Data Processing Agreement

Processor: Raúl Bellmunt Tabero (tax ID 52408413S), Calle Ciudad Real, 12, 08227 Terrassa (Barcelona), España, owner of Utopia Dreams VFX (the «app», at https://app.utopiadreams-vfx.com). Contact: hello@utopiadreams-vfx.com.

Controller: the company or organisation (the «Customer») whose name, tax ID and address are given when the agreement is accepted in the app, represented by the person who accepts it, who confirms they are authorised to do so.

The agreement covers the account or the team for which it was accepted. It is part of the Terms of Service and, on data protection, prevails over them.

We process the personal data contained in what the Customer and its users create, upload or import in the app (the «Customer Data») only to provide the service the Customer uses: writing, illustrating, generating, editing, storing, exporting and sharing its videos, as the app and its help describe.

The agreement applies from its acceptance for as long as the Customer uses the app with that account or team. It ends when the account is deleted, the team is closed or the service ends for any other reason; clause «End of the service» then applies.

• People concerned: those who appear in or are named in the Customer's videos (employees, students, presenters, actors, clients and their staff) and the Customer's users of the app.
• Data: names and texts written about people (ideas, scripts, dialogue, subtitles); photos and images of their faces and bodies; recordings of their voice and the voices cloned from them; the images, clips, voiceovers, music and videos generated from all of that; and the users' names and email addresses.
• Processing: storage; generation of text, images, video, voice and music with AI models; editing and export; sharing with a link and publishing on social networks or YouTube when the Customer asks for it; deletion.

The app uses faces and voices only to make the content the Customer asks for (for example, so that a character keeps the same face, or a presenter speaks with their own voice), never to identify people. The Customer should not upload special categories of data (health, beliefs, ethnic origin and the like) or data of minors unless it is necessary and lawful; the app warns when a photo seems to show someone under 18.

The Customer's documented instructions are what it asks the app to do and what it writes to us at hello@utopiadreams-vfx.com. If we think an instruction infringes data protection law, we will tell the Customer straight away.

We do not use Customer Data for our own purposes: not to train AI models, not to study or improve the app, not for advertising. During the beta, the stories of accounts and teams with this agreement are left out of the copies that our team studies to improve the platform, and any copy made before the agreement was accepted is deleted when it is accepted.

We do not disclose Customer Data to third parties except to the sub-processors of clause «Sub-processors», to those the Customer chooses (when it shares a link or publishes on a social network) and to authorities when the law requires it; in that last case we will tell the Customer first unless the law forbids it.

Only the people on our team who need it can access Customer Data, and they are bound to keep it confidential, also after they leave. They only access it to answer a support request of the Customer, to resolve an incident, to check a report of misuse of the app or when the law requires it.

We apply measures suited to the risk (art. 32 GDPR), among them:

• Encryption of all traffic (HTTPS) and of the data stored by Google Cloud.
• Private files, shown only through signed links that expire (24 hours in the app, 6 hours in shared links); a shared link can be deleted at any time.
• Access to the app with a password stored as a hash, or with Google; access tokens for the engines and AI assistants stored as hashes and revocable; two-step verification for the administrators' panel.
• Access to our Google Cloud project only for authorised members of our team, with separate service accounts and the least permissions needed.
• Checks on every server action that the person calling may use the story or team concerned.
• Technical logs kept 30 days; deleted data disappear from backups within 7 days.

The Customer authorises us to use these sub-processors, bound by contract to the same data protection obligations as we are:

• Google Cloud (Google Ireland Limited and Google LLC): hosting, database, file storage and the Vertex AI models that generate text, images, video, voice and music (Gemini, Imagen, Veo, Lyria and Text-to-Speech). Under Google Cloud's terms, Google does not use these data to train its AI models. Our help desk (Chatwoot) and some open models run on our own servers in the same project.
• fal.ai (Features & Labels, Inc., United States): the lip-sync model for presenter videos and the video and 3D models of other companies, only when the Customer uses lip-sync or chooses one of those models. They are never used if the Customer chooses «Google models only».
• Google Workspace (Gmail): the service's emails, with the users' names and email addresses.

