Privacy policy

1. Controller and contact

MULTIPLE BRAND (FZE), licence 23149, SAIF Zone, Saif Office Q1-04-139/B, Sharjah, United Arab Emirates, controls account, security and billing processing. Privacy contact: privacidad@obrasmart.pro. For third-party content you provide for an organization, controller and processor roles depend on the processing and applicable agreement.

2. Data and purposes

We process names, emails, account and studio details, protected credentials and access records to manage and secure accounts. We process instructions, conversations, assistant memory, photos, characters, products, voices, files and outputs to create content, retain context and organize projects.

Payments generate records of amounts, credits, invoices, Stripe identifiers and, for authorized automatic top-ups, card brand and last digits. Full card details are entered in Stripe. Connections may include access tokens, social accounts, destinations, permissions, limits, schedules and publishing status. Technical IP, browser, error and operation records support security, diagnostics, abuse prevention and reconciliation.

3. Legal bases

Account management and execution of your instructions rely on contractual performance where appropriate. Billing and mandatory retention rely on legal obligations. Security, fraud prevention and incident handling may rely on balanced legitimate interests under applicable law. Processing requiring consent uses specific authorization, revocable for future use; accepting terms does not consent to marketing or every optional activity.

4. Providers and recipients

Necessary data is shared with hosting, database, AI processing and distribution providers. Service integrations include fal.ai for media generation and processing; Google and Anthropic for AI features according to configuration; ElevenLabs for voice when selected; Stripe for payments; and Upload-Post for publishing where enabled. Social platforms and agents you connect receive data needed for authorized actions and may act as independent controllers.

Not every provider participates in every job. Provider use and retention depend on the feature and applicable terms and agreements. We do not assert that all providers exclude training or retention in every mode. You may request the contractual provider list and relevant terms before providing confidential information. We do not publish your assets as our own commercial examples without additional authorization.

5. International transfers

The company is in the UAE; providers or agents may process data in other countries, including outside the EEA or UK. Transfers must rely on a valid mechanism where required by law, such as an adequacy decision or contractual safeguards with necessary additional measures. Ask privacidad@obrasmart.pro about recipients, countries and safeguards. Registration does not waive those requirements.

6. Retention and deletion

Assets and conversations are retained to support your work, recovery and library while your account exists and you have not requested deletion, subject to available quotas. Delete assets or request closure in the application. Closure blocks access; local erasure completes when outstanding operations, balances and payments are resolved. It does not mean every third-party copy disappears immediately.

Payment, authorization and ledger records needed for legal duties or claims are retained separately from creative content. Records relevant to UAE corporate tax must be kept for at least seven years after the end of the relevant tax period; other statutory periods may apply. Technical records and backups are retained according to security and recovery needs; ask for periods applicable to your data. We do not promise immediate erasure across all systems.

Local drafts and preferences may remain in your browser until deleted. Studio Pro deletion does not remove posts or copies already sent to social platforms or external agents.

7. Rights and complaints

Depending on applicable law, you may request access, correction, erasure, objection, restriction, portability, withdrawal of consent and transfer information. Write to privacidad@obrasmart.pro; we verify identity proportionately and respond within the applicable statutory period. You may complain to the competent authority in your country, including the relevant EEA or UK data protection authority where applicable.

If your business needs a data processing agreement, contact us before uploading client personal data. This policy does not replace that agreement or by itself establish all international transfer safeguards.

8. Minors, security and changes

Accounts are intended for adults aged 18 or older. Contact us about an underage account or unauthorized use of a minor’s likeness. We use access controls, separation between accounts and transport and secret protection measures; no system is risk-free. Do not share passwords or tokens. Policy updates carry a date; material changes will be communicated where required.