Privacy Policy

Introduction

This Privacy Policy explains how MotionKit (“MotionKit”, “we”, “us”) collects, uses, and protects your personal data when you visit motionk.it or use our service. We are committed to handling your data in compliance with the EU General Data Protection Regulation (GDPR).

By using MotionKit you acknowledge that you have read and understood this policy.

Who we are

The data controller is 28 bit S.R.L., a Single Member Company with registered office at Strada di Paderna 2, 47895 Domagnano, Republic of San Marino, registered under Economic Operator Code (C.O.E.) SM31527.

For any privacy-related question you can reach us at hello@motionk.it.

Information we collect

We collect only the data needed to operate the service. Specifically:

• Account data: email address and, if you sign in with a social provider, the basic profile information that provider returns to us.
• Authentication data: hashed passwords and session tokens, managed by our auth provider (Supabase).
• Content you create: template configurations, project metadata, and any image, video, or text assets you upload to render videos.
• Rendered output: the videos generated on your behalf and the parameters used to render them.
• Billing data: subscription status, customer identifiers, and the billing contact details our payment provider returns to us (name, city, state or province, postal code, and country). Payment instruments such as card numbers and tax identifiers are handled directly by Polar as Merchant of Record and never reach our servers.
• Technical data: IP address, browser, device, and OS information collected through server logs, analytics, and error monitoring.
• Session recordings: a recording of how you interact with the application interface after you sign in. See “Product analytics and session recordings” below.
• Advertising measurement data: the click identifier an advertising platform adds to the address of our website when you arrive from one of its ads, and the conversion events we send back to that platform. See “Advertising and conversion measurement” below.
• Communications: the content of any message you send us at hello@motionk.it.

How we use your information

We process your personal data for the following purposes and on the following legal bases (GDPR Art. 6):

• To provide the service: create your account, render and store your videos, and deliver the features you request (performance of a contract).
• To process payments and manage subscriptions through Polar (performance of a contract).
• To send transactional emails such as sign-in links, receipts, and service notifications (performance of a contract).
• To keep the service secure, prevent abuse, and debug issues (legitimate interest).
• To understand product usage in aggregate and improve MotionKit (legitimate interest).
• To record and review sessions inside the application, so we can find usability problems and reproduce defects (legitimate interest).
• To monitor errors and diagnose failures in the service (legitimate interest).
• To measure how well our advertising performs, and to attribute sign-ups and subscriptions to the campaign that generated them (legitimate interest). You can object to this at any time, see “Your rights” below.
• To comply with legal obligations, including tax and accounting requirements (legal obligation).

Product analytics and session recordings

Inside the application we use Mixpanel to understand which features are used and where people get stuck. Analytics data is processed on Mixpanel’s European infrastructure.

This includes session recordings: a reconstruction of your interaction with the interface, such as the pages you open and where you click. Recording starts only after you sign in, so visitors who are not signed in are never recorded. The content you type into form fields, including passwords and email addresses, is masked and never captured. We use these recordings only to improve the product, never to evaluate individuals.

We honour the “Do Not Track” setting of your browser. If your browser sends that signal, product analytics and session recording are disabled.

Advertising and conversion measurement

We advertise MotionKit on third-party platforms. To know which campaigns actually work, we measure conversions server to server rather than through advertising cookies in your browser.

This works as follows. When you reach our website from an ad, the platform adds a click identifier to the address of the page. We store that identifier in your browser’s local storage for up to 90 days and pass it along if you go on to create an account. We then send the advertising platform an event describing what happened, without ever sending it the content you create. Hashing, where mentioned below, means the values are converted with a one-way function before they leave our servers.

We use two advertising platforms: Meta (Facebook and Instagram) and Google (Google Ads). What we send to each is different, and we send Google strictly less.

To Meta we send: a page view when you visit our website, which includes your IP address, your browser user agent, and the click identifier if present; an account creation event, which includes your email address in hashed form, an internal account identifier, and the click identifier; and a subscription event, which includes the same identifiers plus the amount and currency of the subscription and the billing name and address details described above, all in hashed form.

