Privacy notice

Last updated 12 October 2026.

This notice explains what we collect when you use this website and our video builder app, why, who helps us handle it, how long we keep it and your rights. We collect as little as we can.

Who we are

Penny Drop Studio is the controller of the personal data described here. It is run by George L, a sole trader.

Contact us about privacy at hello@pennydropstudio.com. You can also write to us at 78 High Street, Houghton Regis, Bedfordshire, LU5 5BJ.

What we collect

When you sign in to the video builder, we collect your email address, and a record of each sign-in request (the email address, your IP address and the time) so we can stop misuse. If the link that brought you says where it came from (for example a share link to someone’s video), we note that tag on your account, so we know which links bring people. The sign-in page runs a security check (Cloudflare Turnstile) that looks at technical signals to tell people from automated spam.

When you make a video, we collect:

  • your website address, and what we read from your website’s public pages: its text, colours, fonts and logo, and, if you ask for them, its photos
  • your brand card: your business name, what you do, who your customers are, your sector and tone, and any changes you make to it
  • a logo, if you upload one
  • your choices for the video: its topic, script, style and pictures, including pictures we draw for its scenes
  • the details you add to its end card: the button’s words, a web address, and any phone number, email address or social media handles you choose to show
  • the finished video, its subtitles, its thumbnail and the captions we write for posting it
  • which steps of the builder it reached, and when it was downloaded or shared

Please don’t put personal information about your customers, patients or clients into your brand card or script. We don’t need it.

If you turn on a share link for a video, anyone with the link can watch it on a page of our website, with your business name, logo, colours, the button and web address from its end card, and what it says. We count how many times it’s played; we don’t record who watches, and we don’t store anything on their device. Stopping sharing turns the link off straight away, and it stops working when the video is deleted. If someone reports a shared video, we keep what they wrote, with a scrambled code made from their IP address that can’t be turned back into it (so one person reporting again and again counts once), and we look at it. If several different people report the same video, we pause its sharing until we’ve looked, and email you.

If you start a Pro trial or subscribe, our payments provider (Stripe) takes your card details; we never see or keep them. We keep a record of your subscription from Stripe (its status, trial and renewal dates, and whether you’ve cancelled), your Stripe customer number, and your card’s fingerprint: a code Stripe gives each card, which lets us see that a card has been used before without knowing its number. To make sure each person has only one trial, we keep a one-way scrambled version (a hash) of your email address and the card’s fingerprint for each trial.

If you tell us how a video turned out, we keep your answer and anything you write with it, to improve the builder.

If you give us a business’s details by mistake, for example someone else’s phone number on an end card, please tell us and we’ll remove them.

When you use the contact form, we collect your name, your email address and your message.

When you visit the website or the app, our hosting provider handles the technical information any website receives, such as your IP address and browser type, to deliver pages and protect the service. We also keep a log of errors and security events, which can include your email address or IP address, so we can fix problems and spot misuse.

We use only the cookies needed to keep you signed in. We don’t use advertising or tracking cookies, and we don’t run analytics that identify you: we count visits to our website with Cloudflare Web Analytics, which uses no cookies and keeps no personal information.

Why we use it, and our lawful basis

  • To give you an account and make your videos. Our lawful basis is providing the service you asked for (a contract), whether your account is free or paid.
  • To keep the service fair and affordable. Each person can make one free video, and we treat versions of the same email address (for example with a “+” tag added, or with dots moved in a Gmail address) as the same person. We also limit sign-in requests and how often a website can be read. Our lawful basis is our legitimate interest in preventing misuse of a free service and keeping its costs under control.
  • To check we can make the video. Websites, brand cards, pictures and the words you type (your script, your topic and your end card) are checked automatically against the kinds of business and content we don’t make videos for, and for swearing and sexual, hateful or violent words (listed in our website terms). If a business is refused more than once in a short time, making videos is paused for that account for a while. Our lawful basis is our legitimate interest in preventing misuse. You can ask for any refusal or pause to be looked at by a person: email hello@pennydropstudio.com.
  • To show a video you share to the people you send its link to, and to count how often it’s played. Our lawful basis is providing the service you asked for (a contract).
  • To improve the builder: which steps videos reach, and what you tell us about how they turned out. Our lawful basis is our legitimate interest in making the builder easier to use.
  • To reply to your message from the contact form. Our lawful basis is our legitimate interest in answering the people who contact us.
  • To run your Pro subscription and trial, including checking each person has only one trial. Our lawful basis is providing the service you asked for (a contract) and, for the trial check, our legitimate interest in preventing misuse of the free trial.
  • If you buy a paid plan or service from us, we use your details to provide it. Our lawful basis is taking steps at your request before a contract, and then performing that contract.
  • To keep the website and app secure. Our lawful basis is our legitimate interest in keeping them free of abuse.

We don’t sell your information and we don’t use it for advertising.

Who else handles it

We use a small number of service providers who process data for us, under contracts that require them to keep it secure and use it only on our instructions:

  • Stripe takes payments for Pro, through its managed payments service, and works out and pays the VAT on them: your card details, billing address and payments. It is a controller of some of this information for its own legal duties, such as preventing fraud.
  • Cloudflare hosts the website and the app, runs the security check, protects them from attacks, stores finished videos, and sends our emails (sign-in links and messages about your videos).
  • Supabase runs our database and sign-in: it holds your account, your brand card, your logo and the content of your videos.
  • OpenRouter, and the AI providers it passes our requests to (currently Google, Black Forest Labs, xAI and MiniMax), read your website’s text, write and check scripts, check and draw pictures, and record the voice-over and time its words for the subtitles. They receive your business details and your video’s words and pictures, not your email address.
  • Our email provider holds the inbox where messages from the contact form arrive. Our provider is Microsoft (Outlook.com).

Some of these providers may process data outside the UK. Where they do, they use the safeguards UK law requires, such as the UK International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework.

We may also share information if the law requires us to.

How long we keep it

  • Finished videos: 7 days after they’re ready on a free account, or 60 days on Pro. We email you before a video is deleted. Then the video, its files and its content (brand card, logo, script, pictures and photos) are deleted.
  • Unfinished videos: drafts, and videos we couldn’t make, are deleted 3 days after you last changed them.
  • What stays after a video is deleted: only a record that it existed: its dates, status and plan, which steps of the builder it reached, your rating of it without anything you wrote, and its website’s domain (for example example.co.uk), so the limits on videos, and on free videos for each website, still work. Its look, end card details, captions, share link and any reports about it are deleted with it. We keep the record for as long as your account exists.
  • Your account: your email address, and the link tag that brought you if there was one, are kept until you delete your account (in the app, under “Your plan” → “Delete your account”) or ask us to.
  • Sign-in records and IP addresses: 30 days. Records of refused businesses: 30 days. Our log of errors and security events: 90 days, with email addresses removed after 30 days. AI answers we keep to avoid paying twice for the same request: 30 days, or until their video is deleted if that’s sooner.
  • Your subscription records: for as long as your account exists, and then for as long as we need them for our legal and accounting obligations (usually six years). The trial check (the hash of your email address and the card’s fingerprint): kept after your account is deleted, so the same person can’t start a second trial. It can’t be turned back into your email address.
  • Contact form messages: kept only as long as we need them to reply to you. We delete them after 12 months at the latest.

If you buy a paid plan or service, we keep your details for as long as you use it and then for as long as we need to for our legal and accounting obligations (usually six years for business records).

You can delete your account yourself in the app at any time, which cancels any Pro subscription straight away, or ask us to delete it or any of your information.

Your rights

You have the right to:

  • ask for a copy of the personal data we hold about you
  • ask us to correct it if it’s wrong
  • ask us to delete it, including your whole account
  • ask us to limit how we use it, or object to our use of it
  • ask for a person to look at a decision our automated checks made about you
  • ask for your data in a format you can take elsewhere

Email hello@pennydropstudio.com to use any of these rights. We’ll reply within one month.

If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

Keeping your information safe

Everything travels over encrypted connections. Each account can only see its own videos, and only we can see the information in the admin tools, which are behind their own sign-in. Finished videos are private: only you can open them, through your account, unless you turn on a share link for one. Our email inbox is protected by a strong password and two-step sign-in.

Changes to this notice

If we change how we use personal data, we’ll update this notice and the date at the top.