Privacy notice

Anjin Ltd, trading as Anjin Media, is the data controller for this website and for the accounts on it. We are a company registered in England and Wales, number 16378036, and our registered office is 213 Station Road, Stechford, Birmingham, England, B33 8BB. We are registered with the Information Commissioner's Office under ZC154847.

There is a second relationship inside the service. The footage you upload is yours, and the people in it are your responsibility: for that material we act as your processor and handle it on your instructions, not on our own account. For your account, your billing details and this website we are the controller.

Write to privacy@anjin.media about anything on this page. That mailbox is being brought up ahead of launch alongside the rest; if a message bounces before then, that is why, and clearing it is our job.

This site uses Google Analytics, and only after you accept it. Nothing is measured before that answer, and turning it off deletes what was set. The consent banner asks in advance of the measurement it will gate, because the answer has to be on record before anything runs. The cookies page names every cookie involved and what each one holds.

One thing is collected either way. This site runs on Fly.io, and its servers keep ordinary request logs: the address a request came from, the time, the page asked for, the browser string and the response code. We use them to keep the site up and to see abuse; we do not build a profile from them, and they are not joined to an account or to anything you type here.

There is no contact form on this site, so nothing is submitted to us by filling something in. If you email one of our published addresses, we hold that message and reply to it.

Signing in at app.anjin.media creates an account, and from then on what we hold is what the work needs:

• Account records. Your name and email address, the other people you invite and the role each of them has, and the API keys you mint - stored as a hash, never as the key.
• What you upload. The video and audio files you bring in, and the derivatives the platform makes from them so it can work: a downscaled mezzanine, the extracted audio, a preview proxy. Any personal data in the footage itself comes with it, which is why the material is handled on your instructions.
• Transcripts and speakers. A word-timecoded transcript of each source group, the separated speaker labels, and any display names you assign to them.
• Briefs, plans and outputs. The brief you write, every version of the plan composed from it, the finished renders and their sidecars - captions, an edit decision list, a quality report.
• Usage records. Counters of what the account has consumed: hours ingested, angle hours rendered, transcript hours planned, plans made, output minutes, egress and stored gigabyte-months. They exist to bill and to enforce limits, and they hold no content.
• Billing identity. Who is paying and for what, held with Stripe. Card details are entered with Stripe, not with us.

Three lawful bases cover everything above.

• Performance of a contract. Running the service you signed up for: the account, the uploads, the transcripts, the plans, the renders and the billing that follows them. Without this data there is no service to give you.
• Consent. Analytics on this website, and only that. It is asked for in advance, recorded in a cookie, and can be withdrawn at any time from the Cookie settings control in the footer.
• Legitimate interests. Keeping the platform up and secure - server logs, rate limiting, investigating abuse - and recovering money genuinely owed. The interest is ours; the test is whether it overrides your rights, and for logs read to stop an attack we are satisfied it does not.

There is no expiry timer in the platform. What you upload stays until you delete it: no retention schedule, no tier a source group ages into, no scheduled purge. Deleting a source group removes the originals and every derivative made from them, then the record; deleting a cut takes its renders and sidecars with it; deletion reaches storage and is not reversible.

One exception, and we would rather print it than let you find it. An account left in arrears moves down a ladder: fourteen days of grace in which everything keeps working and warning emails go out on day zero, day seven and day twelve; then read-only, where nothing new can be started but everything you have is still there to read and download, with further warnings on day sixty and day eighty-three; and no earlier than ninety days the library is reclaimed and its material permanently deleted. Ninety days is the floor rather than a countdown: reclaim runs only once those final warnings are on record, and the periods can be set longer. Clearing the arrears at any point stops the ladder. The terms set the same ladder out as a clause.

Account records last as long as the account. Billing records outlive it, because UK tax and company law requires us to keep them, and we keep them for no longer than that requires.

A short, named list - eight companies, each with one job. Every one of them is on the sub-processors page, with what it does and what it receives, and that page is where changes appear. There is no error-tracking service, no metrics pipeline and no session recorder anywhere in the platform.

We do not sell your data, and there is no advertising network in any of this. We do not train models on your media: there is no Anjin model to train. What the two AI vendors we call may do with what they receive is set by their own published terms, and the security page states each of them separately rather than averaging them.

Most of it stays in the United Kingdom and the European Economic Area, but not all of it, so here is the whole path:

• Transcription - European Union. The extracted audio goes to AssemblyAI's EU endpoint as a signed link that expires in two hours. Their published security page names Dublin as the European processing centre behind it. Your video does not leave.
• Planning - United States. Transcript text and the brief you wrote go to Anthropic. Text only: no audio, no video, no frames. The transfer relies on the safeguards in Anthropic's data-processing terms; confirming exactly which mechanism covers our account is one of the items still open on this draft, and this paragraph will name it when it is closed.
• Storage and database - Supabase. Your media at rest and the records that describe it. We confirm the project region in writing on request rather than printing a region we have not verified here.
• Compute - Fly.io, London. The API, the dashboard and the render workers run in Fly's London region, and media passes through them while it is being ingested or rendered.

Under UK data protection law you can ask us to do any of the following, and we answer within one month:

• See it. A copy of the personal data we hold about you, and what we do with it.
• Correct it. Fix anything inaccurate or incomplete.
• Delete it. Erase it, where we have no overriding reason to keep it. Inside the service you can do most of this yourself, and it reaches storage when you do.
• Restrict or object. Pause our use of it while something is disputed, or object to processing we do on legitimate interests.
• Take it with you. Receive the data you gave us in a portable form. Transcripts, plans and renders can all be exported through the API before you go.
• Withdraw consent. For website analytics, at any time, through the Cookie settings control. Withdrawing does not undo what was lawfully measured beforehand.

If your personal data is inside a customer's footage rather than in an account of your own, the customer who uploaded it decides what happens to it. Write to them; if you write to us instead, we will pass the request on and tell you we have.

Ask us first at privacy@anjin.media. If we get it wrong you can complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk. Our registration number is ZC154847.

Media sits in private storage that has no public address; access is scoped to one account and reached through short-lived signed links; API keys are stored hashed and shown once; webhook deliveries are signed. The security page sets all of it out, including the certifications we do not hold. No system is perfect, and we would rather name what is missing than imply there is nothing to name.

When this notice changes, the date at the top of the page changes with it, and the change ships in the same deploy as whatever it describes. There is no notification list yet, so a material change affecting paying customers goes out by email to the account address and this page carries it. Until the owner has reviewed this draft, treat it as a statement of what we do rather than a finished legal instrument.