Privacy Policy

Last Update: December 15, 2025

In compliance with EU General Data Protection Regulation (GDPR, 679/2016/UE) and Italian Personal Data Protection and Digital Rights Guarantees Act (L. 196/2003), we provide you with the following information about the processing of your personal data.

This privacy policy describes how The Formula AI, S.R.L. ("Filmia", "we", "us", "our") regulates the processing of your personal data collected through the use of the services offered on the websites and the mobile application (hereinafter, "Services").

If you are a California resident, please review the Notice at Collection and the "Additional Information for California Residents" section below for important information about how we process your personal information and your rights under California privacy laws.

The latest update of this Privacy Policy is indicated at the top of this text and it will become effective as of the date indicated in each version. Filmia, thus, recommends reviewing this Privacy Policy from time to time.

In some cases, additional or supplemental privacy policies may be provided and will apply to certain personal data collected and processed by us. These additional policies will control to the extent there is a conflict with this privacy policy. Additionally, access and use of the Services are governed by the relevant Terms of Use.

PERSONAL DATA PROCESSING

The following sections address our collection and processing of your personal data through our Services, including any of their subdomains and sections.

1. Data Controller

The Formula AI S.R.L. as data controller, is responsible for the processing of users' personal data on the Services: The Formula AI S.R.L., registered in the Commercial Registry of Milan, with Tax Number 13815270965 and REA MI 2745629 and registered office at Via Marco Ulpio Traiano 37, 20149, Milan, Italy.

Our Data Protection Officer can be contacted for any requests relating to the processing of your personal data or this Policy by sending an email to info@editby.ai

2. Services Use under Terms and Conditions

You can only contract our Services and validly accept the relevant Terms of Use of each Service if you are of legal age.

Our products are directed to people of legal age. In specific cases, we may explicitly allow them to be hired for use by minors. They must be examined and accepted, on the minor behalf, by the person of legal age who is the holder of the parental authority or in charge of their custody or education.

Notwithstanding the aforementioned, if you are a minor, in accordance with our terms and conditions, you cannot validly enter into any of the contracts we offer.

3. Our Purposes and Lawful Basis of Data We Collect

Your personal data is processed with different purposes. Each processing must be based on a lawful basis, among those set forth by the regulation. We use the following basis:

Consent: you have given your informed, unequivocal and specific consent to the processing of your personal data aimed to a specific purpose.
Legal obligation: the law requires process and disclose certain data on occasions to certain institutions (for example, to the Tax Authority).
Execution of a contract: the data are strictly necessary to provide you with our services or to comply with what was agreed with you.
Our legitimate interests, provided that your interests and rights do not prevail over them.

The legal bases of our data processing carried out through our Services, in relation to the purposes for which we will use your data, are the following:

3.1. Browsing the Services

When you browse and use the Services, even if you do not register, data is automatically collected through technology or automated interactions, such as IP address, unique IDs and certain metadata (HTTP header, your browser, etc.). In addition, information may be collected on the number of downloads you perform. These data are recorded in order to, among other things, control the number of downloads made by each user, thus allowing us to detect a fraudulent or illegitimate use of the Services, and other violations of the relevant Terms of Use, that is, the management of the contractual relationship between you and Filmia.

These technical data observed when the user browses the Services are processed for, among other things, the purpose of detecting and mitigating risks of attacks (bots, code injections, DDOS attacks), and, generally, to guarantee and maintain the Services security. Our lawful basis is our legitimate interest in protecting the security of our systems and preventing the violation of our terms and conditions.

Personal data processed: IP address, device id and certain metadata such as the browser used or the HTTP/HTTPS header.

3.2. Contractual Relationship with Our Registered Users

When you register as a user (either free or "premium"), we request the personal data that we need for the management and fulfillment of our contractual relationship with you.

When you are requested to provide personal data that is deemed as necessary, due to legal obligation or in accordance with our contracting conditions, and you refuse to provide them, we may not be able to formalize said contract or provide the service, which will be communicated to you.

