Privacy Policy

1. Introduction

This Privacy Policy explains how Saga AI Research Labs ("Saga", "we") collects, uses, and protects your information when you use Dora — including the doravideo.com website, the Dora iOS app, and the Dora connector for Claude (collectively, the "Services").

2. Information We Collect

2.1 Account Information

When you sign up, we collect your email address (or Apple/Google ID token when you use single sign-on) and the display name your provider shares with us. If you use Apple's "Hide My Email", we store the relay address Apple gives us — we never see your real email.

2.2 Generation Inputs

Text prompts, reference images, audio, and reference videos you submit for generation are transmitted to our AI processing partner Kie.ai (kie.ai), which routes them to the underlying model providers (see section 4). Inputs are stored in our infrastructure for the duration of the generation job; outputs are stored on your account so you can view them in your gallery.

2.3 Device and Usage Information

We collect device model and OS version, app version, IP-derived country, and Apple identifier-for-vendor (IDFV) on iOS for analytics, abuse prevention, and crash reporting. We do not collect precise geolocation.

2.4 Payment Information

We do not store card numbers. iOS payments are processed by Apple via the App Store; web payments are processed by Stripe. We receive only the customer ID and event metadata needed to grant credits.

3. How We Use Your Information

• To provide, maintain, and improve the Services;
• To process payments and grant credits;
• To detect, prevent, and respond to abuse — including illegal content generation, payment fraud, and bot activity;
• To send service-related notifications (e.g. job complete, credit renewal, security alerts);
• To send marketing emails, only with your explicit consent and only about Dora itself.

We do not use your generation inputs to train our models, and we do not share them with third parties for advertising.

4. Third-Party Processors and AI Model Providers

Generation requests are forwarded to Kie.ai (https://kie.ai), which proxies the request to the underlying model provider you selected. Depending on the model, that provider is one of:

• ByteDance (SeeDance models)
• Google (Veo, Nano Banana)
• OpenAI (GPT-4o Image, ChatGPT 2 Image)
• Kuaishou (Kling, Kling Motion Control)
• xAI (Grok)
• ElevenLabs (Sound Effects)
• Saga (in-house Dora image model)

Other processors we use:

• Google Firebase — auth, database, cloud functions, file storage;
• Google Cloud — backend hosting (Firebase App Hosting, Cloud Run);
• Stripe — web payments;
• Apple — iOS payments via the App Store;
• RevenueCat — subscription state management;
• AppsFlyer — install attribution;
• Anthropic — only when you use the Dora connector for Claude (see section 5).

5. The Claude Connector

If you add the Dora connector to Claude (Anthropic), Claude transmits your generation request (prompt, optional reference image, model choice) to our MCP server at doravideo.com/mcp. The request is then processed identically to a request from doravideo.com or the iOS app. Anthropic's privacy policy governs what Claude does before the request reaches us; this policy governs everything after. You can disconnect the connector at any time from Claude's Settings → Connectors.

6. Data Sharing

We do not sell your personal data. We share data only with the processors listed in section 4, all of whom are bound by data processing agreements. We may disclose data when required by law, including to comply with subpoenas or to report suspected illegal content (e.g. CSAM) to relevant authorities.

7. Data Retention

• Account data — until you delete your account, plus 30 days.
• Generated content — stored on your account until you delete it or the account.
• Generation inputs (prompts, uploaded images) — retained for 90 days for abuse review, then deleted.
• Payment records — retained for 7 years to meet tax and accounting obligations.
• Crash and usage logs — retained for 90 days, then anonymized.
• Suspected-abuse evidence — retained as long as legally required.

8. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your account and personal data — Settings → Delete Account in iOS, or by emailing sagalabs@proton.me;
• Export your data in a machine-readable format;
• Opt out of marketing communications.

EU/UK (GDPR): The lawful basis for processing is (a) performance of our contract with you and (b) our legitimate interest in operating and improving the Services and preventing abuse. You may lodge a complaint with your supervisory authority.

California (CCPA): We do not sell personal information. You may request access or deletion. We will not discriminate against you for exercising these rights.

9. Data Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access to production systems is restricted to authorized personnel and protected by hardware-backed authentication. We run on Google Cloud and Firebase infrastructure.

10. International Data Transfers

Our infrastructure is hosted in the United States. If you access the Services from the EU, UK, or another jurisdiction, your data is transferred to and processed in the US under Standard Contractual Clauses or equivalent safeguards.

11. Children's Privacy

The Services are not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy. Material changes will be announced via in-app notice or email. Continued use of the Services after the effective date of the change constitutes acceptance.

13. Contact

For privacy or support questions, email sagalabs@proton.me.