This policy explains what personal data Value Animate collects on valueanimate.com, in our emails, in Instagram messages and when you buy AI Animation Mastery, why we collect it, who else receives it, how long we keep it, and what rights you have.
1. Who is responsible
The controller is Media-z OÜ, Narva mnt 5, 10117 Tallinn, Estonia, registry code 17284786. For anything about your data, email privacy@valueanimate.com. We have not appointed a data protection officer, because the law does not require one for a business of our size and type.
2. The short version
- No advertising or tracking cookies and no tracking pixels. Our public pages load nothing from other companies: fonts and videos are hosted with the site.
- We set one cookie, only when a buyer signs in to the members page. Details in section 4.
- Our analytics count visits without cookies and show us only totals.
- Our database stores IP addresses only as salted hashes, never in plain form.
- We send you newsletters only after you confirm your sign-up. Buyers get emails about their purchase and, at most, three emails about the upgrade, with an unsubscribe link in each.
- We never sell your data.
3. What we collect and why
Visiting the site
Our host, Vercel, processes your IP address, browser details and the pages you request to deliver the site and keep it secure, and keeps short-lived server logs. We use Vercel Web Analytics to count visits. It uses no cookies and shows us only totals, such as pages, referring sites, countries and device types. It does not follow you across sites or from one day to the next. It also counts a few button clicks (for example “checkout started” or “form sent”), without anything that identifies you. If we ever switch on Plausible Analytics, an EU service that works the same way, we list it in section 5.
When you arrive through a link with campaign tags (UTM parameters, such as which reel you came from), the tags stay in the page address and in memory only. We store them only if you then sign up, buy or send a form, so we know which videos work.
Legal basis: our legitimate interest in running a secure site and knowing which content works (GDPR Art. 6(1)(f)).
The Script Kit, the launch list and our newsletter
Our email form appears as “Send me the Script Kit” and as “Join the launch list”. We note which one you used. When you sign up, you agree to this text (version kit-v3-2026-11-10):
“Email me the free Script Kit, the weekly build log, and news about the paid Value Animate course, including when it opens. Unsubscribe anytime.”
We then email you a link to confirm (double opt-in). Nothing else is sent until you click it. To show that you agreed, we keep a record of each sign-up, confirmation and unsubscribe: your email, the time (UTC), the consent text and its version, the version of this policy, the page you signed up on and the page that linked there, a salted hash of your IP address, your browser’s user agent and the campaign tags. A salted hash still counts as personal data, but it can’t easily be turned back into your IP address. We also use the hash to limit how often one connection can send the form, which stops abuse.
Legal basis: your consent for the emails (GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, and you keep the Script Kit. Keeping the consent record is our legal duty to prove consent (Art. 6(1)(c) with Art. 7(1)). Limiting abuse is our legitimate interest in security (Art. 6(1)(f)).
Instagram comments and messages
If you comment a keyword on one of our reels or send us a direct message, our automation tool ManyChat reads your Instagram username, profile ID and message, and replies with the link you asked for. We don’t get your email address from Instagram. Meta is responsible for Instagram itself, under its own privacy policy.
Legal basis: our legitimate interest in answering your request (GDPR Art. 6(1)(f)).
Buying AI Animation Mastery
You pay on a Stripe checkout page. We never see your card details. Stripe processes the payment for us and, for fraud prevention and its legal duties, as a controller in its own right.
When you start the checkout, we pass Stripe the campaign tags of your visit and which of our buttons you used. From Stripe we receive and store: your email, your name and country if you gave them, the order and payment references, which parts you bought, the amounts with tax and the currency you paid in, whether the sale ran through Link, and the campaign tags. Stripe records that you ticked the box at checkout. We get an internal email for each order, refund and payment dispute.
After checkout, our thank-you page asks Stripe which parts your order contains, so it offers the upgrade only to people who don’t have it yet. That check returns no personal details to the page. If you add the upgrade from there, our server copies your email from the finished checkout into the new one, so you don’t have to type it again.