You can open your account as a registered user on Filmia with your own account on other platforms, such as Google, using the federated Login that you will find at the top of our websites, and access whenever you want through them, without having to create and remember a specific username and password to access Filmia.

This option is possible due to the collaboration between Filmia and Google as the joint controllers of the processing of your personal data, so that (i) you can identify yourself directly on these platform, (ii) they confirm that you are who you say you are, and (iii) we provide you with your login as a registered user on Filmia.

Filmia obtains from this platform, with your previous consent, your username, image and email address in order to register you as a Filmia user. Additionally, this platform collects online identifiers (IP address), technical identifiers (from your device, as well as their advertising identifiers such as your "Google ID") and record, each time you use their login, the date and time of your access to Filmia. Further information can be found in Google Privacy & Terms.

You can exercise your privacy rights (e.g., access, rectification, erasure, limitation of processing, portability and revocation of consent, depending on your jurisdiction) in relation to the personal data obtained from these platforms (and other data that you may have provided to Filmia in your relationship with us) by contacting Filmia at the email address provided in this policy.

Please note that the rectification or deletion of your data in your Filmia account does not automatically imply the rectification or deletion of your data and accounts on the platforms that authenticate your identity: you must also contact them to exercise your rights.

To exercise your personal data protection rights in relation to any other data arising from your relationship with these platforms, you should contact the relevant platform.

3.3. Personalized Advertising on Filmia and Other Websites

We promote our products:

with social networks and other platforms users, between profiles of potential Filmia users, using audience segmented by interests, not created by Filmia but already offered by platforms such as Pinterest, Google and X (Twitter in its old name) and hired by Filmia for this purpose. Likewise, we can only identify you if you register as a user. Our lawful base is our legitimate interests of getting new clients through personalized advertising of our products through profiling offered by social media and other platforms.
Personal data processed: We select the groups of users to whom advertising will be displayed based on the segments offered by the platforms, such as age ranges or country. These platforms provide us with aggregated information about the performance of each campaign, but we cannot identify the specific users who have become registered users as a result of it.
through retargeting: impacting visitors who have visited and left our Services without registering, when they have accepted the use of our cookies, and these allow us to display advertising to them on third party websites. In this case, our basis of legitimacy is your consent (given both on our Services as on third party websites where the advertising is displayed). You can find more information about this treatment in our Cookie Policy.

3.4. Sending of Commercial Communications by Email

We will send you electronic commercial communications if (i) you have registered or contracted any of the Services, (ii) you request information about our products through any of the forms for this. In any case, we will do so as long as you have not expressed your objection to receiving such communications (you can do this conveniently via the specific slider in your user profile, as well as in each communication you receive, at the bottom, via the "Unsubscribe" button).

3.5. Surveys

Based on our legitimate interest to know your opinion in order to improve our products' performance and usability, we may contact you to request your opinion and preferences through satisfaction surveys.

In addition, based on our legitimate interests (improving our products, increasing our sales) we offer you to participate in surveys in order to learn first-hand about your opinions and preferences about our products and, on that basis, to eliminate friction, facilitate their use and improve your interactions with them. Therefore, we will contact you to ask for your opinion through satisfaction surveys.

Personal data processed: contact information.

3.6. AI Assistant Customer Support

Similarly, based on your explicit consent provided by clicking the acceptance buttons, our AI assistant will process your data for the same purposes of support and information requests. The AI assistant operates through the fully automated analysis and comparison of your request and responses with a database generated from frequently asked questions, your account data, and predefined customer-support rules.

If you believe that the assistant's response is unsatisfactory or prejudicial, or if it is unable to provide you with a satisfactory answer or solution, you may challenge the decision or lodge a complaint at info@filmia.ai. Our human supervisor team will take into account any additional details and context you submit with your complaint before reaching a final decision.

Personal data processed: content of your request, username, email address registered with Filmia, language preference, browser, time zone, and operating system.

Description of the logic involved: The AI assistant analyses your query using natural language processing and predefined rules to identify its topic and provide the most suitable response from our knowledge base.

Personal data processed: contact information that you provide us with in order to respond to your request and the content of your request.

