages or by contacting [email protected].

Unsubscribing from marketing does not prevent Us from sending necessary transactional, Account, security or service-related communications.

Retention of Your Personal Data

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy.

Account and subscription information: While the Account or Subscription remains active and thereafter where necessary for legal obligations or disputes.
Projects and uploaded Content: While retained in Your Account and thereafter only as necessary for applicable backup retention, legal obligations or other lawful purposes.
Order and transaction information: For applicable accounting, tax and legal retention periods.
Support requests and communications: Generally for up to five years, unless earlier deletion is appropriate or longer retention is necessary.
Website security logs and technical information: Generally for up to one year, subject to the retention periods of individual security and analytics systems.
Marketing information: Until consent is withdrawn or the information is no longer required, subject to retaining limited suppression records where necessary.
Analytics and cookie information: According to the applicable cookie and service-provider retention periods.

You may delete Content through the available functionality of the Service. Content removed from active storage may remain temporarily in backups until those backups expire in accordance with Our retention procedures.

We may retain information for longer where required by law or necessary to establish, exercise or defend legal claims.

International Data Transfers

Personal Data may be processed by service providers or recipients located outside the European Economic Area, including the United States.

Where required by applicable law, international transfers are subject to appropriate safeguards, including European Commission adequacy decisions, Standard Contractual Clauses or other lawful transfer mechanisms.

Where applicable, transfers to eligible US organisations may rely on the EU-US Data Privacy Framework, provided the recipient is appropriately certified and the transfer falls within the scope of that certification.

You may contact [email protected] for further information about applicable transfer safeguards and how to obtain a copy where required by law.

Disclosure of Your Personal Data

We may disclose Personal Data where required by applicable law, in response to valid requests from courts or public authorities, or where reasonably necessary to protect Our legal rights or the security of the Service.

If the Company undergoes a merger, acquisition, restructuring or transfer of business assets, Personal Data may be transferred subject to applicable data protection requirements.

Security of Your Personal Data

We implement appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, alteration, destruction or loss.

These measures include appropriate access controls, secure communications, account authentication, security monitoring and backup procedures.

No method of Internet transmission or electronic storage can guarantee absolute security.

Your Rights under the GDPR

Subject to the conditions and exceptions provided by applicable law, You have the right to:

Request access to Your Personal Data.
Request correction of inaccurate or incomplete Personal Data.
Request erasure of Your Personal Data.
Request restriction of processing.
Object to processing based on legitimate interests.
Object at any time to processing for direct marketing.
Request data portability where applicable.
Withdraw consent where processing is based on consent.
Not be subject to certain decisions based solely on automated processing that produce legal or similarly significant effects, subject to applicable law.

To exercise Your rights, contact [email protected].

We may request information reasonably necessary to verify Your identity.

We will respond within the periods required by applicable law.

Where Personal Data is processed on behalf of a business customer, requests concerning that Content may need to be addressed to the customer acting as controller. We will provide assistance as required by applicable law and the Data Processing Addendum.

You also have the right to lodge a complaint with a competent data protection authority, including the Croatian Personal Data Protection Agency (AZOP):

https://azop.hr/

[email protected]

Automated Decision-Making

We do not use solely automated decision-making concerning individuals that produces legal or similarly significant effects within the meaning of Article 22 GDPR.

The AI-assisted image-editing features of fylm.ai perform editing operations selected by users and are not intended to make decisions concerning individuals’ legal rights or similarly significant interests.

Children’s Privacy

Our Service is intended for users aged 18 or older.

We do not knowingly collect Personal Data from children where such collection is prohibited by applicable law.

If You believe that a child has provided Personal Data without the required authorisation, contact [email protected].

Links to Other Websites

Our Service may contain links to websites operated by third parties.

We are not responsible for the independent privacy practices of those websites and encourage You to review their privacy policies.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in Our practices or applicable legal requirements.

Updated versions will be published on this page with a revised date. Where required by law, We will provide additional notice of material changes.

Contact Us

For questions about this Privacy Policy, data protection requests or complaints, contact: