Privacy Policy

01Quick summary

• We do not sell personal data.
• We use data to operate, protect, and improve the Services, comply with legal obligations, and respond to customer requests.
• We do not store full payment card data; processing is carried out via a specialized partner.
• We keep strategic partners without disclosing their names, listing only categories of suppliers.
• Data subjects may exercise their rights through the platform chat or via support@moviie.ai (standard response time: up to 15 days).

Moviie ("Moviie", "we") offers a video hosting and distribution platform and artificial intelligence features for creators and companies. This Policy describes how we handle personal data in the context of our websites, applications, APIs, and related services ("Services"), in compliance with the LGPD (Brazilian General Data Protection Law, Law No. 13.709/2018), the Marco Civil da Internet (Brazilian Internet Civil Framework, Law No. 12.965/2014), and international best practices.

02Who we are and how to contact us

• Controller: Moviie, a product of Fidellium, registered under CNPJ 37.779.750/0001-13.
• Contact channel / DPO: support@moviie.ai (privacy support and Data Protection Officer).
• Territorial scope: Brazil.

Moviie is a product operated by Fidellium (CNPJ 37.779.750/0001-13). Should Moviie come to operate under its own legal entity, we will update this section.

03Who this Policy applies to

• Administrators and users of B2B accounts (direct customers who create an account on Moviie).
• Customers' end users (e.g., viewers/subscribers of the customer's content).
• Visitors to our websites and marketing materials.

04Processing roles

• Moviie as Controller: account registration data, billing, communication, platform security, support, essential telemetry, and visits to our website.
• Moviie as Processor: personal data of customers' end users, processed on behalf of the customers (e.g., player events, technical logs, transcriptions/subtitles, and AI artifacts generated at the customer's request).
• There may be specific joint-control situations (e.g., fraud prevention), documented contractually when applicable.

05What personal data we process

Registration and account (B2B)

Currently mandatory: name, email, authentication (via federated identity/OAuth), and basic account preferences. Potentially collected when necessary for billing and electronic invoices (future): phone number, CPF/CNPJ (Brazilian tax IDs), address, and tax data.

Platform usage

Telemetry and logs (IP, device identifiers, user agent, language, date/time, pages and features accessed, player events, errors, and performance); preferences and settings (theme, language, player and AI options); content and metadata (videos and materials uploaded by the customer, thumbnails, titles, descriptions, technical metadata).

Payments

Billing and invoice data (name, email, address when applicable, payment identifiers, transaction status). Cards: we do not store full card data; processing is carried out by a payment processor (supplier category).

Support, authentication, and sensitive data

Messages, attachments, and technical information shared to resolve tickets; federated identity/OAuth (we may receive profile data strictly necessary for authentication, such as email, identifier, and avatar). Moviie does not request sensitive data, and it is prohibited to insert it into videos, subtitles, or free-text fields.

06Purposes and legal bases (LGPD)

07Cookies and similar technologies

We use essential cookies (authentication/session) and essential measurement cookies, including Google Analytics configured without advertising or personalization signals, to understand product usage. We do not currently display a consent banner because we do not use advertising cookies. Details in the Cookies Policy. Browser settings may restrict cookies; some features may stop working.

08AI processing

• Available AI features: transcription/subtitles, automatic chapters, dubbing, moderation/safety, and semantic search.
• AI suppliers: market providers (supplier category) that process data strictly to perform the requested features.
• Model training: Moviie does not use customer data to train third-party models. The customer may choose to train agents/models for its own exclusive use (e.g., local embeddings/fine-tuning) based on its videos; such artifacts belong to the customer.
• Generated artifacts (subtitles, transcriptions, translations) are made available to the customer and can be exported.
• Technical retention: AI artifacts and temporary files are kept only for as long as necessary for execution, validation, and delivery, and are then deleted or aggregated/anonymized as set out in Section 10.

09Sharing data with third parties

We do not disclose the named list of partners as it is a strategic asset. We share data only with categories of suppliers strictly necessary to operate the Services:

• Payment processing (we do not store full card data).
• Infrastructure/hosting and application execution (including serverless/edge when applicable).
• Content delivery (CDN) and performance optimization.
• Essential product measurement/analytics (no advertising).
• Federated authentication/identity (OAuth/OpenID Connect).
• Transactional communications and support (email, customer service, and tickets).
• Monitoring, observability, and security (logs, abuse and fraud prevention).

We may also share data to comply with legal obligations, perform contracts, protect rights, or in corporate transactions. Enterprise customers and authorities (ANPD) may request the full list of subprocessors under an NDA and/or upon a formal request, where appropriate.

Partner-platform integrations: when you connect your account to a partner platform (for example, via OAuth authorization), you authorize Moviie to allow that platform to act on your behalf to manage and publish your videos, in line with the scopes shown at authorization time. In that context, we may share with the partner only the operational signals strictly necessary for the integration (for example, organization identifiers and connection/subscription status), at your direction and revocable at any time in your account settings.

10International data transfers

Data may be processed and stored in Brazil, the United States, and the European Union. When there is an international transfer, we apply safeguards compatible with the LGPD (Article 33 et seq.), such as standard contractual clauses and equivalent security obligations.