3.7. Submitting Your Resume

When you apply to join the Filmia team or as a freelance designer or collaborator, we process your personal data on the basis of your consent, in order to assess your recruitment.

Personal data processed: contact information and information included in your CV and/or cover letter provided to support your application.

3.8. Third-Party Integrations, APIs, Plugins and Extensions

We may integrate or utilize various third-party extensions, add-ons, APIs, plugins, and other technologies (collectively, " Third-Party Integrations") within our platform or services. These Third-Party Integrations are operated and provided by independent companies that are not under our direct control.

This involves connecting and accessing some of your data in Google, always under strict adherence to Google's API Services User Data Policy, including its Limited Use requirements.

Regarding the processing of your personal data granted by Google, we inform you of the following: The data obtained from Google - email, name, language preference and image - and the same information is collected in order to give you access to our products and to ensure compliance with our terms and conditions, i.e. with our agreement with you using our extension. Also, such data is used for security purposes against any type of attack or fraudulent or illegitimate use of the same, based on our legitimate interest to maintain the security, integrity and resilience of our systems and ensure the regular provision of the service, and to comply with our agreements and protect our assets. You may deactivate or unsubscribe at any time and may exercise your privacy rights, in particular your right to object, by contacting us at the address given in the specific section of this policy.

3.9. AI-Based Products

We offer various AI-based products to generate images based on your Inputs or your own image, or images that, under your responsibility, upload to our platform. When you provide us with content that includes personal data of third parties (image, voice, identifiers in your prompt), you do so under your own responsibility, and you must inform the interested parties and have a legal basis for processing it (consent or another basis). We will handle your data for the following purposes:

Provide our Service in accordance with our terms and conditions and usage policy, based on the existing contract between the parties.
Generate avatars or recreations based on your own image, if you upload or capture your image with your camera, or on other images you decide to upload, based on your responsibility.
Maintain the security of our products and systems, based on our legitimate interests.

Additionally, in no case do these data processing activities aim to uniquely identify you.

Personal data subject to processing:

User data included if you are a registered user.
Inputs you include when using AI-based products, as well as the Outputs generated by AI-based products.
Your own image and other images you may upload if you have chosen to contribute them to any of the products made available, with the limitations stated above.

3.10. Legally Binding Processing

In some cases we are legally bound by different regulations (regardless of whether or not you give your consent), to process and / or transfer certain personal data to different entities. For example, to the Tax Authority, or the law enforcement authorities, at their request.

Personal data processed: those set forth in the applicable regulations.

4. For How Long Do We Keep Your Data

We process your personal data only for the necessary period of time, depending on each case. Once our processing has terminated, we keep your personal data blocked for different periods of time. The relevant deadlines in each case are listed below:

In relation to processing carried out to maintain the security of our Services and anti-fraud measures, we will keep your personal data for thirteen months.
In relation to the personal data necessary to provide the contracted service and the contractual relationship, your personal data will be stored while the contractual relationship is still active, and it will subsequently be kept blocked for five years (until the prescription of any contractual liability, or any intellectual property rights claim) and for a period of six years (regarding accounting information).
In relation to the personal data necessary to manage and fulfill our contractual relationships with our external designer, your personal data is processed while the validity of the intellectual property rights license remains in force, and they are kept blocked for five more years, (up to the prescription of possible contractual liabilities).
In relation to the sending of commercial communications by email, the data will be processed for three years from the last interaction with you or until you decide to object, whichever is the earliest.
Regarding the advertisements displayed on our Services by means of cookies, we refer to the descriptive tables available in our Cookies Policy, where you will find detailed information on the persistence or duration of our first-party cookies and links to extended information regarding third-party cookies.
We process your personal data to offer you surveys for the duration of our contractual relationship, unless you have objected to receiving them.
In relation to your non-commercial inquiries, the personal data will be deleted once they have been answered.
We will process the personal data provided for your employment applications for a period of one year from receipt.
Regarding the processing carried out in order to manage the Services through cookies, we refer to the Cookies Policy in which you will find detailed information on the persistence or duration of our own cookies and links to detailed information on third-party cookies.
Regarding the processing of personal data of the models incorporated in the available content, they will be processed for the duration of the contractual relationship with the external creator, and subsequently retained for a period of five years for the purpose of managing possible liabilities arising from the processing.
In relation to the processing of personal data for professional contact, we will process your personal data up to a maximum of three years from the last interaction or until you object to the communication, whichever is the earliest.
Regarding our AI products, we will not retain the images provided by users, only the prompts and outputs generated by our products, based on our contract with our clients and applicable law.
In relation to the AI assistant customer support processing, your data will be processed only for the time necessary to manage and resolve your request and will subsequently be securely blocked for a period of five years (until the expiration of any contractual liabilities or liabilities arising from the processing carried out). Your data will be deleted once the conversation or support ticket is closed, or until you withdraw your consent, whichever occurs first.
Regarding data used for the prevention and detection of fraud, personal identifiers of users suspended for fraudulent or abusive activities may be retained in a restricted, pseudonymized form for the period strictly necessary to prevent recurrence of fraud or the potential creation of new accounts by the suspended user.
We will keep your personal data in relation to the fulfillment of any legal obligation, in general, during the limitation periods of the possible responsibilities derived from our data processing, and specifically during the periods imposed by the regulation, law or by contract in each case.

