Draft for legal review. Everything in square brackets is still to be confirmed.

Privacy policy

Last updated 10 October 2026.

1. Who we are

That Big Vision Studio (the studio) is provided by Loulla Ltd, trading as That Big Vision, a company registered in England and Wales (company number [number to be confirmed]), registered office 20 Wenlock Road, London [postcode to confirm], United Kingdom. We are the controller of the personal data described in this policy. Questions and requests: [Contact email: to be confirmed].

This policy is written for the UK GDPR and the Data Protection Act 2018, and for the EU GDPR where it applies to people in the EU. In this policy "GDPR" means both. [Our representative in the EU (GDPR Art. 27): to be confirmed in legal review.]

2. The short version

• Your data is stored in the EU, in Frankfurt (Vercel, region fra1).
• Video you edit stays on your device. Face grouping, speech-to-text and the voice run in your browser.
• AI features send only what the job needs to our AI provider, Anthropic. For AI review of a video that is the words and their times, never the footage.
• Instagram connects read-only. The studio can never post, comment or message, and disconnecting deletes the login and the Instagram numbers we keep.
• We use your data, including your Instagram results and what you make and keep in the studio, to improve your performance. Patterns are also combined anonymously across accounts to improve suggestions, never showing your posts or numbers to anyone else.
• We do not sell your data and we do not use advertising or analytics cookies.

3. What we collect and why

Your account

Your username, your role and a password stored as a scrypt hash (we never store the password itself). When you log in we set one signed session cookie that lasts 30 days. We use this to run your account and keep it secure.

What you make

The quotes and lines you add, the posts, reels and carousels you make (the quote, the look and the settings), captions and hashtags, the record of what you made, results you type in, saved looks and brand kits. For a brand kit, the studio reads the public website address you give it to collect colours, fonts and a logo. We use this to provide the studio and to show you what has worked.

Photos you upload

Photos in Our photos and in Creators are made smaller in your browser, and their location and camera data are removed before upload. They are stored privately and are shown only through time-limited links. Clips you add under My clips stay on your device.

Creators

For each creator you set up: their name, handle, niche, audience, voice, backstory and offer; the people you name in their photos (name, role, how they are related and a short note); and the carousels the studio writes. You decide what to enter. Only enter details about people who agreed to it.

Inspiration radar, if your plan includes it

The competitor accounts you add to a list. For those accounts we read public information only: post links, public counts, a short caption snippet and the link to each thumbnail, which the studio shows from the platform's own address. Nothing is downloaded or re-hosted. We use this to show the posts that are doing well against each account's own usual.

Instagram, if you connect it

See section 7.

3a. People we contact or work with

This part is for people who are not studio account holders: creators, brands and agencies we contact about the studio, the brands and creators we run content for, and the brands we work with on our own pages. Loulla Ltd (trading as That Big Vision) keeps a short business record about them.

What we keep. Your name, your business email and business phone number if we have them, your public handles (Instagram, TikTok), your company, your role and website, where we met or found you, and a record of our own contact with you: when we wrote, called or met, what we sent or agreed, and the next step. For clients and brand partners also what was agreed, dates of deliverables and posts, and invoice references (the invoices themselves are kept in our accounting system).

What we never keep. Home addresses, birthdays, ID or bank numbers, screenshots of private messages, lists of followers, likers or commenters, anything about health, religion, politics or sex life, or data from personal or private accounts.

Where it comes from. From you (you wrote to us, gave us a card or signed a contract), from someone who introduced us, or from your public business profile or website. We do not buy contact lists, we do not scrape social media, and we do not use enrichment services.

Why, and on what basis. To contact creators, brands and agencies about the studio and to follow up: our legitimate interest in business-to-business contact about a business product (GDPR Art. 6(1)(f)). To run work for clients and brand partners: the contract with you or your company (Art. 6(1)(b)). You can object to the first at any time and we stop (see "Do not contact" below).

Who sees it. Only Kevin and Lilo, the two people who run the studio. It is stored by our providers Vercel (hosting) and Supabase (database), in the EU, in Frankfurt (eu-central-1). We do not sell it or share it for advertising. We never send automated messages from it.

How long we keep it.

• If you did not reply, or told us you are not interested: 12 months after our last contact.
• If we talked but did not go ahead: 12 months after it ended.
• If you were a client or a brand partner: 2 years after the work ended. Invoices are kept in our accounting system for as long as tax law requires.
• If you asked us not to contact you, we keep only a scrambled code made from your email address or handle (a keyed hash that cannot be turned back into your details), so we do not contact you again by mistake.

Nothing is deleted silently or by a machine decision: records that reach these dates come up for review, and we delete them or note why we keep them a little longer. Backups of the database are replaced within the backup period.

Do not contact. Tell us and we stop. We mark you so that nobody contacts you again, or, if you also ask us to delete your details, we keep only the scrambled code described above.

Your rights. You can ask for a copy of what we hold about you (we send it as a file), have it corrected, have it deleted, or object to our contact. See section 12. Write to [Contact email: to be confirmed]. We answer within one month.

4. What stays on your device

• Video editing. The Edit tab works on the video in your browser and the footage is never uploaded. Speech-to-text runs in your browser. The speech model is downloaded once and kept by your browser.
• Face grouping. It is off until you switch it on for a creator, and it runs in your browser. The face data it computes (a numerical print of each face) is stored only in your browser. Our server keeps the names and notes you give people and which photos show the same person, so they appear on your other devices. Switching face grouping off deletes the people, names and notes, and the face data on the device. The photos stay.
• Voice. The studio's voice for animations runs in your browser.
• Photo editing happens in your browser before anything is saved.

