Hydras
Privacy Notice
Last updated 10 September 2026
Beta notice. Hydras is in closed beta. Until the platform is generally available, this Notice may be updated as our practices are finalised, without the 30 days' notice described in Section 11. The version published here is always the current one.
01Who we are
Hydras is operated by Warner Bros. International Television Production Finland Oy (business ID 2551458-5, Tammasaarenlaituri 3, 00180 Helsinki, Finland).
For data protection enquiries: joona.kortesmaki@wbitvp.fi
Hydras is a service for businesses. This Notice is written for the people who use it on behalf of a customer organisation, and for anyone whose personal data may appear in the material a customer brings into the platform.
02Our role, and yours
There are two different kinds of personal data here, and we hold a different role for each.
Account data — we are the controller. Names, work email addresses, roles and organisation membership of the people who use Hydras, plus the records of how the platform was used. We decide why and how this is processed.
Customer Content — we are a processor, and the customer is the controller. Scripts, case material, prompts, reference images, generated stills, video and audio. Our customer decides what goes in and why; we process it on their instructions. A data processing agreement is available on request.
Who decides, and who answers for it
The customer organisation chooses what enters the platform — the case material, the people named in a script, the reference images, the words in a prompt. We do not select, review or approve that material, and we do not review prompts before they are sent to a model. The customer is the controller and is responsible for having a lawful basis; our obligations are those of a processor acting on their instructions. Terms of Service Section 6 sets this out in full.
Be clear about what this material can be
Hydras is used for documentary and true-crime work. Customer Content therefore routinely contains the names of real, identifiable people, the places and dates associated with them, and their role in real events. The customer organisation is the controller of that material and is responsible for having a lawful basis for it. We tell customers this plainly rather than describing their content as material that "may contain personal data".
Where a production is made solely for journalistic or artistic purposes, Section 27 of the Finnish Data Protection Act disapplies parts of the GDPR to that processing. Note also that the GDPR does not apply to the personal data of deceased people at all. Whether either applies to a given production is the customer's assessment as controller.
We do not allow personal data about living people everywhere. Our Terms of Service permit it only in projects the customer has declared as documentary, journalistic or artistic work, where naming real people is inherent to the production. In commercial, advertising and wholly fictional projects it is prohibited, and we apply technical measures to remove identifying details from generation requests.
03What we process
Account data: name, work email address, hashed password, organisation and role, and — for administrators — billing contact details.
Customer Content: everything the customer or its users upload or generate in a project, as listed above.
Usage and technical data: feature usage, job and generation records, cost records per generation, error reports, performance metrics, session and access logs, IP address.
Billing data: the organisation's invoicing details and the invoices themselves. We do not take card payments and we do not process card details. Hydras is invoiced.
04Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing and operating the platform | Performance of the contract with the customer organisation |
| Authentication, access control, security and abuse prevention | Legitimate interests — keeping the service and customers' material secure |
| Invoicing and collecting fees | Performance of the contract; legal obligation for accounting records |
| Support, troubleshooting and incident investigation | Performance of the contract; legitimate interests |
| Product analytics and improvement of the platform | Legitimate interests |
| Complying with law | Legal obligation |
Where we process personal data inside Customer Content, the legal basis is the customer's, not ours; we act on their instructions.
We do not sell personal data.
05AI providers
Generating a still, a video, a shotlist or a voiceover means sending the relevant prompt and reference material to a third-party AI provider, which returns the output. This is how the service works, and it means Customer Content — which may include images of, or text about, real people — is transmitted to those providers.
Our current providers are named, with their role and location, in our sub-processor list published at hydras.app. They include Kling AI Pte. Ltd. (video generation; data stored on servers in Singapore), alongside providers of text, image, voice and upscaling models. Each processes the material to produce the requested output, under its own terms and, where applicable, a data processing agreement with us.
What reaches them
A generation request carries the prompt and any reference material for that shot. Where a production concerns real people, the prompt can name them and describe what they did. The providers that receive the most are the text models used to prepare an episode, because they receive the case material itself.
What does not reach them
We do not send provider requests the identity of the person using Hydras — no account name, email address or user identifier is included in a generation request. Providers receive content, not who requested it.
Training
We do not use Customer Content to train our own models, and we select AI providers whose terms prohibit the use of customer content to train theirs. We do not control those providers and we do not give assurances on their behalf — what each one may do is governed by its own terms, which we review but do not write. Where we become aware that a provider's position has changed, we will change provider or tell you.
Retention by providers
Providers keep material for their own limited periods — typically to detect abuse — which we do not control. Where we know the period, we state it in the sub-processor list.
06Other recipients
- Cloud infrastructure. Google Cloud hosts the platform, its database and its file storage, as our processor under Google's Cloud Data Processing Addendum.
- Email delivery, for transactional messages, notifications and invoices.
- Professional advisers and authorities, where we are required or permitted by law.
07International transfers
Hydras is hosted in Google Cloud. Some of our AI providers process material outside the European Economic Area — including Singapore and the United States. We do not present the service as one in which data never leaves the EEA, because that would not be true.
Where personal data is transferred outside the EEA we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or an adequacy decision. The sub-processor list states, for each provider, where it processes and the mechanism relied on.
Some productions are processed for journalistic or artistic purposes. Section 27 of the Finnish Data Protection Act disapplies parts of the GDPR to such processing, including the international transfer rules where applying them would infringe freedom of expression or freedom of information. Whether that applies is the customer's assessment as controller, and we ask customers to tell us when they are relying on it.
Regardless of that, we minimise what leaves: generation requests are constructed to carry what the model needs to produce the output and not more.
08How long we keep it
| Data | Retention |
|---|---|
| Customer Content | For as long as the organisation's account is active. You can download material from the platform throughout, and may request an export during the term and for 30 days after termination — delivered within 30 days of the request. We delete it within 90 days of termination, and never before a requested export has been delivered |
| Account data | For the life of the account, and 90 days after it ends |
| Job, generation and technical logs | 12 months |
| Billing and accounting records | 6 years from the end of the accounting year, as required by Finnish accounting law |
| On request | We action deletion requests within 30 days |
Deletion propagates to backups on our rolling backup cycle, within 35 days. We say this explicitly because no system with backups deletes instantly.
09Security
We use TLS for data in transit and encryption at rest. Access is role-based, limited to what a person needs, and logged. We review access and security arrangements regularly.
We do not currently hold SOC 2 or ISO 27001 certification. We say so rather than implying otherwise.
If a personal data breach occurs that is likely to result in a risk to people's rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify affected customers without undue delay.
10Your rights
If you are in the EU or EEA you have the right to access your personal data, to have it corrected or deleted, to restrict or object to processing, and to data portability. You may withdraw consent where processing is based on consent.
Contact joona.kortesmaki@wbitvp.fi. If your personal data is in Customer Content, the customer organisation is the controller and we will refer your request to them, and assist them in answering it.
You may complain to your national supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
11Changes to this Notice
We will give at least 30 days' notice by email of material changes once the platform is generally available. See the beta notice at the top of this page for the pre-launch period.
12Cookies
The Hydras application uses only the cookies required to sign you in and keep you signed in. We do not use advertising cookies and we do not track you across other websites.
13Contact
Warner Bros. International Television Production Finland Oy
Tammasaarenlaituri 3, 00180 Helsinki, Finland
Business ID 2551458-5
joona.kortesmaki@wbitvp.fi