Part A
Terms of Service
1. Who we are and what this agreement covers
Publab8 is operated by [TBC: exact registered name], a company registered in Israel under company number [TBC], with its registered office at [TBC] ("Publab8", "we", "us").
These Terms govern your access to and use of publab8.com and the Publab8 service. By creating an account or using the service you accept them. If you do not accept them, do not use the service.
We are not the seller of record. Purchases of credits are made from Paddle.com Market Ltd, which acts as the merchant of record. Your purchase is governed by the Paddle Buyer Terms and Paddle's refund policy, which prevail over these Terms on any question of payment, tax, invoicing or refund. These Terms govern your licence to use the service and what you may do with it.
Contact: [TBC: support@] for the service, [TBC: privacy@] for data protection matters.
If you use the service on behalf of an organisation, you confirm you are authorised to bind it, and "you" means that organisation. Section 11 then also applies.
2. The service
Publab8 turns text you submit into a short video. You supply written material; our system plans the scenes, writes the shot instructions, generates the imagery, narration and music, and assembles a finished video.
Text input only. In the current version you submit text. You cannot upload your own images, footage, audio or brand assets, and the service does not accept them. If we add that capability we will update these Terms before it goes live.
Output is machine-generated and variable. The same input will not produce the same video twice. We do not promise that any particular video will match a description, a reference, a style, a brand guideline or an earlier result. Previews and estimates shown before generation are indicative.
We may change, add to or withdraw features at any time. Where a change materially reduces a feature you have already paid credits to use, we will give notice under section 12.
3. Credits, purchases and refunds
The service runs on credits. You buy credits from Paddle and spend them on generations.
What a credit buys. A credit entitles you to a corresponding quantity of generation capacity, as shown in the estimate before you start a job. The number of credits a job costs is calculated from the length of the narration your input produces, not from the final runtime of the video or from the underlying compute. The estimate shown before you confirm is our good-faith calculation; the final charge is the one displayed on confirmation.
Credit expiry. [TBC: do credits expire, and after how long? If they expire, the period must be stated here and must be reasonable — an unreasonably short expiry is an unfair term for consumers in the EEA and UK.]
Failed and retried generations. Our system automatically retries a failed step before abandoning a job. [TBC: confirm policy] Where a job fails and no video is delivered, we re-credit the credits charged for that job. Credits consumed by internal retries that produce a delivered video are not re-credited. If a delivered video is unusable because of a fault on our side, contact support.
Refunds. Refunds are handled by Paddle under its refund policy. We will not refuse a refund Paddle has granted.
Consumers in the EEA and UK. You have a statutory right to withdraw from a purchase within 14 days. That right is lost once we have begun supplying the digital content, provided you expressly requested immediate supply and acknowledged losing the right. Paddle's checkout captures that consent. If you did not give it, your 14-day right survives and you may exercise it even if you have spent credits.
Consumers in Israel. Cancellation rights under the Consumer Protection Law, 5741-1981 apply as provided by that law and are not limited by this section.
Business customers. Credits purchased by a business are non-refundable except where required by law or where Paddle grants a refund.
Price changes. We may change credit prices and the credit cost of a generation. Changes apply to future purchases and future jobs only, never retroactively to credits you already hold. Where you are a consumer, we will give at least 30 days' notice before changing how many credits a generation costs.
4. Your input
You warrant that you have the right to submit what you submit. This is the most important obligation in these Terms. You confirm that, for every piece of text you put into the service, you either own it or hold the rights and permissions needed to use it this way, including the right to have it processed by our service providers.
Pasting a news article, a blog post or any other third-party writing you did not write and are not licensed to use is a breach of this section. So is submitting text containing a third party's personal data where you have no lawful basis to share it.
Licence to us. You grant us a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, adapt and transmit your input to the extent needed to operate the service, provide it to you, and comply with law. The licence lasts as long as we retain the material under section 6 of the Privacy Policy. It extends to our service providers, who are listed in the Privacy Policy, and to no one else.
We do not train on your content. We do not use your input or your generated output to train or fine-tune any model, and we do not sell it. Where a service provider's terms would allow them to use submitted content for model improvement, we configure our account to exclude it where the provider offers that option; where a provider offers no such option, that provider is identified in the Privacy Policy.
Indemnity. You will indemnify us against claims, losses and costs arising from your input, including claims of infringement, defamation or breach of data protection law.
5. Your output
What we give you. As between you and us, the video is yours. We assign to you whatever rights we hold in it and place no restriction on your use of it, commercial use included, once the credits for it have been paid.
