Privacy Policy

This policy explains what Dyadic Games GmbH does with personal data when you visit scenebrew.com, join the waitlist, or use the Scenebrew platform. It is written to be read, not to be survived: Section 1 is the short version, Section 10 maps every purpose to its legal basis, Section 14 says how long we keep things, and Section 16 tells you how to exercise your rights.

1. At a glance

This table is a summary. The sections below are what actually applies.

2. Who is responsible

The controller within the meaning of Art. 4(7) GDPR is:

Dyadic Games GmbH
Mariahilferstraße 1
8020 Graz, Austria
Email: office@dyadicgames.com
Phone: (+43) 720 519600

Company register FN 516659 v, Regional Court for Civil Matters Graz. Represented by Ing. Mag. Dipl.-Ing. Stefan Kohl. Full company details are in the Imprint.

Data protection officer. We are not required to appoint one under Art. 37 GDPR and have not appointed one. Data protection questions go to office@dyadicgames.com and are handled by a person.

3. Which part of this policy applies to you

Scenebrew has four different relationships with people, and the answers differ. Find yourself here.

4. When you visit the website

4.1 Server logs

Our servers record each request: IP address, date and time, the page requested, HTTP status, amount of data transferred, referring page, browser and operating system. We need this to deliver the page, to keep the service available, and to recognise attacks.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is operating a website that works and is not abused; a request cannot be served without an IP address.
• Retention: application logs are deleted after 7 days, operational metrics after 15 days. We do not log request bodies — they are redacted before the log is written.

4.2 Cookies and your choice

On your first visit a consent banner asks whether we may load optional services. We use two categories:

• Strictly necessary — needed for the site to function and for us to record your choice. The consent cookie is cc_cookie and stores your decision for about six months. If you switch the language, the NEXT_LOCALE cookie remembers it; if you pick a currency in the pricing section, your browser's local storage remembers it under scenebrew.currency. None of these identifies you, and all of them are set without consent, because § 165(3) of the Austrian Telecommunications Act 2021 exempts them.
• Analytics — off unless you switch them on. Nothing in this category is loaded, and no cookie in it is set, before you consent.

To be able to prove your choice later, we also store each decision on our server: a random consent ID (the same one kept in cc_cookie), the banner version, the categories you allowed and the time — no IP address and nothing else that identifies you. These records are kept for the consent period plus three years and then deleted automatically (legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

You can change or withdraw your choice at any time through the cookie settings in the website footer. Withdrawing analytics deletes the _ga cookies and reloads the page, so Google Analytics stops at once. Withdrawing is as easy as consenting and does not affect the lawfulness of what happened before.

4.3 Analytics — only with your consent

If, and only if, you consent to the analytics category:

• Google Tag Manager — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Manages which tags load. It sets no analytics cookies of its own; it loads the service below.
• Google Analytics 4 — same provider. Processes pages visited, time on page, approximate location derived from a truncated IP address, and device and browser information, and sets cookies such as _ga and _ga_* for up to 14 months. Full IP addresses are not logged or stored. See Google's privacy policy.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 165(3) TKG 2021. Transfers: Section 13.

4.4 Fonts

All fonts are served from our own servers. Loading a page contacts no font CDN and sends nothing to a third party.

5. When you join the waitlist

Neither service below is contacted when you merely browse. They are reached only once you submit the form yourself.

The waitlist itself (Brevo). We use Brevo, a service of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, to hold the waitlist and send the mail that goes with it. Signup is double opt-in: when you submit your address we ask Brevo to send you one confirmation email, and you are added to the list only when you click the link in it. Until you do, nothing else is sent. The only thing we transmit is your email address and the language you used. Brevo records the date, time and IP address of your confirmation — that record is what demonstrates your consent under Art. 7(1) GDPR.

• Legal basis: your consent, Art. 6(1)(a) GDPR.
• Withdrawal: the unsubscribe link in any email we send, or a message to office@dyadicgames.com. It takes effect immediately.
• Retention: until you withdraw.
• Further information: Brevo's privacy policy.

Spam protection (ALTCHA). The form is protected by ALTCHA, which runs entirely on our own servers. Your browser solves a small computational puzzle before the form is accepted; this is automatic and needs nothing from you. No third party is involved, nothing leaves our infrastructure for this purpose, and no cookie is set. To stop the same address being used to trigger repeated confirmation emails, we hold that address in memory for 10 minutes and nowhere else.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is running a signup form that cannot be used to mail-bomb strangers.

6. When you contact us

If you email or call us, we process what you send — your address or number, your name if you give it, and the content of your message — to answer you.

• Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or a step before one; otherwise Art. 6(1)(f), our legitimate interest in answering the people who write to us.
• Retention: as long as needed to deal with the matter, and afterwards only where commercial or tax law requires it (Section 14).

There is no contact form on this website. Email and telephone are the only routes.

7. When you use the Scenebrew platform

For the data in this section we are the controller. For the content your team creates inside the platform we are not — that is Section 9.

Account and sign-in. Your email address, name, username, job title if you give one, profile picture if you upload one, and your sign-in credentials. Sign-in runs on Keycloak, which we host ourselves on our own infrastructure — no third-party identity provider is involved for platform users, and Keycloak's login-event logging is switched off in both of our environments, so no login history is stored. If a colleague invites you, we receive your email address from them rather than from you; this policy is how we inform you under Art. 14 GDPR, and we send it with the invitation.

Using the service. Which projects and scenes exist, which pipeline steps you ran, what they cost in credits, and your API keys (stored as a hash, never in the clear). An API key acts with your permissions, so its use is recorded against you.

Activity log. Administrative actions inside a workspace — who invited, changed or removed whom — so the organisation has a record of what happened in its own account.

Billing. If your organisation subscribes, the billing contact's name, email address and address go to Stripe. Card details never touch our systems; they go directly to Stripe.

Support. What you tell us when you ask for help.

Legal bases for all of the above are in Section 10, retention in Section 14.

8. What the AI does with what you write

This is a generative AI product, so it matters exactly where your words go.

What is sent. A scene brief is free text. It, and the documents generated from it, are sent to the language model that writes the Scene Design Document and builds the Player Experience Graph. Laying out the scene and generating the 3D model happen on our own infrastructure and send nothing anywhere.

Where the model runs. By default the language model runs on infrastructure we operate in the EU; it is a model we host ourselves, not a third-party AI service. Which model that is may change as the product develops — we have not made a final choice. No third-party AI provider receives your content in the default configuration.

Your own provider accounts ("bring your own key"). Your workspace can connect its own account with an external provider by entering its own API key: instead of the default model, a language model from OpenAI, Anthropic or Google; and, for 3D and image asset generation, Tripo (China), Meshy (United States) or Scenario (United States). Where you do that, the content needed for the task (the brief and the documents generated from it, or the prompts and reference images for an asset) goes to that provider on your instruction and under your organisation's own agreement with it. That provider is your organisation's processor, not our sub-processor; where it processes the content, how long it keeps it and whether it may train on it are set by the terms your organisation agreed with it, and we have no control over them. OpenAI, Anthropic and Google are US companies; the entity you contract with and where it processes data depend on your agreement with the provider.

Not in service yet. Scenebrew is not yet available to customers. This section describes how the platform handles your content once it is; we will update it before launch if anything changes.

Training. We do not use your content to train our own models. Where a third-party provider is involved, the terms that apply are your organisation's, not ours.

Please note. A brief is free text and we do not inspect it. If you type a colleague's name or a client's address into one, that becomes personal data inside your organisation's content, governed by Section 9. We cannot detect it and cannot filter it out.

9. Content in a workspace: we are the processor

Everything the members of a workspace create or upload — briefs, design documents, conversations, uploaded images and files, and everything generated from them — belongs to the organisation that owns the workspace. For personal data inside that content:

• The organisation is the controller. It decides what goes in and is responsible for the lawfulness of it.
• We are the processor under Art. 28 GDPR and act only on the organisation's documented instructions, under a data processing agreement.
• We do not inspect, classify or filter content for personal data, and we do not read it to improve our products or our marketing.