5. Personal Data Update

We ask that you immediately notify us of any changes to your personal data so that the information contained in our systems is up-to-date at all times and does not contain errors. In this sense, you represent and guarantee that the information and data that you have provided us is accurate, current and truthful.

6. Disclosure of Personal Data

Access by third parties providing services to us. We may disclose personal data of our Users to third parties only in cases when it is strictly necessary for Filmia to perform their functions and to comply with the relevant Terms of Use of each Service. We may also share personal information with other third parties to ensure compliance with applicable laws, including:

Service providers, to manage systems and information technology such as hosting, broadband, IT security or web analytics providers.
Payment platforms, banks and companies involved in the transaction process, to ensure the fulfilment of the necessary transactions.
Advertising platforms, CRM and other marketing tools.
Recruitment management platforms.
User support management platforms.
Lawyers, auditors, legal and accounting consultancy services and financial institutions.

These services provided by third parties are necessary for the development of Filmia's business activity. The processing of personal data is at all times subject to a contract which establishes the duties of the data processor towards the data controller (us). Under no circumstances will personal information be used for other purposes and it will be managed in compliance with Filmia policy guidelines, their privacy policy and the applicable data protection regulation.

In accordance with our commitment to your privacy and your data protection right, we exclusively choose only top-tier service providers, leaders in their respective sectors. You can request the list of providers that have access to your personal data, as well as the services provided by each one, through the email address provided in the exercise of rights section.

Our Services, for users who have requested to enable automatic content publishing, also includes plugins which allow the User to carry out actions on social networks of third parties such as Instagram or TikTok, like, for instance, sending a publication or showing support to the Services. These plugins are indicated with the corresponding social network logotype, and require the login credential to the correspondent platform, and your consent. If you accept these plugins, the content will be transferred to the corresponding social network.

Data flows within the The Formula AI Group of Companies

The Formula AI, in order to centralise administrative and business infrastructure functions and to benefit from the functional specialisation and compartmentalisation inherent in these corporate structures, will process personal data within the group of suppliers, users and employees based on our legitimate corporate interests. Depending on the case, this processing is mainly carried out as a processor and, exceptionally, as a joint controller (for the execution of strategic decisions of the Group).

Data origin: each of the Group's subsidiaries collects the relevant data directly from the data subject in each case.

Personal data processed: basic identification and contact data, data required to log in (single login), economic and professional data, image, audio and video data (contractual management of suppliers - creators and models), data and metadata specific to web browsing (IT processing and web security).

Processing with an impact on the user's web experience: The single login or centralised management of user data from Filmia allows us to facilitate access to services, improve user knowledge and offer products or services from other companies in the group; manage in management of incident support and rights, as well as improving the security and transversal management of our Services.

