Privacy Policy

1. Introduction

LeenStudio Ltd. ("LeenStudio," "we," "us," or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard information when you use our platform at leen.studioand any associated services (collectively, the "Service").

LeenStudio is incorporated in the United Arab Emirates and operates in compliance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). For users in the European Economic Area (EEA) or the United Kingdom, we also comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR respectively. California residents may have additional rights under the California Consumer Privacy Act (CCPA), as described in Section 7.

By using the Service, you consent to the practices described in this Policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect information in the following categories:

Account and Registration Data. When you create an account, we collect your email address, name (if provided), and an encrypted password. If you register via a third-party authentication provider (such as Google), we receive your name and email address from that provider.

Billing and Payment Data. Subscription payments are processed by Stripe, Inc. LeenStudio receives only non-sensitive billing metadata such as your subscription plan, billing country, last four digits of your card, and payment status. Full card details are never transmitted to or stored on our servers.

Instagram Public Profile Data.When you submit an Instagram handle or profile URL for analysis, we access that account's publicly available information, including post captions, engagement metrics (likes, comments, views), follower counts, posting frequency, and video metadata. We do not access private Instagram accounts or require your Instagram credentials.

Video Files. If you upload a video directly for pre-publication analysis, that file is stored temporarily on our secure servers solely to perform the requested analysis. Video files are automatically deleted within 24 hours of analysis completion and are never used for any other purpose.

Usage and Analytics Data. We collect information about how you interact with the Service, including pages visited, features used, analysis requests made, session duration, and click events. This data is collected in aggregate and pseudonymous form and is used to improve the Service.

Technical Data. We automatically collect certain technical information when you access the Service, including your IP address, browser type and version, operating system, device identifiers, and referring URLs.

Communications. If you contact us for support or by email, we retain records of those communications to resolve your inquiry and improve our service quality.

3. How We Use Your Information

We use the information we collect for the following purposes, each grounded in a lawful basis under applicable law:

• Service delivery: To create and manage your account, process payments, run video analyses, and deliver results and reports. (Contractual necessity)
• Service improvement: To understand how users interact with features, identify bugs, and develop new capabilities. (Legitimate interest)
• Security and fraud prevention: To detect, investigate, and prevent unauthorized access, abuse, and other harmful activity. (Legitimate interest / Legal obligation)
• Communications: To send transactional emails such as account confirmations, billing receipts, and security alerts. (Contractual necessity)
• Marketing communications: To send product updates, newsletters, and promotional offers — only where you have given explicit consent or where permitted under applicable law. You may opt out at any time. (Consent / Legitimate interest)
• Legal compliance: To fulfill our obligations under UAE law, respond to lawful requests from authorities, and enforce our Terms of Service. (Legal obligation)

We do not use your data to train our AI models without your explicit opt-in consent. We do not sell your personal data to third parties.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Supabase (Auth & Database): We use Supabase to manage user authentication, store account data, and persist analysis results. Supabase processes data on our behalf as a data processor and is contractually bound to our data protection requirements. Data is stored in secure cloud infrastructure.
• Stripe (Payments):Payment processing is handled by Stripe, Inc., which is a PCI DSS-certified payment processor. Stripe's privacy practices are governed by their own Privacy Policy available at stripe.com/privacy.
• AI Processing Infrastructure: Video and content analysis is performed using AI infrastructure operated by or on behalf of LeenStudio. All processing is subject to data processing agreements and our security standards.
• Analytics Providers: We may use anonymized analytics tools (such as privacy-respecting event tracking) to understand aggregate usage patterns. No personally identifiable information is shared with analytics providers.
• Legal Requirements: We may disclose your information if required to do so by applicable law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. We will notify you of any such change.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service. Cookies are small text files stored on your device. We use the following types:

• Strictly necessary cookies: Required for authentication sessions, security tokens, and core platform functionality. These cannot be disabled without affecting the Service.
• Functional cookies: Remember your preferences, settings, and in-progress work to provide a personalized experience.
• Analytics cookies: Collect aggregate, pseudonymous data about how you use the Service to help us improve features and performance. You may opt out of analytics tracking via your account settings.

You can control cookies through your browser settings. Disabling strictly necessary cookies will impair your ability to use the Service. For more information on managing cookies, visit allaboutcookies.org.

6. Data Retention

We retain your personal data only as long as necessary to provide the Service and meet our legal obligations:

• Account data: Retained for the duration of your account. Deleted or anonymized within 30 days of account closure.
• Analysis results and reports: Retained while your account is active. Deleted within 30 days of account closure.
• Uploaded video files: Automatically deleted within 24 hours of analysis completion, regardless of account status.
• Billing records: Retained for 7 years as required by UAE commercial and tax law.
• Support communications: Retained for 2 years after the closure of a support ticket.
• Usage logs and technical data: Retained in aggregate, anonymized form for up to 24 months for security and service improvement purposes.

7. Your Rights

Depending on your location and applicable law, you may have the following rights with respect to your personal data:

Rights under GDPR (EEA and UK users):

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data (subject to legal retention obligations).
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Withdraw any consent you have given at any time without affecting the lawfulness of prior processing.

Rights under UAE PDPL:

• Access your personal data and request correction or deletion
• Withdraw consent for processing where consent is the lawful basis
• Request information about how your data is used and with whom it is shared

California residents (CCPA/CPRA):

• Right to know what personal information is collected, used, disclosed, or sold
• Right to delete personal information (with exceptions)
• Right to opt out of the sale or sharing of personal information (we do not sell personal data)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information

To exercise any of these rights, please contact us at privacy@leen.studio. We will respond to verifiable requests within 30 days (or as otherwise required by applicable law). We may need to verify your identity before fulfilling a request.

8. Data Security

We take data security seriously and implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. Our security practices include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest
• Row-level security and access controls on our database infrastructure (Supabase)
• Regular security reviews and vulnerability assessments
• Strict internal access controls on a need-to-know basis
• Automatic deletion of temporary files (video uploads) within 24 hours

Despite our best efforts, no method of transmission over the internet or electronic storage is 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

9. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, please do not use the Service or submit any personal data to us.

If we become aware that we have inadvertently collected personal data from a person under 18, we will take steps to delete that information promptly. If you believe we may have collected data from a minor, please contact us at privacy@leen.studio.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the effective date at the top of this page and, where required by law, provide you with advance notice by email or a prominent in-app notification.

We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of a revised Policy constitutes your acceptance of the changes. The current version of this Policy is always available at leen.studio/privacy.

11. Contact and Data Controller

LeenStudio Ltd. is the data controller responsible for your personal data under this Policy. If you have any questions, concerns, or requests relating to your privacy or this Policy, please reach out to us:

• Company: LeenStudio Ltd.
• Privacy inquiries: privacy@leen.studio
• General support: support@leen.studio
• Website: leen.studio

If you are located in the EEA and believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.