Momentum / cinemaOS
Beta 2 — interim

Privacy / Interim Beta 2

Privacy notice.

Interim Beta 2 notice — version privacy-beta2-interim-2026-07-26, effective 26 July 2026. It will be replaced by a separately versioned final notice after legal review. Interim status does not reduce GDPR rights.

1. Controller

Julien Kerknawi, trading as Momentum Studios, Belgian sole trader, enterprise number 0648.946.826, VAT BE0648946826, is controller for the Momentum account and cinemaOS service. Registered establishment: Jules Van Biesbroeckstraat 156, 9050 Gent, Belgium. Privacy contact: privacy@mntm-studios.com.

Momentum is established in the EEA and does not require an Article 27 representative. Its core activities do not involve large-scale special-category processing or large-scale regular and systematic monitoring, so no data protection officer is appointed. Privacy requests are handled directly by the controller.

2. Local processing and data we do not receive

cinemaOS projects, footage, audio, frames, transcripts, prompts, embeddings and bundled AI output stay on your Mac. Momentum does not receive them for product operation, analytics or model training. There is no advertising SDK, third-party analytics SDK or automatic crash-reporting SDK in the app.

3. Account and security data

We process email address, normalized email, password verifier, account and plan state, accepted legal versions and timestamps, referral records, education decision metadata, device public-key material, entitlement and session records, IP-derived security events and audit records. One-time tokens are stored as keyed hashes. We never store your password in readable form.

Purpose and legal basis: perform the account and licence contract; take requested pre-contract steps; protect the service and prevent fraud under legitimate interests; and meet tax, accounting, consumer and security obligations.

4. Billing and tax

Stripe processes card data, billing address, VAT number, payment, subscription, invoice and tax-calculation information. Momentum receives Stripe customer and subscription identifiers, plan, payment status, period end and event records, but not full card numbers. Processing is necessary for the contract and legal accounting and tax duties. Stripe may also act as an independent controller for its regulated payment and compliance activities.

5. Transactional email

Resend processes destination address, sender, subject, message content, delivery events and technical logs for verification, password reset, security, billing and service notices. Transactional messages are necessary to operate the account and are not marketing. Email delivery is configured through Resend’s Ireland sending region, while Resend states that account, email metadata, logs and API records may be stored in the United States.

6. Optional crash reports

Crash upload is currently disabled. If enabled later, it will require a separate explicit opt-in and send only the displayed, scrubbed diagnostic envelope to a private EU-jurisdiction bucket for no more than 30 days. Raw local reports can contain paths or exception text and will not be uploaded. Declining has no effect on account access.

7. Education applications and referrals

Education review may process institution, role, eligibility period and evidence chosen by the applicant. A human makes the material decision. Raw evidence is limited to authorized reviewers and deleted 30 days after decision, or after 90 days if incomplete; decision metadata is retained for the account lifetime plus 24 months. Referral codes and reward events are processed to operate the requested program and detect duplicate or fraudulent use.

8. Website, application and support

The account portal uses strictly necessary security and session mechanisms, including Cloudflare Turnstile. Cloudflare processes request, network and security data at its edge. We do not use advertising cookies. The app stores preferences and update state locally. If you contact support, we process your message, contact details and any files you deliberately provide to answer and document the request.

9. Processors, locations and safeguards

  • Cloudflare hosts the portal, Worker, EU-jurisdiction D1 account database, private EU-jurisdiction crash bucket and update distribution. Edge security and delivery can involve processing outside the EEA. See Cloudflare’s customer DPA and subprocessor disclosures.
  • Stripe Payments Europe Ltd provides payments, subscriptions, invoicing and Stripe Tax. See Stripe’s DPA and its incorporated subprocessor information.
  • Resend provides transactional email. See Resend’s DPA and subprocessor list.

Transfers outside the EEA use applicable adequacy decisions, the EU–US Data Privacy Framework where valid and applicable, or European Commission Standard Contractual Clauses with supplementary measures. We may disclose data to authorities where legally required and to professional advisers bound by confidentiality.

10. Retention

  • verification links: 30 minutes; password-reset links: 15 minutes;
  • access sessions: 15 minutes; rotating refresh sessions: 30 days;
  • security, webhook and audit records: only as long as reasonably needed for integrity, fraud defence and legal claims, then pruned or anonymized;
  • optional scrubbed crash reports, if enabled: 30 days;
  • education data: as stated in section 7;
  • billing, invoice and tax records: the period required by Belgian law;
  • other account data: deleted or irreversibly anonymized within 30 days of a valid deletion request, subject to legal retention and fraud-defence needs.

11. Security

Controls include salted and peppered password derivation, hashed bearer and one-time tokens, P-256 device proof, signed offline entitlements, encrypted transport, least-privilege secrets, rate limits, human verification, isolated beta and production databases, and signed application updates. Email links place one-time secrets in browser fragments to keep them out of portal request logs. No system is risk-free; confirmed incidents are assessed and notified as required.

12. Your rights

Subject to GDPR conditions, you may request access, correction, deletion, restriction or portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Email privacy@mntm-studios.com. We may verify identity and normally respond within one month, extendable where permitted.

You may complain to the Belgian Data Protection Authority at dataprotectionauthority.be or to the supervisory authority where you live or work.

13. Automated decisions, marketing and children

Device, rate-limit and entitlement rules can automatically reject an action, but material education and abuse decisions receive human review. We do not conduct profiling that produces legal or similarly significant effects. Marketing requires separate affirmative consent and an unsubscribe route. cinemaOS is not directed to children and account holders must be at least 18.

14. Changes and contact

Changes are published under a new immutable identifier and presented again where consent or notice is required. Questions and rights requests: privacy@mntm-studios.com. Support: support@mntm-studios.com. The corresponding terms are terms-beta2-interim-2026-07-26.