Privacy Policy

This Privacy Policy ("Policy") explains how Bastion Ventures LLC ("Movly", "we", "us", or "our") collects, uses, shares, and protects information about you when you use the Movly website, mobile applications, players, and related services (together, the "Service"). It also describes your privacy choices and the legal rights available to you.

By accessing or using the Service, you confirm that you have read, understood, and agree to the collection, use, and disclosure of your information as described in this Policy. If you do not agree, please do not access or use the Service.

1. Who We Are

Movly is operated by Bastion Ventures LLC, the data controller responsible for your personal information processed through the Service. Movly is a streaming platform that offers short-form video series.

2. Information We Collect

We collect information you provide directly, information generated automatically during your visits, and data from third parties.

(a) Information You Give Us

• Account and Profile Information: When you register for an account, we collect your email address and password (stored only in a salted, hashed form). If you customize your profile, we collect your username and your custom profile picture or avatar.
• User Content: Our Service allows you to create, upload, or share content, including text comments, profile indicators, or your interactions when liking and sharing our videos ("User Content"). User Content you make public may be visible to other users.
• Purchase History & Transaction Data: Records of the coin packs, episode unlocks, and series purchases you make, including the amount, date, and items unlocked. For web-based purchases, your billing address, bank, and payment card details are collected directly by our payment processor (Stripe); Movly does not store raw credit card numbers.
• Communications: Information you provide when contacting customer support or communicating with us regarding inquiries.

(b) Social Login Data Mapping

If you choose to log in to our Services using third-party single-sign-on services ("Social Login") such as Facebook Connect, Apple Sign-In, or Google, these platforms will authenticate your identity. In accordance with their terms, we may collect and record the following data from them to link your accounts:

• Your name
• Your Social Login user identification number (userID) or user name
• Your city, state, and country
• Your gender and birth date
• Your verified email address
• Your profile picture or its URL

(c) Information Collected Automatically

Even if you view videos anonymously as a guest, we automatically collect certain device and interaction metrics to ensure the Service functions:

• Visitor Identifiers: A randomly generated visitor identifier stored on your device so the Service can track progress and allow anonymous viewing. If you decide to buy credits or coin packs, you will be prompted to sign up for an account to secure your transactions.
• Device and Technical Information: IP address, browser type and language, hardware model, operating system type/version, device maker, screen size, time zone, and approximate location derived from your IP address.
• Usage & Mobile Analytics: Tracking which episodes are played, session lengths, completion rates, resource events (acquiring or spending in-app virtual currency), progression markers, and install timestamps.

3. How We Use Your Information

We use your data, individually or combined, for the following business and operational purposes:

• Provide and Maintain the Service: Streaming short-form videos, processing anonymous guest sessions, and saving video playback state.
• Account Management: Creating user profiles, restoring coins/purchases across devices via RevenueCat, the Apple App Store, or Google Play Store, and enabling Social Logins.
• Payment Processing: Facilitating transactions via Stripe (for web users) and native app store billing engines (for mobile app users).
• Communication & Engagement: Sending service confirmations, transaction receipts, security alerts, and push notifications or email marketing messages (which you can opt out of at any time).
• Security & Fraud Prevention: Enforcing our Terms of Service, protecting our systems against malicious hacking, cheating, or referral program abuse, and ensuring platform safety.

4. Tracking, Analytics, and Advertising SDKs

We use cookies, web beacons, SDKs, and pixel tags to optimize our operations, run marketing campaigns, and analyze user behavior. We partner with the following platforms:

(a) Analytics & Attribution

• PostHog: Used to analyze software performance, user journeys, and tool functionality.
• AppsFlyer: Used for mobile attribution to measure the performance of our marketing campaigns across various installation networks.

(b) Performance & Functional Tools

• RevenueCat: Used to manage server-side in-app purchases, track subscriptions, and seamlessly restore coin balances across platforms.
• OneSignal: Used to deliver push notifications and operational messages to your device (subject to your system-level notification permissions).

