Privacy Policy

1. Who we are

Stagefright.AI ("we", "us", "our") is an AI-powered public speaking coach operated by Ludo Roupell, trading as Stagefright.AI, a sole trader based in the United Kingdom. Our contact address is 55 Harfield Gardens, London, SE5 8DB.

The data controller for the personal data described in this policy is Ludo Roupell. This policy is governed by UK data protection law: the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

You can reach our privacy contact at privacy@stagefright.ai.

2. The data we collect, why, and our lawful basis

2.1 Video and audio recordings: special category (biometric) data

When you record a session, your device captures video and audio of you speaking. Because this can identify you from your face and voice, it is biometric data and is special category data under Article 9 of the UK GDPR, receiving the highest level of legal protection. You can choose to rehearse with audio only, without a camera. Your voice is still biometric data and is processed and protected in exactly the same way; choosing audio does not make it exempt.

• Your recording is transmitted securely to Google (via the Gemini API) solely to generate your coaching report, under terms that prohibit using it to train Google's models.
• If you do not save the session: your recording is stored only temporarily in our EU-based infrastructure (Supabase, Frankfurt, Germany) so we can run the analysis, and is automatically and permanently deleted within 24 hours if you do not create an account.
• If you save the session: your recording is stored in your account within our EU-based infrastructure (Supabase, Frankfurt, Germany). You can re-watch and permanently delete it from your account settings.

Lawful basis: your explicit consent (UK GDPR Article 9(2)(a) and Article 6(1)(a)), given by ticking the consent box before your camera or microphone is switched on. You can withdraw consent at any time by deleting your recording and/or account, or by emailing us. Withdrawal does not affect processing carried out beforehand.

2.2 Account information

If you create an account, we collect your email address and either a securely hashed password or a sign-in provider token, to authenticate you, link sessions to your account, and send service emails.

Lawful basis: performance of our contract with you (Article 6(1)(b)).

2.3 Session data

We store the coaching reports generated from your sessions: scores, written feedback, and metadata such as session length, date, and practice type.

Lawful basis: performance of our contract with you (Article 6(1)(b)).

2.4 Technical and usage data

To run the service securely we process your IP address (for abuse prevention and usage limits), browser and device type, and timestamps. We do not use third-party advertising or analytics trackers.

Lawful basis: our legitimate interests (Article 6(1)(f)) in keeping the service secure, available, and free from abuse.

2.5 No solely-automated decisions with legal effect

Your report is AI-generated feedback for personal development. It does not produce a legal or similarly significant effect on you under Article 22 of the UK GDPR.

3. Who we share your data with

We do not sell your data, share it with advertisers, or use it for any purpose other than providing and securing the service. We may disclose data where required by law.

4. International data transfers

Some processors are in the United States. We rely on the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework) where the recipient is certified, or otherwise the ICO's International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses. Data stored with Supabase remains in Frankfurt, Germany (EEA), permitted under the UK's adequacy regulations for the EEA.

5. How long we keep your data

On deletion or account closure, we permanently delete the associated personal data within 30 days, except where law requires limited retention.

6. Your rights

You have the right to be informed, to access, to rectify, to erase, to restrict, to data portability, to object to legitimate-interests processing, and to withdraw consent. To exercise any right, email privacy@stagefright.ai. We respond without undue delay and within one month (extendable by up to two months for complex requests).

7. How to complain

Please contact us first at privacy@stagefright.ai. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.

8. Cookies

We use a single, strictly necessary session cookie to keep you signed in. Strictly necessary cookies are exempt from consent under PECR, so we do not display a cookie banner. We do not use advertising, tracking, or third-party analytics cookies.

9. How we protect your data

We use encryption in transit (HTTPS), access controls, EU-based storage for saved data, and the principle of not storing biometric recordings unless you choose to save them.

10. Children

Stagefright.AI is not intended for or directed at anyone under 18, and we do not knowingly collect data from under-18s. If you believe someone under 18 has used the service, contact privacy@stagefright.ai and we will delete their data promptly.

11. Changes to this policy

If we make material changes, we will update the date above and, where you have an account, notify you by email. Continued use after changes take effect constitutes acceptance.

12. Contact

Data controller: Ludo Roupell, trading as Stagefright.AI, 55 Harfield Gardens, London, SE5 8DB
Privacy enquiries: privacy@stagefright.ai
Regulator: Information Commissioner's Office, ico.org.uk