What we cannot give you. Read this part carefully, because it is unusual and it is real.
Material generated by a machine without sufficient human authorship may not attract copyright at all in some countries, including the United States. We cannot tell you whether a particular video is protected by copyright, and we do not promise that it is. If it is not, you may be unable to stop others from copying it.
We also do not warrant that a video does not infringe anyone's rights. Generative systems can produce output resembling existing works, people or marks without anyone intending it. Before you publish, you are responsible for checking what you have been given.
No exclusivity. Another user submitting similar text may receive a similar video. You get no exclusive rights in a style, a look, a voice or a composition.
You indemnify us against claims arising from your publication or commercial use of a video.
6. Acceptable use
You may not use the service to produce, or attempt to produce, any of the following.
- Sexual content involving minors, or any sexualised depiction of a minor. We report this and terminate immediately.
- Other sexually explicit material.
- Content depicting or inciting violence, terrorism, or self-harm.
- Harassment, bullying, or content targeting a person or group with hatred on the basis of a protected characteristic.
- Depictions of a real, identifiable person presented as real, including synthetic likenesses of public figures, without that person's consent.
- Impersonation of a person, brand or organisation.
- Political or election material presented as authentic footage of a real event.
- Medical, legal or financial claims presented as fact without a basis.
- Material infringing a third party's copyright, trade mark, or other rights.
- Anything unlawful in Israel, in your own country, or in the country where you publish it.
You also may not resell raw access to the service, attempt to extract our prompts, models or system instructions, circumvent credit metering, or submit material designed to make the service produce prohibited output.
Enforcement. We may remove content, suspend a job, suspend an account or terminate it. We may do so immediately where the breach is serious.
Costs of your breach. Paddle may charge back, fine or withhold funds where a transaction breaches its own acceptable use policy. Where that arises from your breach of this section, you will reimburse us for any chargeback, scheme fine, penalty or withheld amount we incur.
7. AI transparency and limitations
Everything the service produces is artificially generated. The imagery, the voices, the music and the motion are synthetic. No scene was filmed and no person shown exists.
Marking. Videos we deliver carry machine-readable provenance metadata identifying them as AI-generated, as required by Article 50 of the EU AI Act. [TBC: confirm C2PA manifest is attached at render export before publication — see the engineering gap list.] You must not remove, strip or alter that metadata.
Your disclosure duty. If you publish a video in a context where the law requires you to tell the audience it is artificial — deepfake disclosure rules, advertising standards, electoral law, platform policies — that duty is yours. We mark the file; you label the post.
No reliance. Output may be factually wrong, internally inconsistent, or misleading, even where the input was accurate. The system can invent detail. Review every video before publishing it. Do not use the service as a source of fact, and do not publish output unchecked in any context where error causes harm.
Not for high-risk use. The service is not designed or permitted for use in medical, legal, financial, employment, credit, safety-critical or law-enforcement decision-making.
8. Sharing links
When a video is ready we give you a link to it.
Anyone holding that link can view and download the video. The link is not password-protected and we do not check who is using it. It is long and unguessable, so no one will find it by chance, but it offers no protection once it has been passed on, copied out of your browser history, captured by a corporate proxy, or expanded as a preview by a messaging app.
Treat the link as the video itself. Do not put it anywhere you would not put the file.
If you intend to generate material that is confidential, embargoed or commercially sensitive — an unannounced product, a results announcement, anything under NDA — understand this limitation before you do. [TBC: once authenticated, expiring download links ship, replace this section with the expiry period.]
You can ask us to delete a video at any time, which disables its link.
9. Availability, suspension and termination
Availability. We aim to keep the service running but do not guarantee it. We give no uptime commitment unless one is agreed separately in writing with a business customer. We may take the service down for maintenance, and we depend on third-party providers whose outages we cannot control.
Your termination. You may close your account at any time. Unused credits are dealt with under section 3 and the Paddle refund policy.
Our termination. We may suspend or terminate your account on notice, or immediately where you breach section 6, where we are required to by law, or where your use exposes us to legal or financial risk.
What happens to your content. On termination, access to your videos and their links ends. We delete your content on the schedule in section 6 of the Privacy Policy, or sooner if you ask us to. Download anything you want to keep before you close the account.
10. Warranties and liability
No warranties. The service is provided as is. To the fullest extent the law allows, we exclude all implied warranties, including fitness for a particular purpose, merchantability, non-infringement, and that the service will be uninterrupted or error-free.