If you are named in someone's content and want it removed, ask that organisation — it holds the controls, and deleting a project, scene or conversation is its instruction to us to erase it. We carry that out permanently within 30 days, or sooner if the organisation asks because a data subject request requires it. If you cannot identify the organisation, write to us and we will route your request.

We do not inform every person who might be named inside a customer's content, because we do not know who they are and cannot find out without reading content we have undertaken not to read; Art. 14(5)(b) GDPR covers this, and the obligation to inform sits with the organisation that put the data in.

10. Purposes and legal bases

Every purpose, with the legal basis that carries it. Where we rely on legitimate interests, the actual interest is named — you have a right to know it and a right to object (Section 16).

We do not process your personal data for purposes beyond these without telling you first and, where the law requires it, asking you.

11. Automated decision-making

Automated systems watch for abuse: unusual request volumes, credential sharing, payment fraud signals, and content reported to us. They can flag an operation, slow it down, or block it temporarily.

They cannot end your relationship with us on their own. A decision that produces legal effects or similarly significantly affects you — removing content, restricting a project, suspending or terminating an account — is always reviewed by a person before it becomes final. You can contest the outcome, put your point of view, and get a human review: write to office@dyadicgames.com, and see Section 13 of the Terms of Service for the procedure.

We do not carry out profiling to evaluate personal aspects of you, and we make no solely automated decisions within the meaning of Art. 22(1) GDPR.

12. Who receives your data

We do not sell personal data and we do not share it for anyone else's advertising.

Processors act on our instructions under an Art. 28 GDPR contract, use the data only for what we asked, and may not use it for their own purposes.

Two things that are not on this list, deliberately:

• Keycloak, which handles sign-in, is software we run ourselves on our own infrastructure. It is not a third party.
• External AI providers you connect yourself are not our processors. They act under your organisation's agreement — Section 8.

Beyond these, we disclose personal data only where a law or a valid order of a court or authority requires it, and — should we ever sell or merge the business — to the acquirer, in which case we will tell you before it happens.

An up-to-date list of our sub-processors is available to customers as an annex to the data processing agreement; ask at office@dyadicgames.com.

13. Transfers outside the EEA

Everything Scenebrew stores lives in Germany, with a backup copy in Finland — both in the EU. Two recipients can involve a transfer to the United States, both listed above:

• Stripe, for billing, to Stripe Inc.
• Google, for analytics, and only if you consented — withdrawing consent stops it.

Both rely on the EU-U.S. Data Privacy Framework, an adequacy decision of the European Commission, backed by the Commission's standard contractual clauses as a second layer. You can ask us for a copy of the clauses at office@dyadicgames.com.

If your organisation connects its own account with one of these providers, content goes wherever that provider processes it (Tripo in China; Meshy, Scenario and, depending on your agreement, OpenAI, Anthropic and Google in the United States), under your organisation's own agreement with it. That transfer is your organisation's to assess, not ours.

14. How long we keep things

"As long as necessary" is not an answer, so here are the periods.

Sign-in events are not stored at all: event logging is switched off in our identity server.

15. What "deletion" actually means here

We would rather be precise than reassuring.

Content is really deleted. When an organisation deletes a project, scene or conversation, it disappears immediately and is permanently purged within 30 days — database rows, stored files and artifacts, and the conversation transcript. After that it is gone from live systems.

A user account cannot simply be dropped, because ten database references point at it as the author of the organisation's work, and deleting the row would destroy the organisation's own project history. So an erasure request is executed like this: your identity in the sign-in system is deleted outright; every identifying field on your user record — email, username, names, job title, profile picture — is overwritten in place; your identifier is replaced with a fresh random value, never one derived from your old data; your API keys are revoked; your profile picture and any data exports are deleted; and your name is removed from the activity log. What remains is a record with no personal data in it, shown to your colleagues as "Former member", so their projects still make sense.

We call that erasure and we think it is: the remaining record cannot identify you and cannot be reversed. Two things survive by law rather than by choice — credit-ledger entries, kept under Art. 17(3)(b) because Austrian commercial and tax law requires it, and the fact that an administrative event happened, kept without your name under Art. 17(3)(e). Both are restricted to those purposes and processed for nothing else.