Data subjects have the right to object to any of these processing operations based on our legitimate interests through the channels described in the following section.

7. Rights of the User

We guarantee the exercise of rights established in the General Data Protection.

You can exercise the rights described below contact Filmia at info@editby.ai. Please note that Filmia may require you to verify your identity before taking action on the request for the exercise of rights.

You have the following rights:

Transparency and information on how we process your personal data (right to be informed). Right that we satisfy, for example, through this privacy Policy.
Right to request a copy of the personal data we hold, which will be provided to you within a month (right of access).
Right to update or modify the personal data we have if it is incorrect or inaccurate (right of rectification).
Right to request us to stop processing your personal data while a complaint is being resolved, among other cases (right to limit processing).
Right not to be subject to a fully automated decision based solely on the processing of your personal data, which produces legal effects concerning you or significantly affects you (right not to be subject to automated individual decisions).

Additionally, when we process your personal data based on your consent or on our contractual relationship with you:

Right to request that we delete personal data from our records (right to erasure or "to be forgotten"). You can carry out this request at any time by closing your account, through your profile section.
Right to obtain and reuse personal data for your own purposes (right to data portability).
Right to revoke at any time the consent previously given to any of our processing of your personal data.

Or, when we process your personal data based on our legitimate corporate interests:

Right to object to the processing of personal data based on our legitimate interests claiming circumstances based on your personal situation (right to object). You can oppose these treatments related to the sending of advertising both in the registration form, as well as through your own profile, by unchecking the box enabled in the "Notifications" section and through any of the commercial communication we send to you.

8. Data Security

We have implemented appropriate technical and organizational security measures, in accordance with Article 32 of the GDPR and the UK GDPR, to protect Users' personal data against loss, misuse, unauthorized access, disclosure, or alteration including access control, encryption, monitoring systems, and internal security procedures.

However, security risks are inherent in Internet and information technologies, and it is not possible to guarantee the absolute security of personal information.

There are also certain steps you can take to better protect against unauthorized access to your personal information. For example, you should choose a strong password that is unique and do not reuse passwords across multiple sites and services or share your password with others.

9. International Data Transfers

We carry out international data transfers with certain data processors: subcontractors and content delivery networks to help us to deliver our Services.

As mentioned, a data processor may be an external service provider engaged by us, which may have access to, process or store personal data about customers or partners in the context of the service it provides to us.

Some of these external service providers are located outside of the European Economic Area (EEA), so the processing of your personal data involves an international data transfer to jurisdictions with different standards than the EEA. Your data may be transferred outside the European Union in accordance with the terms set out in this Privacy Policy, but will not be disclosed to third parties, and in specific information notices for certain tools, but they will not be communicated to third parties, except in the cases expressly provided for in the applicable regulations or when necessary for the provision of the contracted services.

Our international data transfers can occur to countries with a level of protection of personal data potentially lower than that imposed by the RGPD. Said international data transfers are covered by standard contractual clauses (art 46.2.c) GDPR).

10. Complaint Submission

If you have any questions regarding the way Filmia processes your personal data, you can contact us by sending an email to info@editby.ai or by contacting directly to the Italian Garante della privacy here www.garanteprivacy.it or the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, in Spain) here www.aepd.es.

11. Additional Information for California Residents

This section of the privacy policy provides additional information for California residents and describes our information practices pursuant to applicable privacy laws, including the California Consumer Privacy Act and the regulations issued thereto, each as amended ("CCPA"). To the extent you are a California resident, and we collect "personal information" subject to the CCPA, the following applies.

This section does not address or apply to our handling of personal information that is exempt under the CCPA, such as publicly available information or de-identified or aggregated information. The information provided in this section is intended to provide an overall description of how we process California consumer's personal information. This section does not address or apply to information or practices that are not subject to the CCPA or to the personal information we collect from our contractors, job applicants, employees, Ambassadors, or professional designers, or to personal information we process related to events we may host or sponsor, which are subject to different notices.