We will announce any new sub-processor or change of sub-processor at least 15 days in advance, by email to the person who accepted the agreement and on this page. The Customer may object within that period; if we cannot agree, the Customer may end the service without penalty.

Customer Data are stored and processed outside the European Union. The app, its database and its files are on Google Cloud in the United States (region us-central1). The AI models run on Google's data centres: video (Veo), music (Lyria) and voice (Text-to-Speech and voice cloning) are processed in the United States, or in other Google regions outside the EU, and today they cannot be kept in the EU; text and images can also be processed in any region where Google operates. fal.ai processes the files it receives in the United States.

These transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework, in which Google LLC takes part, and on the standard contractual clauses (art. 46 GDPR) of Google Cloud's data processing terms and, for fal.ai, of its own terms.

If one day the app can keep a Customer's data in the EU, we will tell it, and it will be able to choose it in Settings → Data and models.

The Customer answers the requests of the people concerned (access, rectification, erasure, objection, restriction and portability). It can do most of it itself in the app: open, download, change and delete stories, characters, photos and cloned voices. If someone writes to us directly about Customer Data, we will forward the request to the Customer within 5 working days and will not answer it ourselves, and we will help the Customer with whatever it cannot do in the app.

If we become aware of a breach that affects Customer Data, we will tell the Customer without undue delay and within 48 hours at most, by email to the person who accepted the agreement, with what art. 33.3 GDPR requires that we know at that time: what happened, which data and people it affects, its likely consequences and the measures taken or proposed. We will send the rest as soon as we have it. Notifying the supervisory authority and the people concerned is up to the Customer, and we will help it.

We will give the Customer the information it needs for a data protection impact assessment or a prior consultation with the supervisory authority about its use of the app: this agreement, our Privacy Policy and the answers to its written questions.

Before the end, the Customer can download its videos and their files from the app. When the account is deleted or the team is closed, we delete the Customer Data within 30 days, and from our backups within 7 more days, unless a law requires us to keep any of them; if the Customer asks, we will confirm the deletion in writing. A team's stories go back to the members who made them when the team is closed, as the Privacy Policy explains: the Customer should delete first those it doesn't want them to keep.

We will give the Customer the information needed to show that we comply with this agreement, and we will allow and help with audits by the Customer or an auditor it appoints, bound by confidentiality, once a year or after a breach, with 30 days' notice, at the Customer's expense and without access to other customers' data. We will answer first a written questionnaire, which is often enough. Google Cloud's certifications (such as ISO/IEC 27001 and SOC 2) cover the infrastructure.

• To have a legal basis for each use of the data it gives the app, and to inform the people concerned.
• To have the consent of each person whose face or voice it uses, and of their parents or guardians for a minor, as the app asks when it adds a real person's photo or clones a voice, and to keep proof of it.
• To give the app access only to people it trusts, and to remove from the team those who leave.
• To watch over the processing, and to tell us straight away about anything that may affect the people concerned.

We keep a record of the processing activities we carry out on behalf of our customers (art. 30.2 GDPR). We are not required to appoint a data protection officer; for anything about this agreement, write to hello@utopiadreams-vfx.com.

Each party is liable for the damage caused by its own breach of the GDPR or of this agreement, as art. 82 GDPR and the Terms of Service set out.

We may publish new versions of this agreement on this page, with their date, when the law, our sub-processors or the app change. The app will ask the Customer to accept a new version; until it does, the one it accepted stays in force, and if it does not accept it and the change is required by law, either party may end the service.

This agreement is governed by Spanish law and the GDPR, and the courts named in the Terms of Service decide any dispute. If the Customer's language and the Spanish text differ, the Spanish text prevails.