Privacy Notice

Who we are

Hydras is operated by Warner Bros. International Television Production Finland Oy (business ID 2551458-5, Tammasaarenlaituri 3, 00180 Helsinki, Finland).

For data protection enquiries: joona.kortesmaki@wbitvp.fi

Hydras is a service for businesses. This Notice is written for the people who use it on behalf of a customer organisation, and for anyone whose personal data may appear in the material a customer brings into the platform.

Our role, and yours

There are two different kinds of personal data here, and we hold a different role for each.

Account data — we are the controller. Names, work email addresses, roles and organisation membership of the people who use Hydras, plus the records of how the platform was used. We decide why and how this is processed.

Customer Content — we are a processor, and the customer is the controller. Scripts, case material, prompts, reference images, generated stills, video and audio. Our customer decides what goes in and why; we process it on their instructions. A data processing agreement is available on request.

Who decides, and who answers for it

The customer organisation chooses what enters the platform — the case material, the people named in a script, the reference images, the words in a prompt. We do not select, review or approve that material, and we do not review prompts before they are sent to a model. The customer is the controller and is responsible for having a lawful basis; our obligations are those of a processor acting on their instructions. Terms of Service Section 6 sets this out in full.

What this material can be

Depending on the production, Customer Content can include performers' photographs and footage, and, in documentary and factual work, the names of real people and their role in real events. The customer organisation is the controller of that material and is responsible for having a lawful basis for it, including where it concerns criminal offences or special categories of personal data.

Where a production is made solely for journalistic or artistic purposes, Section 27 of the Finnish Data Protection Act disapplies parts of the GDPR to that processing. Note also that the GDPR does not apply to the personal data of deceased people at all. Whether either applies to a given production is the customer's assessment as controller; we do not assess productions case by case.

Our Terms of Service ask customers not to put personal data into prompts or other inputs unless they need it for the production and are entitled to process it, and make the customer responsible for what they do include.

What we process

Account data: name, work email address, hashed password, organisation and role, and — for administrators — billing contact details. We receive account data from your organisation's administrator, who creates your account; you did not give it to us directly.

Customer Content: everything the customer or its users upload or generate in a project, as listed above.

Usage and technical data: feature usage, job and generation records, cost records per generation, error reports, performance metrics, session and access logs, IP address.

Billing data: the organisation's invoicing details and the invoices themselves. We do not take card payments and we do not process card details. Hydras is invoiced.

Why we process it, and on what basis

Where we process personal data inside Customer Content, the legal basis is the customer's, not ours; we act on their instructions.

We do not sell personal data.

AI providers

Generating a still, a video, a shotlist or a voiceover means sending the relevant prompt and reference material to a third-party AI provider, which returns the output. This is how the service works, and it means Customer Content — which may include images of, or text about, real people — is transmitted to those providers.

Our current providers are named, with their role and location, in our sub-processor list published at hydras.app. They include Kling AI Pte. Ltd. (video generation; data stored on servers in Singapore), alongside providers of text, image, voice and upscaling models. Each processes the material to produce the requested output, under its own terms and, where applicable, a data processing agreement with us.

What reaches them

A generation request carries the prompt and any reference material for that shot. Where a production concerns real people, the prompt can name them and describe what they did. The providers that receive the most are the text models used to prepare an episode, because they receive the case material itself.

What does not reach them

We do not send provider requests the identity of the person using Hydras — no account name, email address or user identifier is included in a generation request. Providers receive content, not who requested it.

Training

We do not use Customer Content to train, fine-tune or improve any model. We send Customer Content only to providers whose terms with us prohibit them from using it to train or improve their models; the clause for each is quoted in our Rights Matrix. If a provider's terms stop meeting that standard, we stop sending it Customer Content within 14 days and tell the customer (Terms of Service Section 5).

Retention by providers

Providers keep material for their own limited periods — typically to detect abuse — which we do not control. Where we know the period, we state it in the sub-processor list.

Other recipients

• Cloud infrastructure. Google Cloud hosts the platform, its database and its file storage in Finland and the European Union (Google Cloud's Hamina region and the EU multi-region), as our processor under Google's Cloud Data Processing Addendum.
• Email delivery, for transactional messages, notifications and invoices.
• Professional advisers and authorities, where we are required or permitted by law.

International transfers

Hydras is hosted in Google Cloud in Finland (Hamina) and the European Union. Some of our AI providers process material outside the European Economic Area — including the United States and Singapore. We do not present the service as one in which data never leaves the EEA, because that would not be true. What we do instead is this.

Where a provider offers a recognised transfer mechanism — an adequacy decision, the European Commission's Standard Contractual Clauses, or certification under the EU-US Data Privacy Framework — we rely on it, and the sub-processor list states which applies to each provider.

Kling AI (Singapore) offers no recognised transfer mechanism, and the sub-processor list says so. The request Hydras sends to Kling carries the prompt written for that shot and a start frame generated in Hydras. The customer, as controller, decides what the prompt contains and is responsible for it being lawful to send to Kling: by keeping personal data out of prompts for Kling video, or on a basis the customer holds, such as the exemption for journalistic or artistic purposes described below.

Where a production is made solely for journalistic or artistic purposes, Section 27 of the Finnish Data Protection Act disapplies the transfer rules to the extent that applying them would infringe freedom of expression or freedom of information. Whether that applies to a production is the customer's assessment as controller.

How long we keep it

Deletion propagates to backups on our rolling backup cycle, within 35 days. We say this explicitly because no system with backups deletes instantly.

Security

We use TLS for data in transit and encryption at rest. Access is role-based, limited to what a person needs, and logged. We review access and security arrangements regularly.

We do not currently hold SOC 2 or ISO 27001 certification. We say so rather than implying otherwise.

If a personal data breach occurs, our duty depends on our role in the data affected. For account data, where we are the controller, we notify the competent supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to people's rights, and notify the people affected where required. For Customer Content, where we are your processor, we notify you without undue delay after becoming aware, with what we know and what we are doing about it, so that you can meet your own 72-hour obligation as controller. We do not notify the authority on your behalf.

Your rights

If you are in the EU or EEA you have the right to access your personal data, to have it corrected or deleted, to restrict or object to processing, and to data portability. You may withdraw consent where processing is based on consent. We do not make decisions about you by automated means that have legal or similarly significant effects.

Contact joona.kortesmaki@wbitvp.fi. If your personal data is in Customer Content, the customer organisation is the controller and we will refer your request to them, and assist them in answering it.

You may complain to your national supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

Changes to this Notice

We will give at least 30 days' notice by email of material changes once the platform is generally available. See the beta notice at the top of this page for the pre-launch period.

Cookies

The Hydras application uses only the cookies required to sign you in, keep you signed in, and remember where you were in the app. We do not use advertising cookies, we do not use third-party analytics, and we do not track you across other websites.

Contact

Warner Bros. International Television Production Finland Oy
Tammasaarenlaituri 3, 00180 Helsinki, Finland
Business ID 2551458-5
joona.kortesmaki@wbitvp.fi