How we handle your data.

Who we are

This policy is published by Handsome Smartech Studio Ltd. (“Handsome Smartech”, “we”, “us”, “our”), an AI TVC production studio with offices in Shanghai (No. 88 Beijing Road West, Jing'an District) and Los Angeles (1208 Abbot Kinney Blvd, Venice, CA).

For the purposes of the EU/UK GDPR and the California Consumer Privacy Act (CCPA), Handsome Smartech is the data controller for personal information collected via this website. For client briefs and project material delivered to us under a signed SOW, we act as a data processor on behalf of the client.

Information we collect

We collect three kinds of information.

Information you give us

• Contact form submissions — name, email, company, phone, and the details of your brief.
• Newsletter subscriptions — email address and language preference.
• Career applications — résumé, portfolio links, and any optional information you include.
• Client materials — references, brand assets, talent likenesses and any other production input, governed by the SOW we sign with you.

Information collected automatically

• Device and browser metadata (user-agent, screen size, OS).
• Coarse geographic location derived from IP (country / city level only).
• Referrer URL, pages visited, and on-page interaction events for product improvement.

Information from third parties

• Email engagement events from our newsletter provider (opens, clicks).
• Form submissions enriched with company-firmographic data from public sources.

How we use it

We use personal information only for the purposes listed below. We do not sell or rent personal information to third parties under any circumstances.

Cookies & analytics

We use a small number of cookies and similar technologies. We do not use third-party advertising cookies, and we do not run retargeting pixels.

• Strictly necessary cookies — language preference, session state.
• Analytics — Plausible Analytics (privacy-respecting, no personal identifiers, no cross-site tracking).
• Performance — Vercel Analytics for Web Vitals only.

You can opt out of analytics at any time using the toggle in our cookie banner or your browser's Do Not Track signal — we honour both.

Sharing & processors

We use a small set of carefully chosen processors to run our business. Each is bound by a Data Processing Agreement (DPA) and only receives the minimum information they need.

We will share information with law enforcement only where legally required, and we publish an annual transparency report.

Brief & project material

The references, brand assets and creative material you send us are treated as confidential by default, even before we sign an SOW.

• Access is restricted to the producers, directors and engineers staffed on your project.
• Material is stored on access-controlled internal systems with audit logs.
• We will not use your project material as marketing or case-study content without your written approval.
• On request, we will delete all project material within 30 days of project closeout.

AI training disclosure

This is important and we want to be unambiguous about it.

• We do not train foundational AI models on client brief material. Period.
• Custom asset models trained on your packaging, talent or brand world are stored in isolated workspaces and used only for your project.
• The third-party AI APIs we use operate under enterprise agreements that prohibit using your inputs to train their models.
• Output content (the finished commercial) is owned by you per the SOW, including all rights for AI-generated frames.

Data retention

• Inquiry forms — 24 months from submission, or until you ask us to delete.
• Client project files — 5 years per industry standard, or as specified in your SOW.
• Newsletter records — until you unsubscribe.
• Job applications — 12 months after the role closes.
• Financial records — 7 years (tax compliance).

Your rights

Depending on your jurisdiction (EU/UK GDPR, California CCPA, Brazil LGPD, etc.) you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion (“right to be forgotten”)
• Object to processing or restrict its scope
• Withdraw consent at any time
• Request a portable copy of your data
• Lodge a complaint with your local data protection authority

Submit any request to privacy@handsome.studio. We'll respond within 30 days.

Security

We take the security of our systems seriously and apply the same care to client material that we apply to our own creative work.

• TLS 1.3 in transit, AES-256 at rest.
• SSO + 2FA on all internal systems.
• Quarterly access reviews and audit log retention.
• Annual third-party penetration testing.
• Incident response plan with 72-hour notification to affected clients.

International transfers

Because we operate from China and the United States and serve a global client base, your personal information may be transferred outside your country. We rely on Standard Contractual Clauses (EU SCCs / UK IDTA) and our processors' Data Processing Addenda to ensure equivalent protection.

Children

Our services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page always reflects the latest revision. Material changes will be communicated to active subscribers and clients by email at least 14 days before they take effect. Historical versions are available on request.

Contact us

For any privacy question, request, or complaint: