Privacy Policy

This Privacy Policy describes how Constella App, Inc. (“Constella,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use our applications, websites, and related services, including Earshot (collectively, the “Services”). By using the Services, you acknowledge the practices described in this Policy. If you do not agree with this Policy, do not use the Services.

This Policy should be read together with our Terms of Service, which govern your use of the Services and contain important provisions regarding your responsibilities, limitations of liability, and dispute resolution.

1. The Nature of the Services: Please Read Carefully

Constella operates Earshot, a service that uses artificial intelligence to generate marketing, advertising, and social video content. Based on the scripts, prompts, and brand assets you submit, the Services can generate Output featuring wholly original, AI-generated personas, or, if you choose, an AI clone of your own face and/or voice built from a photo, video, or audio recording you submit (a “Clone”). See Section 2.3 for how we handle biometric data used to create a Clone. Where you choose, the Services can also publish Output to third-party social or advertising accounts you connect (“Connected Accounts”).

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, password or authentication credentials, and payment information (processed by our payment processors; we do not store full card numbers).
• Content you create: notes, tags, edits, queries, and organizational structures you build within the Services.
• Communications: messages you send to us, including support requests and feedback.

2.2 Content You Submit for Generation

When you use generation features, we collect and process, at your direction:

• Inputs, including scripts, prompts, product and brand assets, images, and other materials you submit to generate Output;
• Clone material, if you choose to create a Clone: the photo, video, or audio recording you submit for that purpose (see Section 2.3);
• Output, including the video, image, audio, and text content generated for you, and any Bio or captions generated alongside it;
• Connected Account data, including authorization tokens and account identifiers for any Connected Account, and metadata about content we publish there on your behalf.

We process this content as a service provider acting on your instructions, solely to generate and, where you direct, publish Output.

2.3 Biometric Information (Face and Voice Clones)

Creating a Clone requires us to process biometric identifiers and biometric information as defined under applicable law, including facial geometry and voiceprint data derived from the photo, video, or audio recording you submit (“Biometric Data”). Wholly original, AI-generated personas not modeled on any real person do not involve Biometric Data.

Consent. Before we process any Biometric Data, we require your explicit, affirmative consent through a dedicated step in the Clone-creation flow, separate from your acceptance of this Policy and our Terms of Service.

Purpose. We use Biometric Data solely to create, personalize, and maintain your Clone and to detect and prevent unauthorized use, impersonation, or deepfake misuse of the Services. We do not sell, rent, or trade Biometric Data, and we do not share it for cross-context behavioral advertising. We do not use Biometric Data to train generalized AI or machine-learning models without your separate, additional consent.

Retention and destruction. We retain Biometric Data only for as long as your Clone remains active on the Services. When you delete your Clone or your account, we permanently destroy the associated Biometric Data within 60 days, and in any event no later than three (3) years after your last interaction with the Services (or one (1) year for Texas residents, as described below).

Illinois residents. Under the Illinois Biometric Information Privacy Act (BIPA), we will not collect your Biometric Data without first providing this notice and obtaining your written release, and we will destroy your Biometric Data when the purpose for collecting it has been satisfied or within three (3) years of your last interaction with the Services, whichever is first.

Texas residents. Under the Texas Capture or Use of Biometric Identifier Act (CUBI), we destroy Biometric Data within a reasonable time, not to exceed one (1) year after the purpose for collecting it has expired.

Your rights. You may withdraw your consent and delete your Clone and associated Biometric Data at any time through your account settings or by contacting us at team@constella.app; withdrawal does not affect the lawfulness of processing before withdrawal.

Third-party likeness.If you submit a photo, video, or audio recording of someone other than yourself to create a Clone or other Output, you are responsible for obtaining that person's consent as required by Section 5.2 of our Terms of Service; we process that material solely on your instructions.

2.4 Information Collected Automatically

• Usage data: features used, actions taken, session duration, crash logs, and performance data;
• Device data: device type, operating system, browser type, IP address, and device identifiers;
• Cookies and similar technologies on our websites, as described in Section 10.

2.5 Information from Third Parties

If you connect third-party accounts, devices, or services, we receive the data you authorize those services to share with us.

3. How We Use Information

We use information to:

• Provide, operate, maintain, and improve the Services, including capture, transcription, indexing, search, and retrieval;
• Process transactions and manage your account and subscriptions;
• Provide customer support and respond to your requests;
• Send service-related communications (and, with your consent where required, marketing communications, which you may opt out of at any time);
• Monitor, detect, and prevent fraud, abuse, security incidents, and violations of our Terms of Service;
• Comply with legal obligations and enforce our agreements;
• Perform analytics and develop new features, using aggregated or de-identified data where practicable.