What we are not liable for. We are not liable for indirect or consequential loss, lost profit, lost revenue, lost data, lost goodwill, or loss arising from your publication of a video.
Cap. Our total liability to you for all claims is limited to the greater of (a) the amount you paid for credits in the 12 months before the claim arose, and (b) USD 100.
What is never excluded. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.
Consumers. If you are a consumer, you keep all rights you have under the mandatory consumer law of your country, including rights to a remedy where digital content is faulty or not as described. The exclusions and the cap above apply only to the extent that law permits, and where it does not, they do not apply to you.
11. Business customers
This section applies where you use the service for business purposes. It overrides anything inconsistent elsewhere in these Terms, and the consumer protections above do not apply to you.
When you submit someone else's data, you are the controller. If you put material containing personal data into the service — your client's copy, your customer's story, a named individual's details — you decide why and how it is processed, and we process it on your instructions. In data protection terms you are the controller and we are your processor.
That relationship requires a written data processing agreement. Our DPA is at [TBC: URL] and is incorporated into these Terms for business customers. It sets out the subject matter and duration of processing, our confidentiality and security obligations, our use of sub-processors, how we assist you with data subject requests and breach notification, and what happens to the data when the contract ends.
Sub-processors. The providers listed in section 4 of the Privacy Policy are our sub-processors. By entering into the DPA you authorise them. We will give notice before adding or replacing one, and you may object.
Your responsibility as controller. You are responsible for having a lawful basis for the material you submit, for giving the required notice to the people it concerns, and for responding to their requests. We will assist you.
Non-standard terms. Enterprise terms, uptime commitments, security schedules, indemnity caps and audit rights are available by separate written agreement.
12. Changes, law and disputes
Changes. We may change these Terms. We will post the updated version with a new effective date. Where a change materially affects your rights and you are a consumer, we will give at least 30 days' notice by email and you may close your account before it takes effect. Continued use after the effective date is acceptance.
Governing law. These Terms are governed by the laws of Israel, and the courts of [TBC: Tel Aviv] have exclusive jurisdiction.
Consumers. That choice of law does not deprive you of the protection of the mandatory consumer law of the country where you live, and you may bring proceedings in your own country's courts.
EU and UK consumers may use the online dispute resolution platform at ec.europa.eu/consumers/odr.
General. If a provision is unenforceable the rest stands. Our failure to enforce a right is not a waiver of it. You may not assign these Terms; we may assign them on a sale of the business. These Terms, the DPA where it applies, and the Privacy Policy are the whole agreement between us about the service.
Effective date: [TBC]
Part B
Privacy Policy
1. Who we are
[TBC: registered name], company number [TBC], of [TBC: registered address], Israel, is the controller of the personal data described here, except where you are a business customer submitting your own clients' data — then you are the controller and we are your processor under the DPA.
This notice covers publab8.com and the Publab8 service. It does not cover Paddle's handling of your payment data; Paddle is a separate controller for that, and its notice is at paddle.com/legal/privacy.
Contact. Privacy questions and requests: [TBC: privacy@publab8.com].
Data protection officer. [TBC: assess whether Amendment 13 to the Israeli Privacy Protection Law requires us to appoint one, and whether GDPR Article 37 does. If appointed, name and contact go here.]
EU representative. Because we offer the service to people in the European Economic Area and we are not established there, we have appointed a representative under Article 27 GDPR: [TBC: name and EEA address]. You may contact them instead of us on any matter relating to your data.
UK representative. [TBC: required if we offer the service to people in the UK — name and UK address.]
2. What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Account data | Email address, name if given, password credentials, account settings | You |
| Input text | The written material you submit for generation | You |
| Derived prompts | The scene plans, shot descriptions and narration scripts our system writes from your input | Generated by us from your input |
| Generated assets | Imagery, voice audio, music and the assembled video | Generated by us |
| Generation trace | Job records, which provider handled which step, timestamps, credits charged, errors and retries | Our systems |
| Usage data | Pages viewed, features used, jobs run | Our systems |
| Technical data | IP address, browser and device type, approximate location derived from IP, cookie identifiers | Your device |
| Support correspondence | What you send us and our replies | You |
Payment data. We do not collect or store your card details. Paddle takes payment and holds that data as a separate controller. We receive confirmation of a purchase, the amount, and a billing country for tax purposes.
Personal data inside your input. If the text you submit mentions or describes identifiable people, their personal data is processed by us and by our providers. You are responsible for having the right to put it there — see section 4 of the Terms.
