Privacy Policy

Effective Date: July 16, 2026

This Privacy Policy explains how Nura Studios, Inc. (“Nura Studios”, “we”, “us”, or “our”) collects, uses, shares, and protects information in connection with the Showcraft platform and related services (the “Service”). It applies to visitors to our website, registered account holders, and authorized collaborators.

This Privacy Policy is incorporated by reference into the Showcraft End User License Agreement (the “EULA”). Capitalized terms not defined here have the meanings given in the EULA, including “Account,” “Inputs,” “Generated Output,” “Credits,” “Privacy Mode,” and “Data Sharing Mode.”

Where Nura Studios processes personal data on behalf of a business customer (for example, a company whose employees use the Service), that processing is also governed by the Showcraft Data Processing Addendum (the “DPA”). In that scenario the business customer is the controller of the relevant personal data and Nura Studios is the processor; this Privacy Policy describes Nura Studios’ own privacy practices and the rights of individuals.

Summary — The Short Version

This summary is provided for your convenience only. It is not a substitute for the full Privacy Policy below, which governs.

• What Showcraft is. Showcraft is an AI media-generation platform. The prompts, images, audio, and video you submit (your “Inputs”) may contain personal information about you and about other people.
• Where your content goes. To generate content, we route your Inputs to third-party AI model providers. The categories of these providers are listed in Appendix C.
• No facial recognition. We do not run facial recognition or voice recognition on your Inputs, and we do not create or store biometric templates, faceprints, or voiceprints.
• AI training is your choice. Whether your content is used to train AI models depends on each project’s Privacy Mode / Data Sharing Mode setting (as described in Section 5 (AI Model Training — Privacy Mode and Data Sharing Mode)). Early Access has special rules described in Section 5.3 (Early Access — training during the Early Access phase); review that section before submitting content during Early Access.
• We do not sell your data. We do not sell your personal information and do not “share” it for cross-context behavioral advertising.
• Your rights. Depending on where you live, you can access, correct, delete, and export your information, and exercise other rights (Section 9 (Your Privacy Rights and Choices)). Contact us any time at support@nurastudios.com.

1. Introduction and Scope

1.1 Who we are. Nura Studios, Inc. is a Delaware corporation. Showcraft is a cloud-based platform that enables users to create, manipulate, and manage AI-assisted media (including images, video, audio, and supporting assets).

1.2 Who this applies to. The Service is intended only for individuals who are at least eighteen (18) years of age. We do not knowingly collect personal information from anyone under 18. See Section 11 (Children).

1.3 Scope. This Privacy Policy covers information we process through the Service, our website, and our communications with you. It does not cover the independent practices of third parties, including third-party AI model providers, payment processors, or any website or service we link to. Your use of third-party AI models through the Service is also subject to those providers’ own privacy policies and terms (see Section 6.1 (Third-party AI model providers) and Appendix C).

2. Information We Collect

2.1 Information you provide to us.

• Account Data. Your name, email address, password or other authentication credentials, and account settings, including your selected Privacy Mode / Data Sharing Mode defaults.
• Inputs. The text prompts, images, audio, video, reference files, configurations, and other materials you submit to the Service to generate or manipulate content. Inputs may contain personal information — including photographs and audio recordings of identifiable individuals — relating to you or to other people.
• Generated Output. The images, video, audio, and other content the Service produces in response to your Inputs, together with associated metadata (including, where supported, C2PA Content Credentials embedded for provenance).
• Project data. Project names, the contents of projects, comments, sharing settings, the identities of collaborators you invite, and each project’s Privacy Mode / Data Sharing Mode setting.
• Payment information. When you purchase Credits, payment is processed by our third-party payment processor. We receive limited billing details (such as the last four digits of a card, billing address, and transaction status) but do not store full payment card numbers.
• Communications. Information you provide when you contact us for support, submit an appeal, exercise a privacy right, or otherwise correspond with us.

2.2 Information we collect automatically.

• Usage data. Generation history, Credits consumed, models and features used, storage consumed, and other activity on the Service, such as page views, clicks, and other feature interactions.
• Device and technical data. IP address, browser type, operating system, device identifiers, language settings, referring URLs, and similar technical information.
• Cookies, analytics, and similar technologies. We and our service providers use cookies, third-party analytics, software development kits (SDKs), tag managers, and similar technologies as described in Section 12 (Cookies and Tracking Technologies).
• Log and security data. Server logs, access timestamps, and information generated by our security and abuse-prevention systems, including content-moderation review records.

