What we hold, why we hold it, and how to make us stop.
This policy covers motionbar.com and the Motionbar studio. It is written to be read, not to be survived. Where a section has legal weight it says so plainly.
Who we are
Motionbar, Inc. ("Motionbar", "we") operates the Motionbar service. For users in the EU and UK we are the data controller for account data and the data processor for the content you generate. Our data protection officer can be reached at privacy@motionbar.com.
What we collect
We collect three categories of data and treat them very differently.
- Account data — name, email, password hash, billing details handled by our payment processor, and the plan you are on. We never see your full card number.
- Biometric and likeness data — the photos you upload to create a twin, the voice sample you record, the consent recording, and the derived face and voice models. This is the most sensitive data we hold and it is treated as such throughout.
- Usage data — prompts, render settings, credit transactions, device and browser metadata, IP address, and error logs.
Biometric data, specifically
Creating a twin requires biometric identifiers. We collect them only with your explicit, recorded consent, and only for the purpose of generating videos in your account.
- Your face embedding and voice model are stored in an encrypted key domain separate from the rest of your account data.
- They are never used to train shared or foundation models, never sold, and never made available to another account.
- They are retained for as long as the twin exists in your library, and deleted from live systems immediately on your request and from encrypted backups within 30 days.
- Residents of Illinois, Texas and Washington have additional rights under state biometric law; those rights are honoured for all users regardless of location.
Why we process it
We process your data to run your account and render your videos (contract), to prevent fraud and likeness abuse (legitimate interest and legal obligation), to bill you (contract), and to send product email you can turn off (consent). We do not process your data for advertising and we do not build profiles for third parties.
Sharing
We share data with a short list of sub-processors: cloud hosting, GPU render capacity, payment processing, transactional email, error monitoring and customer support tooling. Every one is bound by a data processing agreement and none of them may use your data for their own purposes. The current list is published at motionbar.com/subprocessors and changes are announced 30 days in advance.
We disclose data to law enforcement only under valid legal process, and we notify you unless legally barred from doing so.
Retention
- Rendered videos: kept in your library while your account is active, and for 90 days after cancellation.
- Twins, source photos and voice models: until you delete them, or 90 days after account closure.
- Prompts and credit history: 24 months, for billing disputes and abuse investigation.
- Consent recordings: retained for the life of the twin plus 3 years, because they are our evidence that the clone was authorised.
- Server logs: 30 days.
Your rights
Wherever you live, you can access, correct, export or delete your data, object to processing, and withdraw consent. Account settings handle most of this in one click; anything else goes to privacy@motionbar.com and is answered within 30 days. You will never be charged for exercising a right, and we will never degrade your service for using one.
EU, UK and Swiss users may complain to their supervisory authority. California residents have the rights described in the CCPA, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under California law.
International transfers
Data is processed in the United States and, for EU render regions, within the European Economic Area. Transfers out of the EEA and UK rely on Standard Contractual Clauses and the UK addendum where required.
Security
Data is encrypted in transit and at rest. Access to production systems is limited and logged. The full picture is on the Trust & security page. No system is perfect; if we suffer a breach affecting your data we will tell you within 72 hours of confirming it.
Cookies
We use strictly necessary cookies for sessions and security, and first-party analytics to count page views and find broken flows. We do not run third-party advertising cookies or cross-site trackers. You can reject analytics in the banner without losing any functionality.
Children
Motionbar is not for anyone under 18. We do not knowingly collect data from minors and we refuse cloning requests where the subject appears to be a minor. If you believe a child's likeness is in our system, write to security@motionbar.com and we will remove it on sight.
Changes and contact
Material changes are emailed to account holders 30 days before they take effect, and every version of this policy stays available in the archive. Questions go to privacy@motionbar.com or email privacy@motionbar.com.