Privacy Policy

Who we are

Stillmove is operated by RHYL DEAL LIMITED (“we”, “us”), a company registered in England and Wales, at 1-4 East Parade, Rhyl, LL18 3AG. We are the data controller for the personal data described in this policy. You can reach us about anything in it at support@rhyldealretail.com, by telephone on +44 7890 976995 (Monday to Friday, 09:00–17:00 GMT), or by post at the address above.

The one thing most people want to know

Photographs you upload, the frames generated from them and the clips you export are never used to train, fine-tune, improve or evaluate any artificial-intelligence model — ours or anybody else’s. They are not sold, licensed, published or shared for that purpose or any other. They are processed for one reason: to produce the output you asked for. Where a third-party processor performs part of that work on our behalf, they are contractually prohibited from retaining your content or using it to train anything, and we do not work with a provider who will not agree to that.

What we collect

Information you give us

• Account details. Your email address and a hashed password. We never store your password in a form we can read.
• Content you upload. The product photographs you choose to work on, and anything you type into the tool — the sentence describing the camera move, and any price, dimension or specification you add to a clip.
• Correspondence. Emails, phone calls and any other messages you send us, kept so we can deal with your enquiry and refer back to it.

Information created by using the service

• Generated output. The preview frames and the clips made from your photographs.
• Usage and credit records. Which actions you performed, when, and how many credits each one used. This is what makes your billing page accurate and lets us answer a question about a charge.
• Technical records. IP address, browser type and operating system, timestamps, and error logs. These are used for security, for preventing abuse and for fixing faults.

Information from our payment provider

If you subscribe, our payment provider handles your card. We receive the card brand, the last four digits, the expiry month and year, the billing country, the amount, the currency and whether the charge succeeded. We never receive or store your full card number or security code. Card details are entered on the payment provider’s own secure, PCI-DSS-compliant pages, not on ours.

Why we use it, and our lawful basis

Under the UK GDPR and the EU GDPR we must have a lawful basis for each use. Ours are:

• To provide the service — creating your account, processing your photographs, generating frames and clips, tracking your credits. Basis: performance of our contract with you.
• To take payment and keep financial records — subscriptions, refunds, invoices, tax and accounting records. Basis: performance of our contract, and compliance with a legal obligation.
• To support you — answering emails and calls, investigating faults. Basis: performance of our contract, and our legitimate interest in running a service people can get help with.
• To keep the service secure and prevent abuse — detecting fraud, card testing, automated attacks and breaches of our Acceptable Use Policy. Basis: our legitimate interest in protecting the service, our users and ourselves.
• To understand how the tool is used — anonymous or aggregated counts, and analytics cookies. Basis: your consent for analytics cookies; legitimate interest for data that cannot identify you.
• To send service messages — receipts, renewal notices, failed-payment notices, cancellation confirmations and material changes to these terms. Basis: performance of our contract, and compliance with a legal obligation. These are not marketing and you cannot unsubscribe from them while you hold an account, because they are how we tell you about your own money.
• To send optional product emails, if you ask for them. Basis: your consent, which you can withdraw at any time.

How long we keep things

• Uploaded photographs, generated frames and clips: up to 30 days from upload, then deleted automatically. You can delete any of them sooner from inside the tool, and that deletion is immediate.
• Account details: for as long as your account is open. If you delete your account, they are removed within 30 days.
• Credit and usage records: for the life of the account and then 12 months, so we can answer a query about past usage.
• Payment and tax records: six years after the transaction, because we are legally required to keep them.
• Support correspondence: two years from the last message.
• Security and error logs: up to 12 months.

Deleting your account removes every photograph, frame and clip we hold for you. Where we are legally required to retain something — a tax record, for example — we keep only that record and nothing else.

Who we share it with

We do not sell your personal data, and we never have. We share it only with service providers who process it on our behalf, under contract, and only for the purpose we engage them for:

• Our hosting and infrastructure provider, who stores files and runs the application.
• Our payment provider, who processes subscriptions and refunds.
• Our model-processing provider, who performs generation and is contractually barred from retaining your content or training on it.
• Our email provider, who delivers service messages.
• Our analytics provider, only if you accept analytics cookies.

We may also disclose information where we are legally required to, where it is necessary to establish or defend a legal claim, or to prevent harm. If our business is ever sold or restructured, personal data may transfer as part of that; you would be told before it happened and this policy would continue to apply until you were told otherwise.

Where it goes

We are based in the United Kingdom and process data there and in the European Economic Area wherever we can. Some of our providers operate elsewhere, including the United States. Where personal data leaves the UK or the EEA we rely on an adequacy decision covering the destination, or on the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with an assessment of the safeguards in place. You can ask us for details of the transfer mechanism used for any particular provider.

Your rights

Depending on where you live, you have some or all of the following rights. In the United Kingdom and the European Economic Area you have all of them:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion of your data, subject to records we must keep by law.
• Restriction — to have us pause processing while a dispute is resolved.
• Portability — a machine-readable copy of data you gave us.
• Objection — to processing based on legitimate interests, including any profiling.
• Withdrawal of consent — at any time, where we rely on consent. Withdrawing it does not affect anything done beforehand.
• Not to be subject to a solely automated decision with a legal or similarly significant effect. We do not make such decisions.

To exercise any of these, write to support@rhyldealretail.com. We respond within one month and will tell you if we need longer, which is rare. We do not charge for this. We may need to confirm who you are first, so that we do not hand your data to somebody else.

If you are in California

Under the California Consumer Privacy Act as amended, you have the right to know what personal information we collect, use, disclose and sell or share; to delete it; to correct it; to opt out of its sale or sharing and of targeted advertising; and to limit the use of sensitive personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for any purpose that requires the right to limit. We will never discriminate against you for exercising any of these rights. We honour Global Privacy Control signals as a valid opt-out. Use the same address above, or have an authorised agent do so on your behalf.

If you want to complain

Please raise it with us first — most things are a misunderstanding we can clear up quickly. You also have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113). If you live in the European Economic Area you may complain to the data-protection authority in your country. Complaining to us first does not take away your right to go to them.

Children

Stillmove is for people running a shop and you must be at least 18 to hold an account. The service is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, write to us and we will delete it and everything in it.

Security

Every page and every upload is encrypted in transit with HTTPS. Files are encrypted at rest. Access to production systems is restricted to the people who need it, protected by two-factor authentication, and logged. Passwords are stored only as salted hashes. No system is perfect, and if a breach ever affects your rights and freedoms we will tell you and the relevant authority within the time the law requires.

Cookies

We use a small number of cookies, and non-essential ones are only set if you accept them. Rejecting them takes exactly as many clicks as accepting them. The detail is in our Cookie Policy.

Changes

If we change this policy we will update the effective date at the top. If a change materially affects your rights we will email you about it before it takes effect, so you can decide whether to keep using the service.