2.3 Information from third parties.

We may receive information about you from our payment processor (transaction confirmations and fraud signals), from identity or single sign-on providers if you choose to authenticate through them, and from analytics and security vendors. We combine this with the information described above to operate and protect the Service.

3. Personal Information in Your Inputs

3.1 Inputs may contain personal information. Because Showcraft is a media-generation tool, Inputs you submit — such as photographs, video, and audio — may contain personal information about you or about other people, including photographs and audio recordings of identifiable individuals. You are responsible for your Inputs, and you represent and warrant that you have all rights, permissions, consents, and other lawful bases necessary to submit them and to permit Nura Studios to process them in order to provide the Services and generate the Generated Output you request.

3.2 What we do not do. Nura Studios does not perform facial recognition, voice recognition, biometric matching, or identity verification on your Inputs, and does not create, derive, or store biometric templates, faceprints, or voiceprints. We process the content of your Inputs only to generate and deliver the Generated Output you request and to operate the Service.

3.3 Your responsibilities. You should not upload Inputs containing another person’s face, voice, name, or other personal indicia unless you have that person’s informed, written, and revocable-on-request consent for the specific use you are making, as required by EULA §7.4. You are responsible for ensuring you have a lawful basis to submit any personal information contained in your Inputs.

3.4 Third-party processing. Where you generate content with a model that requires processing by a third-party AI model provider, the personal information contained in your Inputs is transmitted to that provider to perform the generation — see Sections 6.1 (Third-party AI model providers) and 7 (International Data Transfers). We encourage you to review the relevant provider’s terms before submitting Inputs that contain other people’s personal information.

4. How We Use Information

We use the information described above for the following purposes:

• To provide, operate, and maintain the Service, including generating and storing Generated Output and enabling project collaboration;
• To process Credit purchases, calculate usage, and manage billing and storage;
• To create, authenticate, and administer your Account;
• To protect the security and integrity of the Service, prevent and investigate fraud and abuse, and enforce the EULA and the Acceptable Use Policy, including content moderation;
• To improve and develop the Service, including through de-identified, aggregated, statistical, and operational analysis that does not identify you or your Inputs;
• To train, fine-tune, evaluate, or otherwise improve AI models — but only as permitted by your Privacy Mode / Data Sharing Mode selection, as described in Section 5 (AI Model Training — Privacy Mode and Data Sharing Mode);
• To communicate with you about the Service, including service announcements, security alerts, support responses, and — where permitted — marketing (which you may opt out of);
• To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

5. AI Model Training — Privacy Mode and Data Sharing Mode

5.1 Your control. The Service offers two project-level data-handling modes, described in EULA §10. In Privacy Mode, Inputs and Generated Output are not used by Nura Studios or by any underlying third-party model provider to train, fine-tune, evaluate, or otherwise improve any AI model. In Data Sharing Mode, Inputs and Generated Output may be used for AI model training and improvement, consistent with the underlying provider’s terms and the EULA.

5.2 Default. When the project-level selector is available, new projects default to Privacy Mode. The mode in effect at the time a particular generation is processed governs how that generation’s data is handled.

5.3 Early Access. During the Early Access phase of the Service, the project-level Privacy Mode / Data Sharing Mode selector may not be available, or may be available only for certain models.

5.4 Custom training features. Certain user-directed features (for example, Style Training) use the data you upload to train or fine-tune a custom model on your behalf. Such custom models remain private to you and are made available only to the projects you assign them to.

5.5 Aggregated and de-identified data. Regardless of mode, we may collect, generate, and use de-identified, aggregated, statistical, and operational data about use of the Service for security, analytics, billing, capacity planning, and product improvement, provided such data does not identify you or your Inputs.

6. How We Share Information

We do not sell your personal information. We share information only as described below.

6.1 Third-party AI model Providers

To generate content, the Service routes your Inputs and Generated Output to third-party AI model providers. This is a core function of the Service: depending on the model you select (or the model the Service selects by default), your content is transmitted to, and processed on the infrastructure of, an external provider. Each such provider processes your data under its own terms of service and privacy policy.

These third-party AI model providers are located in jurisdictions around the world. Depending on the model selected, your Inputs — which may include personal information about you or others, such as photographs and audio recordings of identifiable individuals — may be transmitted to and processed by providers located in countries outside your own. These countries may have data-protection laws that differ from those of your home country.

The categories of third-party AI model providers to which the Service routes content are described in Appendix C. The specific providers within each category change from time to time as models are added or replaced. We encourage you to review Appendix C, and the terms of any provider whose model you choose, before submitting sensitive content. If you do not wish your content to be processed by a particular category of provider, you should select Privacy Mode (which restricts routing to providers that support a no-training commitment) and review the model’s provenance before generating.

