This policy explains how Latest Effects processes personal data, under Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).
Controller
- Controller: Latest Effects
- Registered office: pending: registered address
- Tax identification number (NIF): pending: NIF
- Data protection contact: privacy@latesteffects.com
- Data protection officer: pending: appointed or not, with contact details
These details must be completed with the operating entity’s real data before the Service is offered commercially.
What we process, why, and on what basis
Account data (name, email address, password hash, language and appearance preferences). Used to create and operate your account. Basis: performance of the contract, article 6.1.b GDPR.
Project content (briefs, prompts, uploaded media, generated media, timelines, exports, comments). Used to provide the workspace, run the operations you ask for and store your work. Basis: performance of the contract.
Billing data (project balance movements, resource plan, invoices, partial card identifiers, tax identification where you invoice as a business). Used to take payment and meet accounting and tax duties. Basis: performance of the contract and legal obligation, articles 6.1.b and 6.1.c GDPR.
Usage and diagnostic data (pages viewed, features used, a pseudonymous browser identifier, error reports, approximate location derived from IP, device and browser type). Used to keep the Service secure and working and to understand how it is used. Basis: legitimate interest, article 6.1.f GDPR, for strictly necessary security processing. Optional product analytics are based on your consent under article 6.1.a GDPR and article 22.2 LSSI-CE, and remain disabled until you accept them. See the Cookie Policy.
Support correspondence. Used to answer you and to keep a record of the issue. Basis: performance of the contract and legitimate interest.
Marketing email, only where you have opted in. Basis: consent, withdrawable at any time from any message.
What we do not do
Your prompts and input media are sent to the provider used for the generation you request. Contact our privacy team for the processing and retention terms applicable to a particular provider.
We do not sell personal data. We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you for advertising.
Recipients
Providers receive data needed for the services they supply. The integrations below are used when enabled for the service or operation you select:
| Provider | Purpose and data |
|---|---|
| Supabase | Account authentication, email address, credentials and sign-in emails |
| Google sign-in identity when you choose it; Google Analytics 4 browser events only after analytics consent | |
| Stripe | Payments, billing address, payment method and transaction details; card details are handled by Stripe |
| fal.ai, Pruna, APIMart, ElevenLabs | Prompts, selected input media and generation parameters for operations routed to that provider |
| Sentry | Configured error reports and operational logs |
| Application hosting and object-storage providers | Account records, project content and uploaded/generated files |
The hosting entities, enabled processors, contracted regions and transfer safeguards must be confirmed for the production deployment before commercial launch. Ask privacy@latesteffects.com for the current processing information.
We also disclose data where a law, a court or a competent authority requires it.
An up-to-date list of processors, with the categories of data and the countries involved, must be published and maintained before the Service is offered commercially.
International transfers
Providers may process data outside the European Economic Area. Before such processing is enabled, the operator must verify the applicable adequacy decision or other GDPR transfer mechanism, including standard contractual clauses and any required supplementary measures. Contracted regions and safeguards are pending production verification; this policy does not certify a provider’s terms. You can request the applicable information at the privacy address above.
Retention
- Account and project data: held while your account is open. Account deletion removes the application account and owned projects and requests deletion of their stored files. Content contributed to someone else’s project remains with that project. Contact us for an erasure request concerning that content.
- Billing records and accepted agreements: may be retained to meet accounting, tax and legal-claim obligations, with access restricted to those purposes.
- Privacy requests: retained with your account so you can retrieve the receipt and response. You may keep your own downloaded copy.
- Browser analytics identifiers and consent: as described in the Cookie Policy; withdrawal stops optional analytics on that device.
The production schedules for backups, provider copies, diagnostic logs, correspondence and legal records require operator confirmation. We do not promise a fixed deletion period for those systems until their settings and obligations have been verified. You can ask our privacy team about retention for your data.
Your rights
You may request access to your personal data, its rectification or erasure, the restriction of processing, portability in a structured, commonly used and machine-readable format, and you may object to processing based on our legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
In Account settings → Privacy, you can download account data and accepted agreements, submit a rights request and download its receipt. Responses appear in that section. The export includes account details, project membership, owned project and file metadata, generation records, purchases and recorded agreements; it is not a copy of every media file. You can also write to privacy@latesteffects.com, including if you cannot access your account. Cookie choices can be changed in the same Privacy section. Account deletion is available under account settings.
We respond within one month, which may be extended by two further months for complex requests, and we will tell you if it is extended. We may ask for proof of identity where there is reasonable doubt.
If you consider that your rights have not been respected, you may complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the supervisory authority of your country of residence.
Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access control on a need-to-know basis, network isolation of processing workloads, logging, and regular review. No system is perfectly secure. If a breach is likely to result in a high risk to your rights we will notify you, and we will notify the supervisory authority where article 33 GDPR requires it.
Children
The Service is not directed at people under 18. If we learn that we hold the data of a child without the consent required by article 7 LOPDGDD, we delete it.
Changes
We will publish any change here and update the date above. Where a change is significant we will tell you by email or in the application before it takes effect.