Privacy Policy

Speakwise GmbH

Kollage 3, 49170 Hagen a.T.W., Germany

Represented by Nicolas Hagedorn, managing director.

Phone +49 5401 1523001, email hallo@speakwise.agency

We have not appointed a data protection officer; the conditions of Art. 37 GDPR and § 38 BDSG are not met. Please send privacy requests to the address above.

You can use the library on the website without an account; you need one only for the MCP service and saved collections. There are no advertising cookies, tracking pixels, retargeting, ad networks, social media plugins or embedded video services. We do not sell data, and neither we nor our providers train AI models on your inputs, files or videos. If you email us, we keep your message as long as needed to handle it and for legal retention duties (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for a contract).

We do not ask for cookie consent because nothing we use needs it under § 25 TDDDG. Analytics and copy counting store and read nothing on your device. Two exceptions are strictly necessary for a service you asked for (§ 25(2) no. 2 TDDDG): the theme choice in localStorage (key mr-theme, only when you use the switch), and a session cookie when you sign in, on the website or on the MCP sign-in page at mcp.motionstash.io. The Lemon Squeezy checkout runs on its own domain under its own responsibility.

The server that delivers the site processes the IP address, time, requested URL and status, user agent and referrer, to deliver pages and detect attacks (Art. 6(1)(f) GDPR). The site is hosted by Vercel Inc., USA, as our processor under its Data Processing Addendum, with transfers under the 2021 standard contractual clauses (Art. 46(2)(c) GDPR). We use Vercel Web Analytics and Speed Insights, which count page views and measure loading speed without cookies and without a cross-site identifier, served from this domain (Art. 6(1)(f) GDPR).

When you copy a component, download a preview or copy a prompt, we store which item and button, the referring host name, the country reported by Vercel, a timestamp and a daily pseudonym (a SHA-256 hash of the date, IP address, user agent and a secret); neither IP nor user agent is stored, and the pseudonym changes every day (Art. 6(1)(f) GDPR). All fonts are served from this domain; there is no request to Google Fonts. Previews are files on this domain, with no third-party video player.

You can sign in to the website with Google to save collections and see your own copies. Only after you press "Continue with Google" do we connect to Google Ireland Limited, Dublin, and we receive your name, email address and profile picture URL; no password. Legal basis: Art. 6(1)(b) GDPR. Ask us by email to delete the account at any time.

You connect the MCP service at mcp.motionstash.io to an AI assistant you use yourself. The service runs on Amazon Web Services in region eu-central-1, Frankfurt, Germany. We process:

Legal basis is Art. 6(1)(b) GDPR: without this data we can neither run the account nor make videos. Technical logs and abuse prevention (such as the company email check on the free plan) rest on Art. 6(1)(f) GDPR, our legitimate interest in secure and affordable operation; so does the upgrade offer after a free video.

We read the brand card only from publicly reachable pages of the website of your email domain or the one you name, nothing behind a login. It is used only after you confirm it, and you can have it removed at any time.

We create a copy of your voice only at your express request, based on your consent (Art. 6(1)(a) GDPR and, where voice data is a special category of personal data, Art. 9(2)(a) GDPR). You can withdraw consent at any time; the voice copy is then deleted.

Your AI assistant is not part of our service. Its provider processes what you discuss with Claude, ChatGPT or another assistant under its own responsibility and privacy policy. We receive only what the assistant sends to our server.

To create the concept, text, animation, voice and sound of a video, we send your order and the material it needs to AI models: to Anthropic (Claude) directly, through OpenRouter to further model providers, and to ElevenLabs for voices and sound. This processing serves only to make your video.

Your inputs, files and videos are not used to train third-party AI models. The providers process them as our processors under their API terms, which exclude training on customer data. On OpenRouter our account sets data_collection to "deny": requests go only to model providers that do not store inputs or train on them. There is no automated decision with legal effect on you within Art. 22 GDPR; the models produce design, not decisions about people.

You buy paid plans and credit packs from Lemon Squeezy, LLC, USA, which as Merchant of Record is the seller, handles payment, calculates tax and issues the invoice. You enter your payment and billing data (name, email, address, country, payment method, VAT ID if any) with Lemon Squeezy, which processes it as an independent controller under its own privacy policy, linked at checkout. Lemon Squeezy transfers data to the USA; the transfer is necessary for the purchase contract you make there (Art. 49(1)(b) GDPR), and Lemon Squeezy also relies on its own transfer safeguards.

We never receive card numbers, only what we need to unlock your plan: email address, order number, product, amount, country, subscription and payment status (Art. 6(1)(b) GDPR). We keep these records as long as German commercial and tax law requires (Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB).

These providers process data on our behalf under a contract according to Art. 28 GDPR. Where data goes to the USA, the transfer rests on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR) in the respective data processing agreement.

Lemon Squeezy is not a processor but an independent controller, see above. Otherwise we pass on data only where the law obliges us to.

AI providers keep requests only as long as their API terms provide for operation and abuse prevention, and do not use them for training.

When you join the waitlist we store your email address as unconfirmed and send one email with a link valid for 48 hours; only when you confirm are you on the list. We also store signup and confirmation times, the consent text version, an invite code, the referrer if you came through an invite, campaign tags, referring host, page, browser language and country, and which emails we sent. For rate limiting we store a salted hash of your IP address, not the address. Legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw with the unsubscribe link or by email; attribution, rate limiting and keeping a record of an unsubscribe rest on Art. 6(1)(f) GDPR. Unconfirmed entries are deleted after 30 days, confirmed ones when you unsubscribe or at the latest 12 months after launch. Emails are sent by Resend; the data is stored at Supabase in the EU.

A launch film request on our home page sends us one email with your product URL, email address, note, country and referring host; it is not stored in a database. A salted IP hash is held briefly in server memory for rate limiting. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for country, referrer and rate limiting. The email is sent by Resend.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you can withdraw it at any time with effect for the future (Art. 7(3)). An informal email to the address above is enough. We store no identifier that links a page view to a person, so for website visits there is usually nothing to disclose (Art. 11 GDPR); for accounts and the waitlist we give full access.

You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

This policy applies in the version of October 13, 2026. The German version prevails.