6.2 Service providers

We share information with vendors that perform services on our behalf, including cloud infrastructure and hosting providers, our payment processor, transactional email and notification providers, and analytics, monitoring, and security vendors. These vendors are permitted to use the information only to provide services to us and are bound by contractual confidentiality and data-protection obligations. Our service providers are disclosed by category in Appendix C.

6.3 Legal, safety, and security disclosures

We may disclose information where we believe in good faith that disclosure is necessary to: comply with a law, regulation, legal process, or governmental request; enforce the EULA or the Acceptable Use Policy; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Nura Studios, our users, or the public. Where we are legally permitted to do so, we will endeavor to notify you of a legal request for your information.

6.4 Business transfers

If Nura Studios is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, information may be transferred as part of that transaction, subject to the commitments in this Privacy Policy.

6.5 With your direction or consent

We share information with collaborators you invite to your projects, and otherwise as you direct or consent. Project Owners and collaborators may be able to view Inputs and Generated Output within a shared project.

6.6 No sale; limited “sharing”

We do not sell personal information for money, and we do not “share” personal information for cross-context behavioral advertising, as those terms are defined under the California Privacy Rights Act. We do not use or disclose sensitive personal information for purposes other than those permitted under the CPRA without offering a right to limit such use.

7. International Data Transfers

7.1 Global processing. Nura Studios is based in the United States, and the Service relies on third-party AI model providers and other vendors located in multiple countries. As a result, when you use the Service your information — including the personal data contained in your Inputs — will be transferred to, stored in, and processed in countries other than the country in which you are located. These countries may have data-protection laws that differ from those of your home country.

7.2 Transfer mechanisms. Where we transfer personal data of individuals in the European Economic Area, the United Kingdom, or Switzerland to a country that is not the subject of an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum to the SCCs, or another lawful transfer mechanism, as further described in the DPA.

7.3 Third-party provider transfers. Third-party AI model providers to which the Service routes your content conduct their own international transfers under their own terms and transfer mechanisms. Nura Studios does not control, and is not responsible for, the independent transfer practices of those providers; we describe them in Appendix C so that you can make an informed choice before generating content.

8. Data Retention

8.1 General. We retain each category of personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, and in no event longer than is reasonably necessary for the disclosed purpose. The retention period for each category, or the criteria we use to determine it, is set out below.

• Identifiers (Account Data). Retained for as long as your Account remains active and for a limited period afterward to allow reactivation and to meet our security and legal obligations, after which it is deleted. See Sections 8.2 and 8.3.
• Commercial information (Credits, billing and transaction records). Retained for the period required by applicable tax, accounting, and audit law.
• Internet / network activity (usage data, generation history, logs). Retained for as long as needed to operate, secure, and improve the Service; the period is determined by operational need and by whether the logs are required for an ongoing security investigation or legal proceeding.
• Audio / visual / user content (Inputs and Generated Output). Retained for as long as your Account is active or until you delete the corresponding project, after which it is deleted in accordance with Sections 8.2 and 8.3.
• Sensitive personal information (account credentials). Retained only for as long as needed to authenticate you and maintain account security, and deleted when no longer needed for that purpose.

8.2 Account deactivation. If you deactivate your Account, your data enters a 30-day holding period during which you may request reactivation or a bulk export by emailing support@nurastudios.com. After 30 days, all Account data is permanently destroyed, except where retention is required by law.

8.3 Payment lapse. If your Account runs out of Credits or your payment lapses, a 90-day grace period applies. If payment is not restored within 90 days, all data stored under your Account is permanently destroyed, except where retention is required by law.

8.4 Moderation and security records. Records generated by our content-moderation, security, and abuse-prevention systems, and information needed to comply with legal obligations or to establish, exercise, or defend legal claims, may be retained for longer than the periods above.

Third-party providers. Data transmitted to third-party AI model providers is retained and deleted in accordance with each provider’s own retention practices, which are summarized in Appendix C and governed by each provider’s terms.

9. Your Privacy Rights and Choices

9.1 Choices available to all users

• Privacy Mode. You can control whether your content is used for AI model training using the project-level Privacy Mode / Data Sharing Mode selector, subject to the Early Access limitations in Section 5.3.
• Account information. You can review and update your Account information in your Account settings, and you can download your final video outputs and individual assets using the in-product download functions.
• Marketing communications. You can opt out of marketing emails using the unsubscribe link in those emails. We will still send you non-marketing, service-related messages.
• Cookies. You can manage cookies as described in Section 12.