11Retention and deletion

We keep data only for as long as necessary for the purposes, subject to legal obligations. Reference periods:

The periods above are reference targets. When requested and applicable, we will proceed with anonymization or deletion in accordance with Articles 16 and 18 of the LGPD, subject to legal exceptions and the minimum retention necessary for the regular exercise of rights.

12Information security

We adopt technical and organizational measures proportionate to the risk, including:

• Encryption in transit (TLS) and encryption of sensitive secrets at rest.
• Administrative access control with the principle of least privilege and authentication via identity providers (OAuth/OpenID Connect).
• Environment segregation and periodic access reviews.
• Backups, monitoring, and access logs.
• Incident response plan, with assessment of notification to the ANPD and to data subjects when required.

No measure is infallible; if you identify a vulnerability or incident, contact support@moviie.ai.

13Data subject rights (LGPD)

At any time, you may: confirm the existence of processing; access your data; correct incomplete/inaccurate data; anonymize, block, or delete unnecessary/excessive data; port data to another supplier; withdraw consent; obtain information about sharing; and object to processing based on legitimate interest.

• How to exercise: platform chat or support@moviie.ai.
• Response time: up to 15 days.
• Identity verification: we may request additional information or authentication through the account itself to prevent fraud.
• Portability: we will provide CSV/JSON when technically feasible and without violating trade secrets.

You may also file a complaint with the ANPD (Brazilian National Data Protection Authority).

14Children and adolescents

The Services are intended for individuals over 18 years of age. Use by children under 13 is prohibited. If we learn that data of children under 13 has been collected, we will delete the account and the corresponding data, preserving only the minimum necessary to prevent new improper registration.

15User content, moderation, and reports

Video content is the responsibility of the user/customer. Illegal, offensive content, content that violates third-party rights, or that contains sensitive data is prohibited.

• Reports: send them to support@moviie.ai.
• Review SLA: up to 15 days.
• Process: manual review; we may restrict/remove content, suspend accounts, and notify authorities when required by law.

16Marketing and communications

We may send transactional communications (e.g., service changes, security), which do not depend on opt-in. For marketing, when you create a Moviie account you begin receiving our communications on the basis of the legitimate interest arising from the relationship you started with us, which is disclosed on the sign-up screen itself. For free tools and materials, we collect consent at the moment you provide your e-mail. In every case, unsubscribing is simple: the one-click link in every message works for anyone, including people without an account. Whoever administers an organization can also turn communications off in its settings. Should we adopt remarketing/advertising, we will update this Policy and collect consent when necessary.

Lead capture and nurturing: during sign-up (including when started from a partner platform), we may collect your e-mail before payment is completed. If you do not complete sign-up, we may send a nurturing sequence related to the subject that originated your contact (possibly in coordination with the originating partner), always with one-click unsubscribe; conversion ends the sequence. Unsubscribing is recorded against your e-mail address rather than a specific sign-up, so that a new sign-up does not reverse it.

17Changes and final provisions

We may update this Policy to reflect legal, technical, or operational changes. In case of material changes, we may notify you by email and/or dashboard. Use of the Services after the effective date indicates awareness of the new version. This Policy prevails over previous versions, and matters not provided for will be resolved in accordance with the LGPD, the Marco Civil da Internet, and other applicable Brazilian regulations.

Questions: support@moviie.ai.

18Browser extension (video migration)

Moviie offers a browser extension (Chrome) whose single purpose is to migrate, into the user's own Moviie account, videos the user already owns on other platforms. This section details the data handling specific to the extension; the other sections of this Policy also apply. In this version, the extension supports migration from YouTube.

Data the extension accesses

• Source page content: the video title and identifier and the active tab URL, read only when the user is on a compatible video page, to identify and migrate the video.
• Session cookies of the source platform (e.g., youtube.com): read only with the user's explicit consent and only when needed so that Moviie's server can download the user's own video without being blocked by anti-bot checks.
• Moviie account credentials: an API key scoped to the user's organization, obtained when the user connects the extension to their account.
• Account identification: the user's organization name, shown in the extension interface to indicate the connected account.

What we use it for

Exclusively to perform the requested migration: detect the user's own video, authenticate the Moviie account, and enqueue the import, which is downloaded and processed on Moviie's server. We do not use this data for advertising, profiling, or any purpose unrelated to the migration.

Where it goes

Data flows between the extension, the Moviie API, and the import service that performs the download on the server. There is no sharing with third parties outside this flow. Communication takes place over encrypted channels (TLS).

Retention and local storage

• The import queue and the account connection are kept in the browser's local storage, on the user's device.
• The API key is stored encrypted, never in plain text.
• Cookies of the source platform are used transiently during the import and are not persisted in plain text; we keep only an indicator that a given import uses cookies.

User control

• Access to the source platform's cookies only occurs with explicit consent, which can be declined.
• The user can disconnect the extension at any time, which removes the API key stored locally.
• The extension does not sell or share data for advertising and does not track the user's browsing.

19Appendices

Appendix A: Reference cookie table

Appendix B: Categories of third-party suppliers

1. Payment processing;
2. Infrastructure/hosting and application execution (incl. serverless/edge);
3. Content delivery (CDN) and performance optimization;
4. Essential measurement/analytics (no advertising);
5. Federated authentication/identity;
6. Transactional communications and support;
7. Monitoring/observability/logs;
8. Security/anti-fraud;
9. AI providers (transcription, translation, dubbing, moderation, and semantic search).