Privacy Policy

Last updated: 31 October 2026 · Effective: 31 October 2026

This policy explains what personal data Q-Star Drama (the "Service", at drama.q-star.co.uk) collects, why, and what you can do about it. The Service is operated by QSTAR AI LTD, 5th Floor, 167-169 Great Portland Street, London, W1W 5PF, United Kingdom ("we", "us"). We are the controller of the personal data described here.

1. Data we collect

• Email address. When you sign in with a one-time code, we store your email address to create and identify your account, together with the time the account was created and when you last signed in.
• Google sign-in data. If you choose "Continue with Google", Google shares your Google account identifier and your email address with us. We use only the basic sign-in scopes (openid, email, profile); we do not access your Google Drive, contacts or other Google data.
• Sign-in codes. Each one-time code is valid for 5 minutes. We store only a keyed cryptographic hash of the code (never the code itself), with an attempt counter.
• Age confirmation. After you first sign in we ask for your date of birth. We use it only to check that you are 18 or older. We do not store your date of birth; we store only the time you confirmed your age. If the date shows you are under 18, we delete the account straight away and place a cookie on your browser (see below) to stop it being re-created.
• Abuse-prevention records. To limit how often codes can be requested or tried, we keep short-lived counters. Your IP address is used only in the form of a keyed hash for this purpose; we do not store your IP address in plain form.
• Session data. When you are signed in we keep a session record (a hash of your session token, its expiry and a hash of your browser's user-agent string).
• Your content. Files you upload and the projects, characters, storyboards and videos you create or generate are stored in a private storage bucket and are kept separate per user account.

2. Cookies

We use only strictly necessary cookies:

• __Host-qs_session — keeps you signed in. HttpOnly and Secure. It lasts 30 days and is refreshed while you use the Service, but never beyond 90 days from when you signed in.
• __Host-qs_oauth — a short-lived cookie that protects the Google sign-in flow.
• __Host-qs_underage — set only if a date of birth under 18 was entered. It lasts 30 days and stops a new account being created from the same browser. It contains no personal details.
• __Host-qs_link — a short-lived (10-minute), signed cookie used only when you confirm, with an email code, that a Google account should be linked to an existing account.

We do not use advertising or analytics cookies, and the Service does not load third-party scripts.

3. How and why we use data

• To create your account, sign you in and keep you signed in (performance of our contract with you).
• To store and process your content so you can use the Service (performance of contract).
• To prevent abuse, fraud and automated attacks, and keep the Service secure (our legitimate interests).
• To meet legal obligations where they apply.

We do not sell your personal data and do not use it for advertising.

4. Service providers

• Cloudflare — hosts the website and application, and stores account data (Cloudflare D1) and your content (Cloudflare R2).
• Resend — delivers the one-time sign-in code emails. It receives your email address and the email content.
• Google — provides "Continue with Google" sign-in if you choose to use it.

5. International transfers

Your data is processed by Cloudflare, Resend and Google, which may handle it in the UK, the European Union, the United States or other countries where they operate. Where data leaves the UK or EU, we rely on the data transfer safeguards that these providers publish for their customers.

6. How long we keep data

• Sign-in codes and rate-limit counters are short-lived. Expired sign-in codes, rate-limit records and sessions are cleaned up periodically (the clean-up runs automatically in the background while the Service is in use, so removal may not be immediate).
• Sessions end when you sign out or when they expire (at most 90 days).
• Your account and content are kept while your account exists.

There is currently no self-service account deletion. To delete your account and content, email founder@q-star.co.uk from the address linked to your account and we will handle the request.

7. Your rights

Under the UK GDPR (and the EU GDPR where it applies) you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent where we rely on it. To exercise these rights, contact us at the address below. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

8. People under 18

The Service is only for adults aged 18 or over. It is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If we learn that we hold data about a person under 18, we will delete it. If you are a parent or guardian and believe your child has given us personal data, please email founder@q-star.co.uk.

9. Security

We use encrypted connections, hash sign-in codes and session tokens, keep content in private storage separated per user, and limit access to it. No system is completely secure, but we work to protect your data.

10. Changes

We may update this policy. We will change the "Last updated" date above, and for significant changes we will give notice on the Service or by email.

11. Data controller

The data controller is QSTAR AI LTD, a company based in the United Kingdom, 5th Floor, 167-169 Great Portland Street, London, W1W 5PF.

12. Contact

QSTAR AI LTD, 5th Floor, 167-169 Great Portland Street, London, W1W 5PF, United Kingdom · founder@q-star.co.uk