No image uploads. The service does not accept uploaded images, footage, audio or biometric data. We do not perform facial recognition and we do not create likenesses of specific real people from reference material, because no reference material is accepted.
3. Why we use it, and on what legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Running your account and generating your videos | Account data, input text, derived prompts, generated assets | Performance of a contract, Art. 6(1)(b) |
| Metering credits and preventing abuse of them | Generation trace, usage data | Performance of a contract; legitimate interests, Art. 6(1)(f) |
| Keeping the service secure and investigating misuse | Technical data, generation trace | Legitimate interests, Art. 6(1)(f) |
| Fixing faults and improving the service | Generation trace, usage data | Legitimate interests, Art. 6(1)(f) |
| Enforcing acceptable use and responding to legal claims | All categories as needed | Legitimate interests; legal obligation, Art. 6(1)(c) |
| Accounting, tax and statutory records | Transaction records | Legal obligation, Art. 6(1)(c) |
| Service emails you cannot opt out of | Account data | Performance of a contract |
| Marketing emails | Account data | Consent, Art. 6(1)(a) — withdrawable at any time |
We do not train on your content. Your input, your derived prompts and your videos are not used to train or fine-tune any model, by us or, so far as our contracts allow us to require it, by our providers. [TBC: confirm per provider — see section 4.]
We do not sell your data, and we do not share it with advertisers.
No automated decisions about you. Generating a video is automated, but it produces content, not a decision about you. Nothing we do has a legal or similarly significant effect on you within the meaning of Article 22.
4. Who else processes your data
Generating a video takes several specialist providers. Each one receives only what its step needs. This is the full list.
| Provider | What it does | What it receives | Country |
|---|---|---|---|
| OpenAI | Plans the scenes and writes the shot instructions and narration | Your input text in full, plus the plans written from it | United States |
| Anthropic | Same, where that step is routed to it | Your input text in full | United States |
| Generates reference imagery (Gemini) and video clips (Veo) | Derived prompts only | United States | |
| ByteDance (Dreamina / Seedance) | Generates video clips | Derived prompts only | People's Republic of China |
| Kuaishou (Kling) | Generates video clips on some tiers | Derived prompts only | People's Republic of China |
| ElevenLabs | Generates the narration voice and the music | The narration script | United States |
| Plainly Videos | Assembles the final video from the generated assets | The generated assets and the assembled video | [TBC: jurisdiction] |
| Amazon Web Services | Stores your content and runs our infrastructure | All stored content | United States [TBC: confirm S3 region] |
| Heroku (Salesforce) | Runs the application | Account and job data | [TBC] |
| Paddle | Takes payment, as a separate controller | Billing identity and transaction data | United Kingdom / United States |
Your input text is not sent to the clip generators. Only OpenAI and Anthropic, both in the United States, receive what you wrote. From it our system writes a short visual description of each shot, and only that description goes to Google, ByteDance or Kuaishou. Those providers never see the article, the account it came from, or who you are.
That said, a description written from text about an identifiable person may still concern that person. We treat derived prompts as personal data and protect them accordingly.
Provider terms on model improvement. [TBC: confirm for each provider whether its API terms permit use of submitted content for model training, and whether our account is configured to opt out. Any provider that reserves such a right and cannot be opted out of must be named here explicitly.]
We also use providers for email delivery, error monitoring and analytics. [TBC: name them.]
5. International transfers
We are in Israel. Our providers are in the United States, the People's Republic of China and elsewhere. Your data moves between these countries.
To Israel. The European Commission has decided that Israel provides an adequate level of protection for personal data. Transfers from the EEA to us need no further safeguard.
To the United States and other third countries. We rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where UK data is involved, together with technical and organisational measures.
To China — read this. Two of our video clip providers, ByteDance and Kuaishou, are established in the People's Republic of China. China has no adequacy decision from the European Commission or the Israeli Privacy Protection Authority. Transfers to them rely on Standard Contractual Clauses under Article 46 GDPR, supported by a transfer impact assessment which we review annually.
We have assessed that Chinese law may permit state access to data held there in ways that our contracts cannot fully prevent. Our principal safeguard against that is what we send rather than what we promise: these providers receive only a short machine-written description of a shot, with no account identifier, no contact details, no payment data, and not the text you submitted. [TBC: this statement is only true once the minimisation step is live — see the engineering gap list. Do not publish before it is.]
[TBC: routing decision. If we route European, UK and business traffic exclusively to Google's Veo, this section says so and the Chinese providers are disclosed as applying to other traffic only. If we do not, this section stands as written. This decision must be made before publication.]