9.2 California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to: (a) know and access the personal information we have collected about you; (b) delete personal information; (c) correct inaccurate personal information; (d) opt out of the “sale” or “sharing” of personal information; and (e) limit the use and disclosure of sensitive personal information. As stated in Section 6.6, we do not sell or share personal information as those terms are defined under the CPRA. We will not discriminate against you for exercising these rights. The categories of personal information we collect, the purposes for which we use them, and the categories of recipients are described in this Privacy Policy and summarized in Appendix A.

9.3 EEA, UK, and Switzerland (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to: access your personal data; request rectification or erasure; restrict or object to processing; data portability; the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you; and, where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local data protection supervisory authority. The legal bases on which we process personal data are summarized in Appendix B. Where Nura Studios processes personal data as a processor on behalf of a business customer, you should direct your requests to that business customer (the controller); we will assist the controller as required by the DPA.

9.4 How to exercise your rights

To exercise any of the rights described above, or to ask a question about this Privacy Policy, email us at support@nurastudios.com. We will respond within the timeframes required by applicable law (for example, 45 days under the CPRA, extendable as permitted; and one month under the GDPR, extendable as permitted). We may need to verify your identity before fulfilling a request. You may use an authorized agent to submit a request on your behalf; we may require your signed permission and confirm the request with you directly. If we decline a request, you may appeal by replying to our response.

10. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit and at rest, access controls applying the principle of least privilege, multi-factor authentication for administrative access, logging and monitoring, and personnel confidentiality obligations. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for notifying us promptly of any unauthorized use of your Account.

11. Children

The Service is intended only for individuals who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will delete it. If you believe a minor has provided us with personal information, please contact us at support@nurastudios.com.

12. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to operate, secure, and improve the Service. We use the following categories:

Strictly necessary cookies are required for the Service to function. For all other cookies, we ask for your consent through our cookie banner, and you can change your preferences at any time through the cookie-preferences link in the Service footer. We do not use cookies for cross-context behavioral advertising.

13. Third-Party Links and Services

The Service may contain links to, or integrate with, third-party websites and services, including third-party AI model providers. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third party before providing it with personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised Effective Date and, for material changes that adversely affect your rights, provide reasonable advance notice (such as by email or an in-product notice) before the change takes effect. Your continued use of the Service after the Effective Date of an updated Privacy Policy constitutes acceptance of the update.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, contact us at:

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• United Kingdom (UK)
• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/NuraStudios

Appendix A — California Privacy Disclosures

The following table summarizes the categories of personal information (as defined by the CPRA) that Nura Studios collects, the sources, the business purposes for collection, and the categories of recipients. We have collected each category within the preceding 12 months.

We do not sell personal information and do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information beyond the purposes permitted by the CPRA. The retention periods for each category are described in Section 8 (Data Retention).

Appendix B — EEA / UK Legal Bases for Processing

For individuals in the EEA, UK, or Switzerland, Nura Studios relies on the following legal bases under the GDPR:

• Performance of a contract — to provide the Service, process Credits, and administer your Account.
• Legitimate interests — to secure the Service, prevent fraud and abuse, conduct de-identified analytics, and improve the Service, where those interests are not overridden by your rights.
• Consent — for marketing communications, non-essential cookies, and use of content for AI model training in Data Sharing Mode. You may withdraw consent at any time.
• Legal obligation — to comply with laws, respond to lawful requests, and meet recordkeeping and reporting requirements.

Where Nura Studios acts as a processor on behalf of a business customer, the business customer is responsible for establishing the legal basis for the underlying processing.

Appendix C — Service Providers

Third-Party AI Model Providers

• Image generation models. Generate or edit still images from your Inputs.
• Video generation models. Generate or animate video from your Inputs.
• Audio models. Generate, transform, or otherwise process audio.
• Large language models (LLMs). Power text generation, agentic, and assistant features within the Service.
• Post-processing and upscaling models. Enhance, upscale, or otherwise refine Generated Output.
• Translation models. Translate text or other content within the Service.

Other Service Providers

• Payment Processors. Process your payments, manage billing, and track account credits.
• Identity / SSO Providers. Authenticate users and enable account creation, single sign-on login, and invitations.
• Analytics and Security Vendors. Measure how users interact with the Service and help detect, prevent, and respond to fraud, abuse, and security threats.
• Cloud Infrastructure Providers. Host, store, and process data to operate and deliver the Service.

← Back to home