Privacy Statement

Dremito is operated by Dremito, Romania. We are the controller of the personal data described here.

Data protection contact: [email protected]. We have not appointed a Data Protection Officer; privacy requests are handled by the contact above.

From viewers:

• Account data: email address, profile name, optional profile picture, password (stored only as a salted hash).
• Membership and billing data: plan, payment status, billing country, invoices. Card details are handled by our payment provider and never stored by us.
• Viewing activity: titles watched, progress, ratings, My List, searches within Dremito, playback settings including the maturity limit you set.
• Device and technical data: device type, browser, IP address, playback quality and error logs.
• Your cookie choices and your language and active-profile choices (see Cookie preferences).
• Browser error reports: when something breaks in your browser we send a scrubbed error report to our own error-reporting service. It is sent without asking for consent, uses no cookies and no user or device identifier, and removes query strings, email addresses and similar personal data before sending; it contains the error, the page path and the app version. We rely on legitimate interest (Art. 6(1)(f)) to keep the service working.
• Analytics (only with your consent): if you accept analytics in Cookie preferences, page views are counted by our self-hosted, cookieless analytics service, without identifying you. Nothing is sent before you accept, and withdrawing consent stops it.

From creators, in addition:

• Identity and business data: name or company name, address, country of residence, tax identification number, VAT number, date of birth for individuals, and payout account details.
• Submissions: the files you upload, their metadata and provenance data, your declarations about the AI tools used and the rights you hold, and our review decisions.
• Earnings and payout records.

From anyone who writes to us:

• Contact and report forms: your email address, the topic, the title concerned and your message. If you report content, we keep the report and our decision.

We get most of this directly from you or from your use of Dremito. Our payment provider tells us whether a payment succeeded.

• To provide the service you subscribed to — account, streaming, saving progress and My List, service emails — performance of a contract (Art. 6(1)(b) GDPR).
• To review, publish and pay for creators' titles under the Creator Agreement — performance of a contract (Art. 6(1)(b)).
• To bill you, keep accounting records, report creator income to tax authorities where the law requires it, handle reports of illegal content and keep records of moderation decisions — legal obligation (Art. 6(1)(c)).
• To keep the service secure, prevent fraud and account sharing, fix errors, measure watch time for creator payouts and defend legal claims — legitimate interest (Art. 6(1)(f)).
• To recommend titles based on what you watch — legitimate interest (Art. 6(1)(f)); you can object at any time by switching personalised recommendations off for a profile. The main parameters are: what the profile watched, ratings, My List, similarity of genre, creator, format, AI tools and age rating, popularity and recency, and the profile's age limit (see the Terms of Use).
• Optional analytics and marketing cookies, and recommendation emails — your consent (Art. 6(1)(a)), which you can withdraw at any time in Cookie preferences or Account → Notifications.

Giving us account and payment data is necessary to have a membership; without it we cannot provide the service. Everything based on consent is optional.

We do not take decisions about you that are based solely on automated processing and that have legal or similarly significant effects. Automated checks on creators' submissions are always followed by a human decision.

We do not sell personal data. We use service providers that act on our instructions under data processing agreements:

• Cloud hosting and video delivery: Amazon Web Services (EU regions).
• Database and authentication: our own Supabase instance, hosted in the EU.
• Email delivery: Emailit.

We also share data with recipients that decide for themselves how to use it:

• Payments: Stripe, for payment data.
• Tax and other public authorities, courts and regulators, where the law requires it. For creators this can include reporting identity and income data to the Romanian tax authority.
• Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
• If you report content, we tell the creator what was reported and why, but not who you are, unless that is strictly necessary — for example where you claim that your own rights are infringed.

Creators see only aggregated statistics about their titles (views, watch hours, countries). They never see who you are.

We keep data in the European Economic Area where possible. When a provider transfers data outside the EEA, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses with additional safeguards. Ask us for a copy at the address above.

• Account and viewing data: while your account is active, then deleted within 30 days of account deletion.
• Billing and accounting records: for the period required by Romanian accounting and tax law (currently up to 10 years).
• Creator contracts, payout and tax-reporting records: for the term of the Creator Agreement and afterwards for the period required by tax law.
• Reports of content and moderation decisions: 3 years after the case is closed.
• Security logs: up to 12 months.
• Support messages: up to 3 years after the case is closed.
• Cookie choices: until you change them or clear your browser storage.

You can ask for access to your data, have it corrected or deleted, have its use restricted, receive it in a portable format, and object to processing based on legitimate interest. Where we rely on consent you can withdraw it at any time; that does not affect what was done before.

You can download your data and delete your account directly in Account → Privacy and data.

For any other request write to [email protected]. We answer within one month; in complex cases the law allows us to extend this by two more months, and we will tell you if we do.

You may also complain to the Romanian supervisory authority, ANSPDCP, or to the authority in the EU country where you live or work.

• ANSPDCP — Romanian data protection authority

Dremito is not directed at children. A paid membership requires you to be 18 or over, and we do not knowingly create accounts for anyone under 16. Younger viewers may watch under a parent's or guardian's account with a suitable maturity limit. If you believe a child has given us personal data, write to us and we will delete it.

Data is encrypted in transit, access is limited to staff who need it, and each viewer's data is isolated in the database so that only that viewer can read it. No system is perfectly secure; if a breach is likely to put your rights at high risk we will tell you without undue delay.

We will tell you by email and in the app at least 30 days before material changes take effect.