Legal basis: performing the contract (GDPR Art. 6(1)(b)), our legal duty to keep accounting records (Art. 6(1)(c)), and our legitimate interest in knowing which content leads to sales (Art. 6(1)(f)).
Your members page
Buyers get a members page. For it we keep your email, your name, which parts you own and since when, your access status (for example after a refund), when you last signed in, and which access emails we sent. To sign in, you ask for a one-time link by email; the same email has a 6-digit code you can type instead. We store only a hash of each link and code, with its expiry and a salted hash of the IP address that asked for it. Signing in sets a cookie (section 4). Course files download through private links that work for one minute. We also save which lessons you marked done and where you stopped a lesson video, so you can continue on any device.
Legal basis: performing the contract (GDPR Art. 6(1)(b)) and our legitimate interest in keeping accounts secure (Art. 6(1)(f)).
Sharing your first script or reel
On the members page you can send us a link to your first script or reel, a note, and whether we may show it: not at all, without your name, or with your name or handle. We use it to see how buyers get on and to improve the lessons. We show it publicly, for example on Instagram or our sales page, only if you said yes, and only in the way you chose. If you share your first script and don’t own the upgrade yet, we may send the first upgrade email (below) a little earlier.
Legal basis: our legitimate interest in improving the course (GDPR Art. 6(1)(f)), and your consent for showing it publicly (Art. 6(1)(a)). You can withdraw that consent at any time by emailing privacy@valueanimate.com. We then stop showing it and remove it where we can.
Emails to buyers
Buyers get emails about their purchase: access and sign-in links, getting started, new lessons for the parts they own, and changes that affect them. These are part of the contract (GDPR Art. 6(1)(b)). You can turn off the course-update emails with the link in them. Emails about access, sign-in and changes to your purchase always come.
If you own the core but not the upgrade, we may also send you up to three emails about the upgrade, and later, rarely, about similar courses of ours. The upgrade emails stop for good once you buy it. We may do this without asking first, because you are our customer and it is about our own similar products (ePrivacy Directive 2002/58/EC Art. 13(2), as applied in Estonia’s Electronic Communications Act; GDPR Art. 6(1)(f)). You can say no at any time, free of charge: click unsubscribe in any of these emails, reply “stop”, or email privacy@valueanimate.com. After that we don’t send you offers again.
If you also joined our newsletter before buying, you can unsubscribe from it separately, and we stop sending you its emails about the course once you have bought it.
Withdrawal, refund and support requests
When you use the withdrawal page or email us, we process your name, email, order details and message to handle the request and send the confirmation the law requires. For the withdrawal page we also keep a salted hash of your IP address and your browser’s user agent, as a record of when and how it was sent, and to stop abuse.
Legal basis: the contract and our legal duties (GDPR Art. 6(1)(b) and (c)), and our legitimate interest in security (Art. 6(1)(f)).
Enquiries about explainer videos for your organisation
When you send the form on the For brands page, we process your name, work email, organisation, website or channel, the kind of organisation and package you picked, your message, the page and campaign tags you came from, a salted hash of your IP address and your browser’s user agent. We use them to reply, prepare a quote and stop abuse. We don’t add you to any newsletter.
Legal basis: steps you ask for before a possible contract (GDPR Art. 6(1)(b)) or, when you write for an organisation, our legitimate interest in answering business enquiries (Art. 6(1)(f)).
4. Cookies and browser storage
We use no advertising, analytics or tracking cookies. This is everything our site stores in your browser:
| Name | What it does | How long |
|---|---|---|
__Host-va_member (cookie) | Keeps a buyer signed in to the members page. Set only when you sign in. Signed, and not readable by scripts. | Up to 30 days, or until you sign out |
va-motion (local storage) | Remembers that you pressed “Pause motion”. Set only if you press it. | Until you press “Play motion” or clear your browser data |
va-review, va-variant (session storage) | Only on our internal design-review links. Remember which design is being compared. | Until you close the tab |
Each of these only does something you asked for, so they don’t need consent (ePrivacy Directive Art. 5(3)). The Stripe checkout page sets its own cookies, for example for fraud prevention, under Stripe’s and Link’s privacy policies.