(c) Advertising & Pixels

• Google AdSense: Used to deliver display ads within our web applications.
• Meta Pixel, TikTok Pixel, and Snapchat Pixel: These tracking tags are embedded in our web and mobile frameworks. They share limited, pseudonymized information (such as a hashed email, device parameters, IP address, and video engagement actions) to measure how our external ads perform and to serve relevant Movly ad campaigns to you on social platforms.

You can manage your preferences or opt out of targeted ad structures using the "Limit personalized ads" toggle inside the Movly app settings, updating your browser cookie controls, or utilizing the opt-out mechanisms provided directly by Meta, TikTok, Google, and Snap.

5. How We Share Information

We share your information only under strict legal boundaries:

• Service Providers: Trusted companies processing data strictly on our behalf under confidentiality agreements (e.g., cloud hosting, payment networks like Stripe, database controllers, and email delivery suites).
• Content Licensors: We share aggregated, anonymized viewership logs to report performance figures to third-party content owners; no personal identification metrics are shared here.
• Legal Compliance: When required by law to comply with subpoenas, court orders, or governmental requests, or to defend our legal rights and the physical safety of our users.
• Business Transfers: As part of any company merger, corporate restructuring, financing, asset sale, or dissolution where consumer information transfers to an acquiring entity.

6. Data Retention

We retain personal information for as long as needed to fulfill the operational goals outlined in this Policy.

• Inactive Accounts: We will maintain user profile data for an inactive account for up to 5 years following your last login event. After 5 years of total inactivity, your profile will be automatically deleted or securely anonymized.
• Legal & Transactional Minimums: Notwithstanding account deletion, we will retain transactional, billing, and dispute-related records for a minimum of 5 years (or longer if mandated by tax, accounting, or federal corporate regulations) to satisfy legal compliance and corporate audit requirements.

7. Children's Privacy

The Service is intended strictly for individuals who are at least 13 years of age. We do not knowingly collect or solicit personal information from children under 13. If you are under 13, please do not use the app, sign up for an account, or submit any data to us. If we discover that we have inadvertently collected data from a child under 13, we will execute standard database protocols to delete that information as quickly as commercially practicable.

8. Appendix: International Data Transfers

Movly operates globally. Information collected about you may be transferred to, stored in, and processed across servers located in the United States or other global jurisdictions where Bastion Ventures LLC or its affiliates maintain facilities. These locations may have different data protection laws than your home country. Where required by regional frameworks (such as the GDPR), we utilize approved legal safeguards—including Standard Contractual Clauses (SCCs)—to protect your data cross-border.

9. Appendix: Regional Privacy Disclosures

(a) Additional Information for California Residents (CCPA/CPRA)

• Categories Collected (Past 12 Months): Identifiers (emails, IP addresses, unique visitor IDs); Commercial information (purchase logs); Internet network activity (video activity, tracking pixels); Geolocation data (approximate location via IP).
• No Sale of Data: We do not sell your personal information for monetary compensation. However, the integration of background cross-context behavioral ad frameworks (Meta, TikTok, Snap pixels) may be classified as "sharing" under California law. You may invoke your right to opt out of this sharing via your device settings or our in-app privacy panel.
• Your Rights: California residents have the right to Know, Access, Correct, and Request Deletion of their personal data, and to do so without discriminatory backlash. Contact us via the information in Section 10 to execute these choices.

(b) Additional Information for the EEA, UK, and Switzerland

Bastion Ventures LLC acts as the data controller for users in these territories. We process your data on the following legal bases:

• Performance of a Contract: Delivering video streaming, executing purchases, and managing your user account.
• Legitimate Interests: Securing the application from fraud, debugging platform code, tracking internal engagement analytics, and managing operational data logs.
• Consent: For promotional email marketing, push notifications, and targeted cookie deployment (which can be withdrawn at any time).
• Legal Obligation: Compliance with commercial tax processing, legal requests, and accounting regulations.

You have the right to access, rectify, delete, restrict processing, or port your data, as well as the right to file a formal complaint with your local Data Protection Authority.

10. How to Contact Us

For any questions, concerns, or requests regarding your data rights or to close an account, please reach out directly via email or physical mail:

Bastion Ventures LLC
Attn: Privacy Compliance Team
30 N Gould St #62429
Sheridan, WY 82801
United States
Email: [email protected]