Privacy Policy

The data controller responsible for processing your personal data is:

Pegasxs Studio
Zurich, Switzerland
support@pegasxs.com

This Privacy Policy is based on the Swiss Federal Act on Data Protection (DSG/nDSG), effective September 1, 2023. Where users are located in the European Union or European Economic Area, the EU General Data Protection Regulation (GDPR) also applies. Processing of your data is based on your consent (Art. 6(1)(a) GDPR), the performance of a contract (Art. 6(1)(b) GDPR), and our legitimate interests (Art. 6(1)(f) GDPR) where applicable.

We collect the following categories of personal data:

• Account data: Email address, password (hashed), and display name provided at registration
• Usage data: Video prompts you submit, renders you create, and timestamps of activity
• Payment data: Billing information processed by Stripe Inc. — we do not store card numbers
• Technical data: IP address, browser type, device information, and session data collected automatically
• Communication data: Any messages you send us via email or support channels

We process your data for the following purposes:

• Providing and operating the Pegasxs service
• Processing payments and managing subscriptions
• Sending transactional emails (account confirmation, receipts, service notices)
• Improving the quality and performance of our AI pipeline
• Complying with legal obligations
• Preventing fraud and abuse

We do not use your data for advertising, and we do not sell your data to third parties under any circumstances.

We use the following third-party services that may process your personal data:

• Supabase (database and authentication) — servers located in EU regions
• Stripe Inc. (payment processing) — governed by Stripe's own Privacy Policy
• Anthropic PBC (AI generation) — prompts you submit are sent to Anthropic's API
• Vercel Inc. (web hosting) — serves the frontend application
• Hetzner Online GmbH (server infrastructure) — VPS located in Helsinki, Finland (EU)

Each provider is bound by data processing agreements and applicable data protection law.

We retain your personal data for as long as your account is active or as needed to provide the service.

• Account data is retained until you delete your account
• Generated videos are stored for as long as your subscription is active
• Payment records are retained for 10 years as required by Swiss accounting law
• Technical logs are retained for 30 days

Upon account deletion, personal data is erased within 30 days, except where retention is required by law.

Under the Swiss DSG/nDSG and GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data
• Right to restriction: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at support@pegasxs.com. We will respond within 30 days.

Pegasxs uses essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics.

You can disable cookies in your browser settings, but this may prevent the service from functioning correctly.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encrypted connections (HTTPS), hashed password storage, and access controls. No system is completely secure — if you suspect a security incident, contact us immediately at support@pegasxs.com.

Some third-party providers we use (including Anthropic and Stripe) are based in the United States. Where data is transferred outside Switzerland or the EU/EEA, we ensure adequate protection through Standard Contractual Clauses or equivalent mechanisms recognised under Swiss and EU law.

Pegasxs is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on the platform. The date at the top of this page reflects the most recent update. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch, or with the supervisory authority in your EU member state if applicable.

support@pegasxs.com
pegasxs.com