Privacy Policy
Last updated: 26 October 2026
Mewvie Stream deals with two groups of people: our customers — the businesses and the people in them who hold an account — and the viewers who watch our customers' videos. This policy says what we do with the data of each.
1. Who is responsible
For customer accounts, this website and the Mewvie app, the controller is Nerqis Ltd, a company incorporated under the laws of the Republic of Cyprus, registration number HE487200, registered office at 7 Magdanis Street, Flat/Office 101, Kato Polemidia, 4152 Limassol, Cyprus.
For viewers, and for people who appear in customers' videos, the controller is the customer whose video it is; we process that data on the customer's behalf (section 4).
Questions and requests go to [email protected].
2. The short version
- We do not watch your videos. They are processed by machines to encode them and, when you ask, by AI; a person looks only when a video is reported.
- Viewers stay anonymous to us. We never learn a viewer's name or email; we turn their IP address into a country and do not store the address with their playback.
- No advertising. No advertising identifier, no advertising SDK, and we do not sell personal data or use it to train anybody's models.
3. Customers: what we collect, and why
3.1 Your account
Your email address and a password (stored only as a salted hash), or the identifier Apple or Google gives us when you sign in with them, together with your email if you allow it. If you turn on two-factor authentication, its secret and your recovery codes (as hashes). Your accounts, your role in each, and the sessions of your browsers and devices.
Basis: performance of the contract (art. 6(1)(b)).
3.2 What you put into the service
Your libraries, videos, posters, subtitle and audio tracks, collections, settings, API keys (as hashes and encrypted for signing uploads), webhook address and its delivery log.
Basis: the contract.
3.3 Credits and payments
Your balance and every change to it: hourly charges with the storage and traffic they are for, AI jobs, grants. For packs bought in the App Store or Google Play we receive from the store the product, the price, the currency, the store's identifiers for the purchase and any refund; the notifications the stores send us are kept as they arrived. Apple and Google handle the payment itself — we never see card or bank details.
Basis: the contract, and our obligation to keep accounting records (art. 6(1)(b), 6(1)(c)).
3.4 The app
For each device signed in to the app: a push token issued by Apple or Google, so that we can tell you a video is ready or the balance is low, and your notification settings. Error reports when the app crashes. Product analytics: which screens are opened and a few events — signing in, uploading a video, buying credits — linked to your account id, so we can see what works and what does not. Feedback you send from the app.
Basis: the contract for notifications; our legitimate interest in an app that works (art. 6(1)(f)) for errors and analytics.
3.5 Running the service
Technical records: server logs and traces with an IP address, the time and the address of a request, kept to find faults and stop abuse. Secrets — passwords, keys, tokens and signatures — are removed from them before they are written.
Basis: our legitimate interest in a service that works and is not abused (art. 6(1)(f)).
3.6 Reports
When someone reports content through mewvie.com/report, we keep the report: the reporter's name and email, the links, what they say, and, for a copyright notice, their signature and statements. A copyright notice may be forwarded to the customer whose video it concerns, as the law on notices expects.
Basis: our legal obligations as a host (art. 6(1)(c)), and our legitimate interest in keeping the service free of abuse (art. 6(1)(f)).
4. Viewers: what we process for our customers
When a customer's app or site plays a video through Mewvie Stream:
- The playback session — the customer gives us an identifier of its own for the viewer. We store it with the session, a hash of the session id, the video, when it started, and how long it was watched.
- The IP address — used at the moment of the request to apply the customer's access rules (allowed sites and countries), to limit the request rate, and to count traffic by country. Usage is stored by country, without the address.
- Forensic watermark — where the customer turns it on, each session plays a slightly different version of the video, so that a leaked copy can be traced back to the session it came from.
People who appear in a customer's video, and their voices, are processed as part of the video — encoded, and, if the customer asks for AI subtitles or a dub, transcribed and voiced. We act only on the customer's instructions; questions about this data are best sent to the customer, and we will help them answer.
