Privacy Policy

Under article 10 of the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller for personal data relating to the AI-powered animation and video-film creation service (the “Service”) offered under the runime brand is IS.TEAM LLC.

• Legal name: IS.TEAM LLC
• Address: 8 The Green, Ste A, Dover, DE 19901
• Jurisdiction: Delaware, United States
• Registration no. (Delaware File Number): 10536716
• Tax ID (EIN): 32-0850176
• Contact: support@runime.com

IS.TEAM LLC is a legal entity established in Delaware, United States. For users resident in Turkey we are therefore an overseas-established data controllerwithin the meaning of KVKK article 9, and your personal data is, by its nature, processed abroad. The legal basis for this processing is the performance of the contract that is necessary for you to use the Service (art.5/2-c) together with the explicit consent you give (art.9). The servers of the cloud infrastructure and AI providers we use may be located in different countries; the current and complete list is in the “Data transfers and processors” section below.

Your paid subscription and token purchases are carried out by Stripe, Inc. (Merchant of Record — Stripe Managed Payments), acting as Merchant of Record. Your card details are collected directly by Stripe and are never stored on IS.TEAM LLC servers; with respect to that payment data Stripe is an independent data controller under its own privacy policy. These purchases are also governed by our Terms of Service.

We process the following categories of personal data while you use the Service:

Account and identity data

• Your name, email address, profile picture (avatar) and unique account identifier as provided by Google when you sign in with Google
• Your account status and your language and interface preferences

Service and content data

• The scripts, stories, ideas and instructions you write for production
• The reference images you upload (character, location or object images)
• The video, image and audio assets you create with the Service and their associated project data
• Your own voice recorded in the voice-changer (STS) feature. This voice recording is processed in order to be recast into the character voice you select and may be treated as biometric / special category personal data within the meaning of KVKK article 6; it is processed only with your explicit consent and is deleted at the latest within 30 days after the operation is completed.

Technical data (device and network)

• IP address — processed by being one-way hashed with SHA-256 at the moment of logging; the raw IP address is not stored
• Browser type, operating system, device and screen information, language preference
• Server access logs (URL, status code, timestamp)

Billing data

• Subscription type and status, token wallet balance and spending records
• Payment identifiers held on Stripe’s side (customer, subscription and payment IDs); the card number and CVV never reach our systems

Communication data

• The messages you send us for support, KVKK requests or notifications, and their attachments

We also store a small number of cookies and similar browser storage; these are described in detail in our Cookie Policy.

We process your personal data for the following purposes:

• Providing the Service: creating your account, maintaining your session and keeping your projects available.
• Film production: running your script, story or idea through the AI production pipeline to generate scene images, video clips, dialogue voice-over, music and sound effects, and preparing the full-film MP4 output.
• Personalization: keeping the content you create consistent with your character, location and style preferences.
• Voice changer (STS): only with your explicit consent, recasting the voice you record into the character voice you select.
• Billing: managing subscription and token purchases, metering spend and issuing your invoices.
• Security and abuse prevention: enforcing quotas and blocking misuse and account-takeover attempts.
• Service improvement: debugging and aggregate (non-personalized) performance analysis.
• Legal obligations: records that must be kept under tax, commercial and other legislation.
• Communication: responding to support requests and sending mandatory service notices (renewal, security, contract changes).
• Marketing (only with explicit consent): product updates and campaign announcements; you may opt out at any time.

Our processing conditions under KVKK articles 5 and 6 are summarized in the table below:

In order to provide the Service, your personal data is shared with a limited number of contractually bound processors. A data processing agreement (DPA)is in place with every processor. For cross-border transfers we rely, under KVKK article 9, on your explicit consent or on contractual safeguards that provide adequate protection (e.g. the GDPR Standard Contractual Clauses — SCCs).

