Privacy Policy
- Who we are and how to reach us: section 1.
- What we collect and why: sections 3 and 4.
- Who we share it with, including AI providers, and where it goes: sections 5 and 6.
- How long we keep it and how to delete your account: section 7.
- Your rights and how to complain: sections 8 and 12.
- 1. Who we are
- 2. What this covers
- 3. What we collect
- 4. How we use it
- 5. Who we share it with
- 6. Where your data goes
- 7. How long we keep it
- 8. Your rights
- 9. AI generation
- 10. Security
- 11. Children
- 12. Complaints
- 13. EU and US visitors
- 14. Changes
1. Who we are
OneTake is a trading name of Morgan Industries Ltd, a company registered in England and Wales with company number 17445665. We are the data controller for the personal data described in this policy.
Registered office: 140 Dance Square, London EC1V 3AL, United Kingdom. Email: admin@onetake.digital. We do not have a Data Protection Officer because the law does not require one for a business of our size and type; the address above is our privacy contact and we answer within 30 days.
We are registering with the UK Information Commissioner's Office as a data controller[add the registration number once issued].
2. What this policy covers
This policy covers the marketing website at onetake.digital and the OneTake studio at app.onetake.digital, including the newsletter and email updates that come with membership. It does not cover other websites we link to, or the social platforms you post your finished videos on.
3. What we collect
Information you give us
- Account details. Your email address. If you sign in with Google, we also receive the name and profile picture on your Google account. We never see your Google password, and email sign-in uses a one-time link rather than a password stored with us.
- What you make in the studio. Reel names and folders, story formats, your choice of actor, location and props, scripts you write or have written for you, storyboard frames, captions and banner text, and the finished videos and images.
- Things you upload. Logos and brand marks (PNG, JPG or SVG) and any other files you add to your brand library.
- Messages you send us. Support emails and anything you tell us in them.
Information created as you use OneTake
- Spend and usage. A ledger of every paid action (which step, which provider, how many seconds or images, the cost in US dollars, the time) so we can charge your balance correctly and show you exactly what you spent.
- Membership and balance. Whether your membership is active, your prepaid balance, your spend cap and a Stripe customer reference. We never receive or store your card number; Stripe does.
- Technical data. Server logs that record requests to our systems, including your IP address, browser type and the time, kept for security and to fix faults. Session tokens and small preference settings held in your browser (see our cookie notice).
We do not ask for, and you must not upload, special category data such as health, religion, sexuality or political opinions, or photographs or voices of real people without their permission (see section 9).
4. How we use it, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating your account, signing you in and keeping you signed in | Email, Google profile, session tokens | Performing our contract with you |
| Building your videos: writing scripts, generating images, clips, voices, captions and covers | Scripts, choices, uploads, storyboard frames | Performing our contract |
| Charging your balance, taking membership payments and top-ups, showing you your spend | Ledger, membership, balance, Stripe reference, email | Performing our contract; legal obligation for tax and accounting records |
| Sending service emails: sign-in links, low-balance and membership notices | Performing our contract | |
| Telling you when we open, if you registered your interest on our holding page | Consent, which you can withdraw by replying to any email or writing to us | |
| Email updates and the OneTake newsletter | Legitimate interests (you became a member and can opt out at any time); consent where you sign up without a membership | |
| Keeping the service secure, preventing fraud and abuse, enforcing spend caps and our terms | Logs, IP address, account and usage data | Legitimate interests in running a safe, solvent service |
| Understanding how the studio is used so we can improve it | Aggregate usage figures from the ledger and logs | Legitimate interests; we look at totals, not individuals |
| Measuring how the marketing site is used, if you allow analytics cookies | Anonymised usage data and a first-party analytics cookie ID | Consent, which you give in the cookie card and can withdraw at any time |
| Answering support requests | Your messages and the account data needed to help | Performing our contract; legitimate interests |
| Meeting legal duties, for example tax records or a lawful request from an authority | Whatever the duty requires | Legal obligation |
Where we rely on legitimate interests we have checked that our interest does not override your rights. You can object at any time (section 8). We do not use your data for automated decisions that have a legal or similarly significant effect on you. Content filters may decline to generate certain material; a person reviews any dispute.
5. Who we share it with
We share personal data only with the providers that run parts of the service for us, acting on our instructions under written contracts. We do not sell personal data and we do not share it for advertising.
| Provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Supabase | Sign-in, including sending your sign-in link, and our database | Email, Google profile details, account and studio records | EU (Frankfurt) |
| Hetzner Online | The servers the studio runs on and the storage for your videos, images and uploads | Everything processed by the app while it runs; your media files; server logs | EU (Finland) |
| Sign in with Google; and Google Workspace, our business email, which sends email updates and the newsletter | Your name, email and picture when you sign in with Google; your email address and the content of emails we send you | US, under the UK Extension to the EU-US Data Privacy Framework | |
| Stripe | Membership payments, top-ups, and as Onelink (Stripe's seller of record) your receipts and invoices; cancellation | Email, account reference, payment details you enter on Stripe's pages | Ireland and US |
| BytePlus | Generating video clips and images | Storyboard frames, reference audio, text descriptions of the shot; never your email or account details | Singapore |
| Google (Gemini models) | Writing and checking scripts; small image tasks | Your reel brief, script text and prompts; never your email or account details | US, under the UK Extension to the EU-US Data Privacy Framework |
| OpenRouter | Routing some model calls for us | Prompts and script text only; never your email or account details | US |
| ElevenLabs | Generating the voice for each actor | Script text | US |
| fal.ai | Short-lived hosting of generated audio between steps | Generated audio files | US |
| Google (Google Analytics) | Website analytics on the marketing site, only if you allow analytics cookies | Anonymised usage data and an analytics cookie ID; never your email or account details | US, under the UK Extension to the EU-US Data Privacy Framework |
We may also share data if the law requires it, to protect our rights or someone's safety, or with a buyer if OneTake is sold, in which case this policy continues to apply. We may add or change providers; we will update this table when we do.
6. Where your data goes
Your account and studio records live in the European Union, which UK law treats as offering adequate protection. Some providers process data in the United States or Singapore. When that happens we rely on one of these safeguards: the UK Extension to the EU-US Data Privacy Framework for certified US companies, or the UK International Data Transfer Agreement or Addendum (and, for our EU users, the EU Standard Contractual Clauses) built into the provider's contract with us. You can ask us for a copy of the safeguard that applies to any provider.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account details and everything in your studio | While your account is open, then deleted within 30 days of you closing it |
| Uploaded logos and brand marks | Until you delete them or close your account, then within 30 days |
| Spend ledger, receipts and payment records | Six years after the tax year they relate to, as HMRC requires |
| Server logs | 30 days |
| Database backups | Rolling 30 days; deleted data leaves the backups on that cycle |
| Support emails | Two years after the matter closes |
| Newsletter address | Until you unsubscribe or your membership ends, whichever you choose |
| Register-your-interest address | Until we have opened and written to you, or until you ask us to remove it, whichever is sooner |
Closing your account. Email admin@onetake.digital from your account address and we will cancel any membership, refund nothing that has already been spent (see the Terms for the balance), and delete your studio on the schedule above. Download anything you want to keep first. You can also ask Onelink to delete the payment records it holds and cancel any subscription, through Onelink support; Stripe tells us when it does.
8. Your rights
Under UK data protection law, and the EU GDPR if you live in the EU, you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we no longer need it;
- restrict or object to processing, including any processing based on our legitimate interests;
- receive the data you gave us in a portable format;
- withdraw consent at any time where we rely on it, for example for the newsletter;
- not be subject to solely automated decisions with legal or similarly significant effects.
To use any of these rights, email admin@onetake.digital. We may ask you to confirm your identity. There is no charge and we respond within one month, extendable by two months for complex requests, in which case we will tell you. Every marketing email we send carries an unsubscribe link.
9. AI generation: what you should know
- Your inputs are sent to AI providers. To build a reel we send your script, prompts, storyboard frames and any uploaded brand marks to the providers named in section 5. They process them to produce the output and return it to us. Under our contracts they act as our processors and do not use your inputs or outputs to train their models.
- The actors are synthetic. Every face and voice in our libraries is AI-generated. None depicts a real person.
- Do not put real people in without permission. If you upload an image or describe a real, identifiable person, you must have their permission. Generated content that depicts an identifiable person is their personal data, and creating it without a lawful basis breaks our Terms and may break the law.
- Labelling. Videos made in OneTake are AI-generated. Our outputs carry machine-readable marking where the generation provider supplies it, and we ask you to label them as AI-generated when you post, which some platforms and the EU AI Act require.
- Filters. Our providers refuse some content, for example sexual or violent material. A refusal is not charged and does not count against you.
10. Security
All traffic uses HTTPS. Sign-in is handled by Supabase using signed tokens; we never hold your password. Your media is stored in private storage on our servers and served only through short-lived signed links tied to your account. Access to the database is restricted by row-level security so one account cannot read another's records. Spend caps are enforced on our servers before anything is built. Secrets are kept out of our code and off our public systems. If a breach ever puts your rights at risk we will tell you and the ICO without undue delay, and within 72 hours where the law requires.
11. Children
OneTake is for adults. You must be 18 or over to hold an account. We do not knowingly collect data from anyone under 18 and we close any account we find to be held by someone under age. If you think a child has given us data, email us and we will delete it.
12. Questions and complaints
Please raise anything with us first at admin@onetake.digital; we would like the chance to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you live in the EU you may instead complain to the data protection authority of the country you live in.
13. Visitors from the EU and the US
European Union. The EU GDPR applies to our EU customers. We have not yet appointed a representative in the EU under Article 27; until we do, EU customers can contact us directly at admin@onetake.digital. Transfers of your data out of the EU are covered by the safeguards in section 6.
United States. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use your data for profiling with legal effects. US state privacy laws set business-size thresholds that OneTake is well below; we nonetheless honour the rights in section 8 for everyone, wherever they live. Our marketing emails follow CAN-SPAM: every one identifies us, carries our postal address and lets you unsubscribe in one click.
14. Changes to this policy
We will post any changes here with a new date and version number. If a change materially affects how we use your data we will email account holders before it takes effect. Earlier versions are available on request.