Backups hold copies for up to 30 days and then expire. If we ever had to restore from a backup taken before an erasure, we re-apply that erasure afterwards — that is what the erasure record exists for.

16. Your rights

You have all of the following. Exercising them is free, and we answer within one month of receiving a request (Art. 12(3) GDPR); for account erasure we aim for five business days.

• Access (Art. 15) — a copy of your data and the information in this policy, specific to you.
• Rectification (Art. 16) — correct anything wrong or incomplete.
• Erasure (Art. 17) — see Section 15 for exactly what happens.
• Restriction (Art. 18) — have us hold data without using it while something is being sorted out.
• Data portability (Art. 20) — your data in a structured, commonly used, machine-readable format, or sent straight to another provider. The platform has a self-service export; your rights under the EU Data Act to switch provider are in Section 20 of the Terms of Service.
• Withdraw consent (Art. 7(3)) — at any time, as easily as you gave it, without affecting what was lawful before.
• Complain to a supervisory authority (Art. 77) — details below.

To exercise any of them, write to office@dyadicgames.com. We may need to confirm who you are before we act, and we will ask only for what is needed for that — not for more documents than the request warrants.

Your right to object — please read this one

You have the right to object at any time, on grounds relating to your particular situation, to processing we base on our legitimate interests (Art. 6(1)(f) GDPR), including any profiling based on it. This is Art. 21(1) GDPR. If you object, we stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or that we need it to establish, exercise or defend legal claims.

Where we process your data for direct marketing, you can object at any time and we stop, with no exceptions and no balancing (Art. 21(2) and (3) GDPR).

Object by writing to office@dyadicgames.com. Section 10 names every legitimate interest we rely on, so you can see what an objection would cover.

Complaining to the authority

You can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or where you think something went wrong. Ours is:

Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
www.dsb.gv.at

You do not have to come to us first, though we would like the chance to fix it.

17. How we protect your data

Our measures under Art. 32 GDPR include: TLS on every connection to the service; passwords and API keys stored only as hashes, never in the clear; all data held in the EU; access to production restricted to named staff over authenticated channels, with what they do recorded in an audit log; network policies that stop each service reaching anything it has no business reaching; separated production and development environments; security updates and dependency scanning; automated secret scanning on every commit; and backups taken on a schedule with a defined retention.

We review these measures as the service changes, and we would rather list what we actually do than what sounds reassuring.

No system is perfectly secure. If a breach ever puts your rights at risk, we notify the Austrian Data Protection Authority within 72 hours and tell you directly where Art. 34 GDPR requires it.

18. Children

Scenebrew is a professional tool and is not directed at children. Under the Terms of Service you must be 18 to enter into a contract with us, or 14 with your guardian's consent.

Where we rely on consent for an information-society service, Austrian law sets the age at 14 (§ 4(4) of the Austrian Data Protection Act); below that, a guardian must consent. We do not knowingly collect personal data from children below that age. If you believe a child has given us data, write to office@dyadicgames.com and we will delete it.

19. Do you have to give us your data?

You are never obliged to give us personal data. But some of it is necessary rather than optional:

• To have an account, we need an email address and sign-in credentials. Without them there is no account — this is a contractual requirement under Art. 13(2)(e) GDPR.
• To be billed, we need a billing contact, and tax law requires us to record the invoice.
• To join the waitlist, we need an email address to send the confirmation to.
• Everything else — your name, job title, profile picture — is optional, and leaving it out costs you nothing but a less personal interface.

20. Changes to this policy

We update this policy when what we do changes — a new provider, a new feature, a change in the law. The current version is always on this page with the date it last changed at the top.

If a change materially affects how we process your data, we will not rely on you noticing: we will tell registered users by email before it takes effect. Where a change requires your consent, we will ask for it rather than assume it.

21. Contact

Questions, requests, or objections:

Dyadic Games GmbH
Mariahilferstraße 1
8020 Graz, Austria
Email: office@dyadicgames.com
Phone: (+43) 720 519600

A person reads that mailbox. You will get an answer.