We never sell, rent or trade your personal data for advertising purposes. Sharing takes place only with the processors listed above and only to the extent needed to provide the Service. Where the competent authorities make a duly issued written request, sharing may be carried out limited strictly to the scope of that request.

We retain your personal data only for as long as necessary for the purpose of processing. Once the statutory retention periods (e.g. invoice records) expire, the data is deleted or anonymized.

In particular, billing and payment records are retained for 10 years as required by Turkish law (Tax Procedure Law art.253 and Turkish Commercial Code art.82).

Under KVKK article 12 we take appropriate technical and organizational measures to protect your data:

• All connections are end-to-end encrypted with TLS 1.2+.
• Authentication is managed by Firebase Authentication; we do not store passwords, and sign-in happens through Google.
• Only the server-side service account accesses the database; the client cannot access data directly.
• IP addresses are one-way hashed with SHA-256 before being stored.
• Payment card data never reaches our systems; Stripe is PCI-DSS Level 1 compliant.
• Regular vulnerability scanning is carried out on third-party dependencies.
• If a personal data breach is detected, under KVKK article 12/5 we notify the Board and the affected data subjects within 72 hours.

Under KVKK article 11 you may exercise the following rights by applying to us as the data controller:

1. To learn whether your personal data is being processed
2. To request information if it has been processed
3. To learn the purpose of processing and whether the data is used in line with that purpose
4. To know the third parties, in Turkey or abroad, to whom the data is transferred
5. To request rectification if it has been processed incompletely or inaccurately
6. To request its erasure or destruction within the conditions set out in KVKK article 7
7. To request that rectification and erasure be notified to the third parties to whom the data was transferred
8. To object to a result arising against you as a consequence of the data being analysed exclusively by automated systems
9. To claim compensation for damage suffered as a result of unlawful processing

Users located in the European Union may additionally exercise their rights under GDPR articles 15–22 (access, rectification, erasure, restriction of processing, data portability, objection to automated decisions, and complaint to a supervisory authority).

You may make article 11 requests free of charge. We respond to your request within 30 days at the latest. Application channels:

• Email (recommended): support@runime.com
• Post (international): IS.TEAM LLC, 8 The Green, Ste A, Dover, DE 19901

Because the data controller is registered outside Turkey, we do not operate a KEP (registered electronic mail) line; the official channel for all requests is email. It is sufficient to include in your request the information that verifies your identity (the email address linked to your account) and to state your request clearly; to prevent unauthorized access we may apply an additional identity-verification step.

If you are not satisfied with our response, you retain the right to lodge a complaint with the Personal Data Protection Board (KVKK article 14).

runime does not provide the Service to users under the age of 13. Users under 18 may use the Service only with the knowledge and supervision of a parent or legal guardian; this supervision is also required for paid subscription and token purchases.

If we detect data belonging to a user under the age of 13, the relevant account is closed immediately and the data is deleted. If you wish to delete an account belonging to your child, you can reach us at support@runime.com.

For users accessing from the European Union we would like to point out the following in particular:

• Film, image, video and audio production takes place through a fully automated process. However, this production does not produce a decision that has legal effects concerning you or similarly significantly affects you; it therefore does not constitute a “decision based solely on automated processing” within the meaning of GDPR article 22.
• You may exercise your GDPR articles 15–22 rights (access, rectification, erasure, restriction of processing, portability, objection) via support@runime.com.
• For transfers of data outside the EU, the Standard Contractual Clauses (SCCs) or equivalent safeguards are applied.
• You retain the right to lodge a complaint with the data-protection supervisory authority of the country where you are located.

We may update this policy from time to time due to changes in legislation or updates within the scope of the Service. We announce material changes by email or inside the Service before they take effect; for minor text and formatting corrections you can rely on the “Last updated” date at the top of this page.

If you do not wish to accept the policy, you retain the right to stop using the Service and to close your account. For questions, requests or feedback, and to review the consents you have given, see your consent settings or email support@runime.com.