To Google we send only two events, and only after you have chosen to create an account: an account creation event and a subscription event. Each contains your email address in hashed form and, if you arrived from one of our ads, the click identifier Google itself assigned to that click; the subscription event also carries the amount and currency. We do not send Google your IP address, your browser user agent, your name, or your billing address, and we never send it anything about people who only visit our website without registering.

We also tell Google explicitly that we do not have your consent to use this data for personalised advertising, so it may not be used to build advertising audiences or to retarget you.

Meta acts as an independent controller for the data it receives and may use it to measure and improve the delivery of advertising. We do not use this data to build profiles of you, and we do not use it to show you personalised or retargeted advertising.

The legal basis for this processing is our legitimate interest in understanding whether our advertising is effective. You can object at any time by writing to hello@motionk.it, and we will stop sending events relating to you.

Service providers and data sharing

We do not sell your personal data. We share it only with the service providers that make MotionKit work, each acting as a data processor or independent controller for its own portion of the processing:

• Supabase (authentication and database).
• Amazon Web Services (S3 storage for assets and rendered videos, Lambda for rendering).
• Netlify (hosting of our public website).
• DigitalOcean (hosting of the application).
• Polar (payments and subscriptions, acting as Merchant of Record and independent controller for billing and tax data).
• Plunk (transactional email delivery).
• Pirsch (privacy-friendly, cookieless website analytics).
• Mixpanel (in-product analytics and session recordings, on European infrastructure).
• Sentry (error monitoring; error reports include your IP address and the identifier of your account).
• Meta (advertising conversion measurement, acting as an independent controller; see “Advertising and conversion measurement” above).
• Google (advertising conversion measurement through Google Ads, acting as an independent controller; see “Advertising and conversion measurement” above).

International data transfers

We are established in the Republic of San Marino, and several of our providers are based outside the European Economic Area, in particular in the United States (for example AWS, Polar, Mixpanel, Netlify, DigitalOcean, Sentry, Meta, and Google). When personal data is transferred outside the EEA, we rely on the safeguards permitted under GDPR, such as the European Commission’s Standard Contractual Clauses, transfers to providers certified under the EU-US Data Privacy Framework, and additional technical measures where appropriate.

Data retention

We keep your personal data only for as long as it is needed for the purposes described above.

Account data and the content you create are retained while your account is active. If you delete your account, we remove your account data and rendered outputs within 30 days, except for information we must keep to meet legal obligations (for example invoices, which we retain for the period required by tax law).

Server logs, error reports, product analytics, and session recordings are kept for a limited period, according to the retention settings of the provider concerned, and are then deleted or anonymized.

The advertising click identifiers stored in your browser expire 90 days after they are captured, and are removed automatically. Events already sent to an advertising platform are retained by that platform under its own policy.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Request that we correct inaccurate or incomplete data.
• Request deletion of your data (“right to be forgotten”).
• Restrict or object to certain processing activities, including advertising measurement, session recordings, and product analytics. Write to hello@motionk.it and we will stop the processing you object to.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with a supervisory authority, in particular the one in the EU country where you live or work.

Cookies, local storage, and similar technologies

MotionKit uses very few cookies, but it does store some information in your browser’s local storage, which is covered by the same rules as cookies.

Strictly necessary cookies keep you signed in and are required for the service to work.

Beyond those, two things are stored in your browser and are not strictly necessary: the state used by our product analytics provider, Mixpanel, which is kept in local storage rather than in cookies; and the advertising click identifiers described above, one for each advertising platform, kept in local storage and expiring after 90 days.

Our website analytics provider, Pirsch, stores nothing on your device and does not track individual visitors.

Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), encryption at rest with our infrastructure providers, scoped access policies, and isolated per-user storage. No method of transmission or storage is 100% secure, but we work to keep your data safe and to notify you promptly if a breach affecting your data occurs.

Children

MotionKit is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@motionk.it and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, notify you through the service or by email.

Contact

If you have any questions about this Privacy Policy or want to exercise your rights, contact us at hello@motionk.it.