5. Who receives your data
These providers process data for us, under a data processing agreement, except where we say they act on their own account:
- Vercel (USA): hosting, server functions, short-lived logs and cookieless analytics.
- Supabase (USA; our data is stored in Ireland): our database for sign-ups, consent records, orders, members, lesson progress and enquiries, and storage for the course files and the Script Kit.
- Resend (USA): sends our emails, and stores email data in the USA. We don’t track whether you open our emails or click their links.
- Stripe (Ireland and USA) and Link (a Stripe company): payments. Stripe also acts on its own account for fraud prevention and its legal duties.
- ManyChat (USA): replies to Instagram comments and messages. Meta (Instagram) acts on its own account.
- GoDaddy (USA), with its Professional Email by Titan: our mailbox for info@valueanimate.com and its aliases. It receives and stores the emails you send us and our internal order notices.
- Mux (USA): hosts and plays the lesson videos on the members page. To stream them and measure playback quality, it processes your IP address, device and browser data, and how the video played (for example where it paused). Each video plays through a private link that expires after 12 hours.
- Our accountant (Estonia) sees order and payment records. We share data with tax authorities, other authorities or courts only when the law requires it.
6. Transfers outside the EU and EEA
Several providers are in the USA. We rely on the EU-US Data Privacy Framework where the provider is certified under it, and on the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) in our agreements. Email privacy@valueanimate.com for a copy of the safeguards.
7. How long we keep data
- Sign-ups that are never confirmed: deleted after 30 days.
- Subscribers: until you unsubscribe. After that we keep the consent record for 3 years to prove consent, and your email on a do-not-email list so we don’t write to you again.
- Rate-limit counters (hashed IP addresses): deleted after 24 hours.
- Sign-in links and codes: deleted one day after they expire.
- Lesson progress (lessons marked done, where a video stopped): while you have access, and deleted with your members page account.
- Our log of which scheduled emails went to which address and when (so nobody gets the same email twice): deleted 12 months after sending.
- Orders, payments, refunds and receipts: 7 years from the end of the financial year, as the Estonian Accounting Act requires.
- Your members page account: while you have access, then up to 3 years for possible claims.
- Scripts and reels you shared with us: until you ask us to delete them, and no longer than 3 years after your access ends.
- Withdrawal and support requests: 3 years after the matter is closed, or 7 years where they are accounting records.
- Enquiries from the For brands page that don’t lead to a project: deleted 24 months after the last update.
- Instagram contacts in ManyChat: 12 months after your last message.
- Server logs: a few days at most, under Vercel’s log settings.
8. Your rights
You have the right to:
- get a copy of your data and know how we use it;
- have wrong data corrected;
- have your data deleted, unless we must keep it by law;
- restrict how we use it;
- receive data you gave us in a machine-readable format;
- object to processing based on our legitimate interest, and object to direct marketing at any time;
- withdraw your consent at any time. This doesn’t affect what we did before.
Email privacy@valueanimate.com. We reply within one month and may ask you to confirm your identity. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the data protection authority where you live or work.
9. Other points
- Giving us data is voluntary. Without an email we can’t send the Script Kit. Without an email and payment details you can’t buy.
- We make no decisions about you based only on automated processing that have legal or similarly significant effects. Stripe screens payments for fraud under its own privacy policy.
- The site and the course are for adults. Please don’t sign up if you are under 16. You must be 18 to buy.
- We protect your data with encrypted connections, access limited to the people who need it, and hashed IP addresses and sign-in links. Payment card data never touches our systems.
10. Changes to this policy
When we change this policy, we publish the new version here with a new date and version number. Each consent record stores the version you saw. If a change matters to you, we tell subscribers and buyers by email.