11.1. Categories of Personal Information Collected and Disclosed

Categories of personal information collected: Generally, we collect the following categories of personal information:

Identifiers such as name, alias, address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, or similar information.
Customer records such as your account and profile information and customer records that contain personal information, such as name and contact information.
Characteristics of protected classifications such as characteristics of protected classifications under California and federal laws such as date of birth, gender, national origin, and citizenship.
Commercial information such as products or Services purchased, obtained, or considered, or other purchasing or use histories or tendencies.
Internet or other electronic network activity information such as information regarding your use of our Website such as browsing history, clickstream data, search history, and information regarding your interactions with our Websites and advertisements, including access logs and other activity information related to the use of our Services.
Geolocation data such as general location information about a particular individual or device.
Professional information such as current and former employer(s) and position(s), business contact information, and professional memberships.
Audio, Electronic, Visual, or Similar Information such as audio, electronic, visual, or similar information including photographs and images (e.g., that you provide us).
Inferences such as inferences drawn from other personal information that we collect to create a profile reflecting an individual's preferences.
Sensitive personal information such as driver's license number, and state identification card number.

11.2. Sources of Personal Information

We collect personal information from the following sources: directly from individuals, through our Websites, service providers, business partners, advertising networks, internet service providers, operating systems and platforms, social media platforms, public and third-party databases, or other third parties.

11.3. Retention

We retain the personal information we collect only as reasonably necessary for the purposes described above or as otherwise disclosed to you. For example, we will retain information as necessary to comply with our tax, accounting, and recordkeeping obligations, to provide you with the Services, and an additional period of time as necessary to protect, defend, or establish our rights, defend against potential claims, and comply with our legal obligations. In some cases, rather than delete your personal information, we may deidentify or aggregate it and use it in compliance with the CCPA.

11.4. Purposes for Processing Personal Information

As more fully described in the "Our purposes and lawful basis for data we collect" section above, we collect, use, and otherwise process the above categories of personal information to operate and improve our Websites and Services, to manage your account, to contract with you, to promote our Websites and Services including across other websites and third-party services, to communicate with you, display personalized advertisements, conduct surveys, for research and analytics purposes, to develop new features, for safety and security, to prevent fraud, to respond to inquiries and complaints, for other customer service purposes, to comply with legal obligations, for general business operations, and for other business administration purposes including to investigate, prevent, or take action regarding illegal activities, suspected fraud, and situations involving potential threats to the safety of any person or violations of this privacy policy.

11.5. Sensitive Personal Information

We do not use or disclose sensitive personal information beyond the purposes authorized by the CCPA. Accordingly, we use and disclose sensitive personal information as reasonably necessary (i) to perform our services requested by you, (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents, (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct, (iv) to verify or maintain the quality and safety of our services, (v) for compliance with our legal obligations, (vi) to our service providers who perform services on our behalf, and (vii) for purposes other than inferring characteristics about you.

11.7. California Resident Rights

The CCPA provides California residents with certain rights regarding their personal information. This section describes those rights and how to exercise them. Please note that these rights are subject to certain conditions and exceptions.

Right to know/request access: The right to know:
- The categories of personal information we have collected about you;
- The categories of sources from which we have collected your personal information;
- The business or commercial purposes for collecting, selling, or sharing your personal information;
- The categories of third parties to whom we have disclosed your personal information; and
- The specific pieces of your personal information we have collected.
Right to delete: Subject to certain conditions and exceptions, you have the right to request we delete your personal information.
Right to correct: Subject to certain conditions and exceptions, you have the right to request that we correct inaccuracies in your personal information.
Right to opt-out of sales and sharing: You have the right to opt-out of "sales" and "sharing" of your personal information, as those terms are defined under the CCPA. While we do not "sell" personal information in the traditional sense (i.e., for money), our use of third-party analytics and advertising cookies may be considered "selling" and "sharing" under the CCPA.
Right to non-discrimination: We will not discriminate against you for exercising any of the rights described in this section.

To exercise your rights, emailing us at info@editby.ai

11.8. Verification

When you submit a request, we will take steps to verify your identity and request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for denial. You may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization, and we may also require the relevant consumer to verify the identity and the authority of the authorized agent.