AI processing. The Services use machine-learning and generative-AI technologies, including third-party AI model providers acting as our processors, to generate and process your Content and Output. We do not permit third-party AI providers to use your Content, Output, or Biometric Data to train their generalized models, and we contractually restrict processors to processing data solely to provide services to us.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended (CCPA/CPRA).

4. How We Share Information

We share information only with:

• Service providers and processors performing services on our behalf (cloud hosting, AI/transcription processing, payment processing, analytics, customer support), bound by contractual confidentiality and data-protection obligations;
• Legal and safety recipients, where we reasonably believe disclosure is required by law, legal process, or governmental request, or necessary to protect the rights, property, or safety of Constella, our users, or the public;
• Corporate transaction parties, in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case this Policy will continue to apply to your information or you will be notified of changes;
• Parties you direct, when you use features that share or export your content.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

5. Data Retention and Deletion

• Your Content, Output, and account content are retained until you delete them or delete your account, subject to the timelines below.
• When you delete content or your account, we delete or de-identify associated personal information within 30 days, except where retention is required for legal compliance, dispute resolution, fraud prevention, or enforcement of agreements, or where data resides in encrypted backups that are purged on a rolling basis of up to 90 days.
• Derived data (such as embeddings and indexes) generated from deleted content is deleted on the same schedule.
• Biometric Data used to create a Clone follows the separate retention and destruction schedule in Section 2.3, not this Section 5.

6. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and logging. However, no system is perfectly secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials. In the event of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access / know the personal information we hold about you;
• Correct inaccurate personal information;
• Delete your personal information;
• Port your data in a machine-readable format;
• Opt out of marketing communications;
• Limit use of sensitive personal information (we use sensitive information only to provide the Services you request);
• Withdraw consent for processing your Biometric Data and delete your Clone (see Section 2.3);
• Non-discrimination for exercising your rights.

You may exercise these rights through your account settings or by contacting us at team@constella.app. We will verify your request and respond within the timeframe required by law. You may designate an authorized agent where permitted. If we decline a request, you may appeal by replying to our decision, and you may lodge a complaint with your local supervisory authority.

7.1 California Residents

California residents have the rights described above under the CCPA/CPRA. In the preceding 12 months, we have collected the categories of personal information described in Section 2 for the purposes described in Section 3, and disclosed them to the categories of recipients described in Section 4. We do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of doing so for consumers under 16. Biometric Data you submit to create a Clone is sensitive personal information under the CCPA/CPRA; we process it only as described in Section 2.3 and do not sell or share it.

7.2 EEA, UK, and Swiss Residents

Where the GDPR or UK GDPR applies: our legal bases for processing are performance of a contract (providing the Services), legitimate interests (security, improvement, communications), consent (where required, e.g., certain marketing or optional features), and legal obligations. You additionally have rights to object to or restrict processing and to withdraw consent at any time. International transfers are safeguarded by Standard Contractual Clauses or other approved mechanisms. An EU/UK representative is not currently required. Where you create a Clone, the Biometric Data involved is “special category data” under Article 9 GDPR, and our legal basis for processing it is your explicit consent, which you may withdraw at any time (see Section 2.3).

8. Children

The Services are intended for users 18 and older, consistent with our Terms of Service. The Services are not directed to children under 13 (or the higher minimum age in your jurisdiction), and we do not knowingly collect personal information, including Biometric Data, from them. If you believe a child has provided us personal information, contact us and we will delete it.

9. Third-Party Likeness in Your Content

Your inputs, Clone material, or Output may include personal information about people other than you (for example, a photo of another person, or their name, voice, or image). With respect to that information, you are the party who determines the purposes of collection, and we process it solely on your behalf as a service provider. See Section 2.3 for your consent obligations when submitting another person's likeness. If a third party contacts us about their likeness appearing in a user's account, we will direct the request to the relevant user where appropriate and reserve the right to remove content or suspend accounts that violate our Terms of Service or applicable law.

10. Cookies and Analytics

Our websites use cookies and similar technologies for authentication, preferences, and analytics. You can control cookies through your browser settings and, where required, our consent banner. We honor Global Privacy Control (GPC) signals where legally required.

11. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or in-app notice before the changes take effect. Your continued use of the Services after the effective date constitutes acknowledgment of the updated Policy.

12. Contact Us

For unresolved privacy concerns, EEA/UK users may contact their local data protection authority.