WeDaVinci

GDPR overview

Implementation is concrete rather than declaratory. WeDaVinci GmbH names itself as controller at its Munich address, gives privacy@wedavinci.ai as the contact point, and maps each purpose to a specific Article 6 basis: (b) for providing the platform, (f) for security and abuse prevention, (c) for legal obligations and (a) for newsletters and marketing. The full set of data subject rights is listed, including erasure, portability and withdrawal of consent, and the Bavarian supervisory authority BayLDA is named for complaints. Transfers outside the EEA rely on an adequacy decision, the EU-US Data Privacy Framework where applicable, or standard contractual clauses. Sub-processors are published by name with their purpose and data categories. The policy is dated August 2026. Notably, the site never applies the phrase "GDPR compliant" to itself.

Who owns the data?

The terms leave project content, prompts and uploaded media with the user, who must hold the rights to everything they upload and stays solely responsible for third-party rights. WeDaVinci states that it does not review generated output for infringement and owes no such review, so clearance before publication falls to the customer. On ownership of the result the FAQ is unusually direct: a user can obtain copyright in their trailer where they add sufficient creative contribution through their own prompts and direction, the underlying story already being theirs. Uploaded originals remain stored until the user deletes the file or the project concerned.

Reuse rights

Users can reuse what they generate without asking WeDaVinci for permission: nothing in the terms reserves a licence over customer output for the vendor's own purposes, and the copyright position set out in the FAQ assumes the customer exploits the result commercially. The practical limit is legal rather than contractual. WeDaVinci warns that generated material may resemble protected works, trademarks, designs, voices or the likeness of real people, and requires the user to obtain any consents, licences and clearances in advance. Compliance with labelling and transparency obligations for AI-generated content is placed on the user too, and the indemnity clause applies to any resulting infringement claim.

Data retention & training

Hosting summary

Hosting is described by region rather than by country. WeDaVinci states that it selects European regions for cloud services wherever possible, and that waiting list and newsletter data is held in a European Supabase region. Storage, authentication infrastructure and some AI features run on Amazon Web Services, including Amazon Bedrock; T-Systems International's Open Telekom Cloud provides cloud infrastructure, API hosting and technical logs. Model calls may go to OpenAI, Google Cloud Vertex AI, ElevenLabs or BytePlus depending on the feature selected. Stripe handles payments, Sentry may process error data, and user management runs on a self-hosted SuperTokens instance on the company's AWS infrastructure. The policy acknowledges that some providers or their sub-processors may process data outside the European Economic Area, or access it from there, and covers those transfers with an adequacy decision, the EU-US Data Privacy Framework where applicable, or standard contractual clauses with additional safeguards where appropriate. No individual hosting country is named; the company says the regions and mechanisms actually used are reviewed through its internal vendor documentation. The controller is established in Munich, so German and EU law govern.