Privacy Policy

Summary

Dimly is an AI music video generator operated by dimly.ai ("Dimly", "we", "us"). To make a video we need your account details, the songs, photos and prompts you give us, and the results we generate for you. We use them to run the service, bill you and keep it safe. We do not sell personal information and we do not use your uploads to train our own AI models. You can ask us at any time for a copy of your data or to delete it by emailing support@dimly.ai.

This policy covers dimly.ai and its subdomains. It does not cover third-party sites you reach through links on Dimly.

Information you give us

• Account details. Your email address, name, and password (stored only as a salted hash). If you sign in with Google, we receive your name, email address and profile picture from Google; we never see your Google password.
• Songs and audio. Audio files you upload and links you import (for example a Suno link), plus the confirmation that you own the recording or have permission to use it.
• Photos and images. Pictures you upload as references, for example a selfie for an AI effect or a photo to build a character sheet. These may show your face or other people's faces.
• Prompts and conversations. What you type to the Dimly director, the treatments, shot lists and quotes it produces, and your feedback on takes.
• Support messages. What you send to support, including attachments.
• Payment details. Card and billing information is entered on our payment processor's page (Stripe) and stored by them. We receive only the customer ID, the last four digits and brand of the card, the billing country, and the amount and status of each payment.

Information we collect automatically

• Usage data. Pages visited, features used, generations started and their status, credits consumed, and timestamps.
• Device and log data. IP address, browser and operating system, referring page, and the campaign source (UTM tags) that brought you to Dimly. Our servers and our hosting provider keep request logs for security and debugging.
• Cookies and similar storage. We use cookies to keep you signed in, remember your language and theme, and protect forms. We use privacy-focused analytics (Umami) that does not use advertising cookies or build cross-site profiles. We do not run advertising trackers.

Content we generate for you

The images, video clips, lyric captions, edits and finished music videos you generate ("Outputs") are stored with your account so you can review, download and reuse them. Media files are served from our storage provider through long, unguessable links; anyone who has such a link can open the file, so share links with care.

How we use information

• To provide the service: transcribe and analyse your song, plan shots, generate images and video, assemble and deliver your exports.
• To run accounts and billing: sign-in, credits, subscriptions, receipts and refunds of failed generations.
• To keep Dimly safe: detect abuse, fraud, payment disputes and content that breaks our Terms of Service.
• To support you: answer requests and investigate problems you report.
• To improve the product: measure which features are used and where generations fail, using aggregated or de-identified data where we can.
• To communicate: send transactional emails (sign-in links, password resets, receipts, important account notices). We send marketing email only if you have agreed to it, and every such email has an unsubscribe link.

We do not use your songs, photos, prompts or Outputs to train our own AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal bases (EEA, UK and Switzerland)

Where the GDPR or similar law applies, we rely on: performance of our contract with you (running the service and billing); our legitimate interests (security, fraud prevention, product analytics, support), balanced against your rights; your consent (marketing email, and any optional cookies), which you can withdraw at any time; and legal obligations (tax and accounting records).

Who processes your data

We share personal information only with service providers that help us run Dimly, under contracts that limit their use of it to providing services to us:

• Hosting, storage and email: Cloudflare (application hosting, file storage, speech-to-text for lyric timing), our database server host, and our transactional email provider.
• AI generation: model providers that run the image, video, speech and language models you choose or that the director uses, such as Kie, APIPod, Fal, Replicate, Anthropic and DeepSeek. They receive the prompts, reference images, audio segments and other inputs needed for that generation and return the result.
• Payments: Stripe, which processes payments and handles card data under PCI DSS.
• Sign-in: Google, if you choose Sign in with Google.
• Analytics: Umami, self-hosted on our own server.

We may also disclose information when the law requires it, to respond to valid legal process, to protect the rights, property or safety of Dimly, our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

International transfers

Our providers operate in the United States and other countries. When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the provider's Standard Contractual Clauses or an equivalent safeguard.

How long we keep data

• Account, projects, uploads and Outputs: for as long as your account is active. When you ask us to delete your account, we delete these within 30 days, except where we must keep something for the reasons below.
• Payment and invoice records: as long as tax and accounting law requires (usually up to 7 years).
• Server logs: typically up to 90 days.
• Support conversations: up to 2 years after the request is closed.
• Backups: deleted data can persist in encrypted backups for up to 30 more days before it is overwritten.

Security

Connections to Dimly are encrypted with TLS. Passwords are hashed, provider secrets are encrypted at rest, and access to production systems is restricted to the people who operate the service. No system is perfectly secure; if we learn of a breach that affects your personal data, we will notify you and the relevant authorities as the law requires.

Your rights and choices

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent. California residents have the right to know, delete and correct personal information and not to be discriminated against for using these rights; we do not sell or share personal information as those terms are defined in the CCPA.

To use any of these rights, email support@dimly.ai from the address on your account. We will reply within 30 days and may need to confirm your identity first. You can also complain to your local data protection authority.

You can download your Outputs from your account at any time, unsubscribe from marketing email with the link in each message, and clear or block cookies in your browser (some features, such as staying signed in, will then stop working).

Photos of people

Only upload photos of yourself, or of people who have agreed to their photo being used this way. We use uploaded photos only to generate the content you request. We do not create face templates for identification and we do not use photos to identify anyone.

Children

Dimly is not intended for children under 13, and users under 18 need permission from a parent or guardian. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the service changes. The date at the top shows the latest version. For material changes we will notify you by email or in the product before they take effect.

Contact

Questions or requests about privacy: support@dimly.ai.