Your rights here. You can ask us for a copy of the safeguards we rely on. Write to the address in section 1.
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Input text | 5 years from submission | Reproducing and supporting past work, handling disputes |
| Derived prompts and generation trace | 5 years from the job | Answering access requests, billing disputes, abuse investigation |
| Generated videos and assets | 5 years from the job | Giving you continued access to what you paid for |
| Account data | For the life of the account, then 5 years | Reactivation, disputes |
| Transaction and tax records | 7 years | Israeli accounting and tax law |
| Technical and security logs | 12 months | Security investigation |
| Support correspondence | 3 years | Handling recurring issues |
After these periods the data is deleted. [TBC: this requires automated lifecycle rules on our storage, including expiry of old versions and a defined backup purge window. Publishing this schedule without them makes it a promise we are not keeping.]
Backups. Deleted content persists in encrypted backups for up to [TBC: 30–90 days] before being overwritten. We do not restore deleted content from backups.
Earlier deletion. You can delete a video or your whole account at any time, and we act on that straight away rather than waiting out the periods above. Some records survive deletion where the law requires us to keep them — transaction records for tax, and records needed to defend a legal claim.
7. Your rights
You can ask us to do any of the following, free of charge. Write to [TBC: privacy@publab8.com]. We respond within one month, extendable by two months for complex requests, and we will tell you if we need the extension.
- Access. Get a copy of your personal data, including the full record of how a video was made: what you submitted, the prompts our system derived from it, which provider handled which step, when, and what it cost you in credits.
- Rectification. Correct inaccurate data.
- Erasure. Have your data deleted. This removes the input, the derived prompts, the generation trace and the videos, not only the account record.
- Restriction. Have us stop processing while a dispute is resolved.
- Portability. Receive your input text and your videos in a usable format, or have them sent to another provider where technically feasible.
- Objection. Object to processing we base on legitimate interests.
- Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect what we did before.
What an access request does not cover. You are entitled to your own data and to meaningful information about how the system reaches its result. You are not entitled to our system prompts, our scene-planning logic, our production templates or our source code, which are trade secrets and are protected from disclosure under Recital 63 GDPR.
If you are a business customer's end user, and the material about you was submitted by one of our business customers, that customer decides what happens to it. Send your request to them. If you send it to us we will pass it on and assist them.
Complaints. You can complain to a supervisory authority. In the EEA, the authority where you live or work. In the UK, the Information Commissioner's Office. In Israel, the Privacy Protection Authority. We would rather you came to us first.
8. Security
We encrypt data in transit and at rest, restrict internal access to those who need it, and require our providers to maintain appropriate security.
One limitation you should know about. Links to finished videos are not protected by a password or a login. Anyone who has the link can open the video. The link is long and random, so it cannot be guessed, but it offers no protection once it has been shared, forwarded, or picked up by browser history, a corporate proxy, or a messaging app that fetches previews.
We are telling you this plainly rather than leaving you to assume otherwise. Treat a video link as you would the video file. [TBC: replace this section when authenticated, expiring links ship.]
Breaches. If a breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and tell you where the risk is high.
No system is perfectly secure, and we cannot guarantee the security of data transmitted over the internet.
9. Where you live
Everything above applies to everyone. These additions apply by region.
EEA and UK. The GDPR and UK GDPR give you the rights in section 7 and the right to complain to a supervisory authority. Our EU representative is named in section 1. Where we rely on legitimate interests, we have carried out a balancing assessment and will share it on request.
Israel. The Privacy Protection Law, 5741-1981, as amended by Amendment 13 (in force 14 August 2025), gives you rights of access, correction and deletion. You may complain to the Privacy Protection Authority. You are not obliged to give us your data, but we cannot provide the service without the account data and the text you want turned into a video.
California. You may request disclosure of the categories and specific pieces of personal information we collect, request deletion, and request correction. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of. We will not discriminate against you for exercising these rights.
Everywhere else. We apply this notice as our global baseline. Where your local law gives you stronger rights, you keep them, and you can exercise them through the same contact address.
10. Children, cookies and changes
Children. The service is not for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
Cookies. We use cookies that are strictly necessary to run the service and keep you signed in. [TBC: if analytics or marketing cookies are used, they require consent in the EEA and UK, which means a consent banner and a separate cookie notice. List them here or confirm there are none.]
Changes to this notice. We will post any updated version with a new effective date. Where a change materially affects how we use your data, we will tell you by email before it takes effect.
Effective date: [TBC]