5. AI features

AI writing, photo tagging, AI review of videos and AI stories are provided by Anthropic (Claude). Today these jobs run through the operator's own Anthropic setup. They will move to Anthropic's commercial API. What each job sends:

• Creators (photo tagging, carousels, ideas, photo requests): the selected photos through a time-limited link, the creator profile, the names and roles you gave people, the positions of faces in a photo (so words can be placed away from them) and your instructions. Face prints are never sent.
• Edit, AI review: the words of the video and their times only. They are removed from the job when it ends.
• Brands, brand ideas and AI stories in Animations: the brand kit or the prompt you write.
• Inspiration radar, Suggest competitors: the creator's niche, audience, voice, story and offer, or the brand's name, niche, audience, tone, offer and website, plus the accounts already on your list and any note you add.

AI output can be wrong. Review everything before you post it (see the terms).

6. Learning from results

When you connect Instagram or set up a creator or workspace for learning, the studio asks for your agreement to this:

We use your data, including your Instagram results and what you make and keep in the studio, to improve your performance. Patterns are also combined anonymously across accounts to improve suggestions, never showing your posts or numbers to anyone else.

• We record who agreed, when and to which version of the text.
• Patterns are combined only across accounts that agreed, and only once at least two have. A creator is only shown figures that include other accounts when at least five accounts contribute and none makes up more than half.
• The learning is recalculated each time it is used; nothing derived from other accounts is stored with yours.
• You can withdraw at any time by disconnecting Instagram or by writing to us. Withdrawing deletes the agreement and your data stops being combined at once.

7. Instagram (Launch Center)

• Connecting uses Instagram's official login with two read-only permissions: basic account details and insights. The studio can never post, comment or message.
• We keep the access token encrypted (AES-256-GCM), your account details (username, follower count) and the insights Instagram provides for your posts: for example reach, views, saves, shares, likes, comments, follows and average Reels watch time, read at day 1, 3, 7 and 30, plus your account's daily reach to followers and non-followers. Numbers are pulled once a day.
• Disconnect in Launch Center deletes the stored login, the account record and the Instagram numbers kept for it, and withdraws the learning agreement. Numbers you already saved into a post in Made stay with that post until you delete it.
• If you remove the studio in your Instagram or Facebook settings, Meta tells us and we delete your token, account record and Instagram numbers. Meta gives you a confirmation code and a link to a status page.
• Instagram connections for members open after Meta's app review.

8. Legal bases (GDPR)

• Contract: running your account, storing what you make and providing the features you use.
• Consent: learning from your results and combining patterns across accounts (section 6), connecting Instagram, and face grouping. Face grouping processes biometric data on your device and needs the explicit agreement of the people shown. You can withdraw consent at any time; this does not affect processing before you withdrew.
• Legitimate interests: keeping the studio secure, preventing abuse and fixing faults.
• Legal obligation: keeping billing records once paid plans exist.

9. Who receives data

We share data only with these providers, for these purposes:

We do not sell personal data and we do not share it for advertising.

10. International transfers

We are a UK company. We store your data in the EU, in Frankfurt, and UK law recognises the EU as giving personal data adequate protection. Some providers above may process data in the United States. Where they do, the transfer relies on the UK Extension to the EU-US Data Privacy Framework or the UK Addendum to the EU Standard Contractual Clauses, and for people in the EU on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. [The safeguard per provider is to be confirmed in legal review.]

11. How long we keep data

• Account and what you make: while your account is open. When you close it we delete your content and the data linked to it within [30] days.
• Photos: until you delete them, the creator or your account.
• Face data: in your browser until you switch face grouping off for that creator or clear your browser data.
• Instagram: until you disconnect or Meta asks us to delete it (section 7).
• Transcripts sent for AI review: removed when the job ends.
• The learning agreement: while it stands; withdrawing deletes it.
• Session cookie: 30 days.
• Billing records, once paid plans exist: as long as tax law requires, [6 years under UK rules, to be confirmed with the accountant].
• People we contact or work with: 12 months after the last contact if there was no reply, no interest or no deal; 2 years after the end for clients and brand partners; a scrambled code only for people who asked not to be contacted. Details in "People we contact or work with".

12. Your rights

Under the GDPR you can ask us to:

• see the personal data we hold about you (access);
• correct it;
• delete it;
• export it in a common, machine-readable format (portability);
• restrict or object to how we use it;
• withdraw consent at any time, for learning, Instagram or face grouping.

Write to [Contact email: to be confirmed]. We answer within one month. You can also complain to the UK regulator, the Information Commissioner's Office (ico.org.uk), or, if you live in the EU, to the data protection authority where you live.

13. Children

• You must be 16 or older to have an account.
• Photos of a child may be used only with the agreement of a parent or guardian. In Creators, a person marked as a child, or one the photo check sees as a child, needs the box "A parent or guardian agreed" ticked before their photos can be used in carousels.

14. Security

Passwords are stored as scrypt hashes. Session cookies are signed and expire. Instagram tokens are encrypted at rest. Photos are private and reachable only through time-limited links. Data is stored in the EU.

15. This website

This website sets no cookies and runs no analytics. Its animation library loads from jsDelivr, which sees your IP address. See the cookie notice.

16. Changes and contact

When we change this policy we update the date at the top, and we tell account holders about material changes before they apply. Contact: [Contact email: to be confirmed], Loulla Ltd, trading as That Big Vision, 20 Wenlock Road, London [postcode to confirm], United Kingdom.