Momentum / cinemaOS
Private beta

Privacy / Private beta v1

Your work stays yours.

Effective 19 July 2026 for invited private-beta testers only

This notice covers the free, invitation-only cinemaOS private beta. A reviewed commercial notice will replace it before paid launch.

1. Controller and contact

The controller is Julien Kerknawi, trading as Momentum Studios, Belgian enterprise number 0648.946.826, VAT BE0648946826, registered establishment address Jules Van Biesbroeckstraat 156, 9050 Gent, Belgium. Privacy requests: privacy@mntm-studios.com. Support: support@mntm-studios.com.

2. Data we process

  • Account data: email address, password verifier, accepted legal versions and optional marketing consent.
  • Security data: hashed session/token identifiers, coarse request-security identifiers, device name, device public key fingerprint, sign-in and audit events.
  • Entitlement data: plan, trial and referral dates, education review status, active devices and signed licence generation.
  • Billing linkage: Stripe customer/subscription identifiers, plan, status and paid-through date. Momentum does not store full card details.
  • Support and optional crash data: messages you send and, only after separate opt-in, scrubbed technical error/crash information.

3. Data we do not use for licensing

We do not upload project names, media paths, footage, audio, transcripts, prompts, edits or creative output for licensing, anti-piracy, advertising or fraud scoring. Crash reporting is errors-only: no session replay, screen recording or project-content capture.

4. Purposes and legal bases

  • Contract: create and secure your account, deliver trials/plans, activate devices, issue entitlements, process billing and provide support.
  • Legitimate interests: prevent abuse, protect accounts, diagnose service reliability and maintain an audit trail, balanced against user rights.
  • Legal obligations: accounting, tax, fraud response and valid authority requests.
  • Consent: marketing communications and optional remote crash reporting. Consent can be withdrawn without affecting core account use.

5. Providers and recipients

Expected processors are Cloudflare (account portal, Worker, D1, private opt-in crash intake and release hosting), Stripe (billing and tax) and Resend (transactional email). No third-party crash-reporting SDK is planned for v1. The beta uses Cloudflare (EU-jurisdiction storage for account data and opt-in crash reports), Stripe Payments Europe Ltd (billing infrastructure, test mode only during the beta) and Resend (transactional email), each under its EU data-processing terms. We disclose data to authorities only where legally required and to professional advisers under confidentiality where necessary.

6. International transfers

Primary service regions should be selected in the EU where available. Account data and crash reports are stored in EU-jurisdiction infrastructure. Where a provider processes data outside the EEA, transfers rely on EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. Retention

Beta schedule: unused verification links 30 minutes; reset links 15 minutes; access sessions 15 minutes; rotating refresh sessions 30 days; expired security records pruned on a scheduled basis; billing/tax records kept for legally required periods; optional scrubbed crash reports 30 days; raw education evidence deleted 30 days after a decision or after 90 days if an application remains incomplete; education decision metadata kept for the account lifetime plus 24 months. This schedule is operative for the private beta; billing and tax records follow Belgian statutory retention periods.

8. Security

Passwords are salted, peppered and one-way derived. Bearer and one-time tokens are stored as keyed hashes. Device proof uses P-256 keys; offline entitlements use server-signed ES256 claims. Production uses encrypted transport, rate limits, human verification, least-privilege secrets and signed application/update releases. No system is risk-free; confirmed incidents are handled under the applicable notification rules.

9. Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent. Contact privacy@mntm-studios.com. Identity verification may be required. You may complain to the Belgian Data Protection Authority or the competent authority where you live or work. The Belgian Data Protection Authority is reachable at gegevensbeschermingsautoriteit.be; verified requests receive a response within one month.

10. Marketing and children

Transactional account and security messages are required to operate the service and are separate from marketing. Marketing requires affirmative consent and an unsubscribe route. cinemaOS is professional software and is not directed to children; you must be at least 18 years old to join the private beta.

11. Automated decisions and changes

Device, rate-limit and entitlement rules can automatically reject an action, but material education or abuse decisions receive human review. Updates are versioned, dated and presented again where law requires.