5. Who we share it with
With the providers below, each under a data processing agreement, each acting only on our instructions.
| Provider | What it does | Where |
|---|---|---|
| DigitalOcean | Servers, database, video delivery | Amsterdam, the Netherlands (AMS3) |
| Cloudflare | Storage for videos and files (R2), and the network in front of our website | EU and outside the EEA |
| Modal | Encoding videos and packaging tracks | Outside the EEA |
| OpenRouter and the AI model providers it routes a request to | Transcription, translation and voices for AI features, only for videos a customer runs them on | Outside the EEA |
| PostHog | Product analytics of the app | EU |
| Google — Firebase Cloud Messaging; Apple — Push Notification service | Notifications to the app | Outside the EEA |
| Mailgun | Sending the emails we send to customers | Outside the EEA |
| Apple, Google | App distribution, sign-in, and payment for credits | Outside the EEA |
We also disclose personal data where the law requires it, and where it is necessary to establish or defend a legal claim. If we are compelled to hand something over, we tell the person concerned unless we are prohibited from doing so.
We do not sell personal data and we do not share it for advertising.
6. Transfers outside the European Economic Area
The providers marked above as outside the EEA are in the United States. Those transfers are covered by the European Commission's standard contractual clauses, or by the EU–US Data Privacy Framework where the provider is certified under it. You can ask us for the details at [email protected]. The database is hosted in Amsterdam, the Netherlands (AMS3).
7. How long we keep things
| What | How long |
|---|---|
| Videos, tracks and posters | Until the customer deletes them; the files go at once, a replaced audio track 48 hours later |
| An upload that was never finished | 1 day after its last progress |
| Playback sessions with the viewer identifier | 365 days; a session that was never played, 7 days. Then only totals per video and hour remain |
| Traffic by country in five-minute steps | 8 days; hourly totals stay for billing |
| Your account | Until you delete it — then your sign-in, name and email are removed at once |
| Balance, transactions and store purchases | As long as accounting and tax law requires |
| Reports, takedowns and their records | As long as needed to handle them and any appeal or claim, and to stop repeated abuse |
| Server logs and traces | A few weeks |
What deletion removes is set out in Account Deletion and Data Retention.
8. Your rights
You can ask for a copy of your data, for a correction, for deletion, for the processing to be restricted, for your data in a portable form, and you can object to processing based on our legitimate interests. How to use each of them is in Your Data Rights.
You also have the right to complain to a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection in Cyprus; you may also complain to the authority where you live.
9. Automated decisions
Mewvie Stream makes no decision about anybody that has a legal or similarly significant effect, and does not profile people. Suspension at a zero balance follows from the balance alone and ends when it is topped up; takedowns are decided by a person.
10. Children
Customer accounts are for adults acting for a business. We do not knowingly hold the account of anybody under 18, and delete it if we learn of one.
11. Security
Traffic is encrypted in transit with TLS. Videos are encrypted with a key of their own, given only to a live playback session; files are reached through signed links that expire. Passwords and API keys are stored as hashes, and secrets are encrypted at rest. Access to production systems is limited to those who need it, and every operator action is recorded.
If a breach occurs that is likely to result in a risk to people's rights, we notify the Office of the Commissioner for Personal Data Protection within 72 hours, the customers whose data is affected without undue delay, and, where the risk is high, the people affected.
12. Changes to this policy
If we change how we use personal data in a way that matters, we update this policy and tell customers in the dashboard and the app before the change takes effect. Where a change needs consent, we ask for it.
13. Contact
Nerqis Ltd, 7 Magdanis Street, Flat/Office 101, Kato Polemidia, 4152 Limassol, Cyprus.
Privacy: [email protected]
Supervisory authority: Office of the Commissioner for Personal Data Protection, Cyprus
Questions about this document?
Write to [email protected]. For anything about your own data, [email protected] reaches the same people faster.