EIZOPrivacy notice
What the current service processes, who can see it, storage and browser preferences.
Active · Version 2026-10-19.4
1. Notice status and controller #
Watkins Labs operates EIZO Studio and handles account administration, privacy requests and service security. Contact corp@eizo.watkinsx.com. The planned initial app-store market is the United States. This privacy notice takes effect on October 17, 2026.
The website and iOS/Android apps use the same account and backend services. Authorized creator and compute-node features have additional processing described below; new BASE viewer accounts do not gain access to those features by signing up.
2. Data we process #
Account data includes usernames, email addresses, password hashes, display names, avatars, sessions and verification or recovery records. A private date of birth supports age eligibility; rating limits and excluded content descriptors record your viewing choices. Your date of birth is not a public profile field. Technical and security records can include request metadata, IP addresses, authentication events and audit entries.
Community data includes profiles, subscriptions, saved items, comments, votes, messages, reports, blocks and account-data requests. Some features depend on your account permissions. Authorized creator data can include projects, films, prompts, source uploads, generated media, tags and previews. Participating compute-node records can include node/system inventory, model availability, job status, transfers and contribution records.
3. Purposes and legal bases #
The service processes data to authenticate users, store and organize assets, run requested jobs, transfer results, produce previews, schedule resources and show account or node status. Security, abuse prevention, moderation and operational troubleshooting also require some records.
Where EU law applies, the basis for processing must be appropriate to each purpose: contract necessity for requested services, assessed legitimate interests for proportionate security and abuse prevention, legal obligations where applicable, and separate consent where required for optional processing. Account registration is not blanket consent. Any unrelated use requires an appropriate basis and an updated notice.
4. Recipients and shared compute #
Authorized users in the relevant account or tenant can access content according to permissions. Administrators, moderators and technical operators may access information necessary for their functions. Watkins Labs operates the application and account infrastructure. Cloudflare R2 stores and delivers media and receives the object data and network requests needed for those operations.
When work uses another owner’s node, inputs and outputs needed for that work reach that machine. Its owner may inspect the work and related user identity through node review or host access. Shared compute is unsuitable for confidential or regulated data unless an appropriate technical and contractual arrangement has been established. Private-node selection limits scheduling; it is not a promise that no service administrator can access data.
Authorized creators can choose AI connections to Anthropic Claude, OpenAI, Microsoft Azure AI Foundry or an EIZO node running Ollama. Before a connection is enabled, its disclosure identifies the recipient and the data sent, and requires a separate sharing choice. Requested work can include prompts, conversation history, relevant project text, tool results and usage metadata. Cloud vision checks can also send selected image or video frames after separate permission. An Ollama connection sends the work to the selected EIZO node; it does not necessarily run on your phone. Disabling a connection stops new use through that connection; requests already in progress may finish.
Provider retention and processing locations depend on the selected provider, endpoint and applicable account terms. EIZO does not promise zero provider retention or US-only processing. Copies held by a provider are distinct from EIZO account records. Contact corp@eizo.watkinsx.com about the recipients and retention relevant to your request. Lawful disclosures may also be necessary for legal process or protection against abuse.
EIZO uses YouTube API Services for optional connected-channel publishing. When you authorize a connection, EIZO stores protected authorization tokens and channel identifiers and titles. It reads relevant video and playlist information and sends the media, titles, descriptions, thumbnails, settings and playlist changes you choose to Google/YouTube. Those records support your publishing jobs and their status. Access is limited to the authorized account and necessary operators. This connection is separate from ordinary viewing of EIZO-hosted media.
You can revoke EIZO’s access through your Google account permissions page linked below and request deletion of EIZO-held connection or publishing data through Privacy & safety or corp@eizo.watkinsx.com. Revoking access does not itself remove videos already published on YouTube. Remove those through the connected publishing controls while access remains available, or directly through YouTube. Google’s Privacy Policy also applies to its processing.
5. Retention, deletion and protection #
Stored content is retained to provide the service until it is removed or an account-deletion request is fulfilled; there is no universal age-based expiry for all account content. Confirmed account-deletion requests immediately disable the account and start background cleanup. Shared ownership, unresolved execution and retained records can require review before cleanup can finish.
Deletion from a library, removal of a source mapping, removal from node storage and expiry of backups are different operations. Copies may remain on participating nodes or in retained records until separately handled. Do not assume a user-interface action erases every copy. Access controls, authenticated transport and quotas reduce risk but do not eliminate breach or data-loss risk.
Managed database backup archives are private and become eligible for deletion 30 days after their original modification time. Daily cleanup normally removes them by 31 days; an interrupted cleanup can delay expiry. This schedule covers the managed database archives, not every external export, provider copy or participating device.
A separate deletion ledger records the request and account identifiers and request time so a database restore can reapply deletion requests. It is copied to a second server and kept separately from expiring database archives. These minimal recovery records remain while retained copies could restore the deleted data. A restore must replay deletion requests before the restored service is exposed to users.
Completion is verified separately for account data, content, messages, media, notifications and backups. A submitted request or disabled account does not mean every copy has been erased. Remaining provider, external-copy and retention exceptions must be identified in the response; no fixed end-to-end completion period is promised.
A verified email address is retained separately from the erased account solely to deliver deletion receipts, progress updates and completion confirmation. It does not preserve login access. The contact is removed seven days after successful completion notification, or 30 days after completion if delivery repeatedly fails. Delivery status is monitored by staff.
Necessary moderation decisions and report evidence may remain under restricted staff access for review, appeals and applicable legal obligations after an account is deleted. The deleted subject’s account is not kept open to preserve a moderation decision. Ask about retained evidence through Privacy & safety or corp@eizo.watkinsx.com; retained evidence is separate from an active account or public content.
7. Requests and contact #
Use Privacy & safety in the website or app for deletion, data-access requests, privacy questions and moderation appeals. Keep your receipt ID to follow progress. If you cannot sign in, try account recovery or contact corp@eizo.watkinsx.com. Ownership verification may be needed before disclosing or deleting account information.
Do not send passwords, authentication codes, private keys or unnecessary identity documents. A request receipt is not proof that fulfillment is complete. Applicable privacy rights depend on your location and circumstances; the EU data-rights page describes additional considerations where relevant.
EIZO Studio iOS and Android apps and public community #
The EIZO Studio iOS and Android apps use the same accounts, public profiles, videos, songs, posts, subscriptions, comments, messages and moderation records as this website. Public profile fields and public posts are visible to other visitors. Private messages are available to their participants and may be reviewed by authorized staff when reported; they are not end-to-end encrypted.
The app stores saved-video IDs, onboarding preferences, downloaded media and download metadata on your device. Downloads remain until you remove them or clear the app’s storage. Removing a download or clearing device preferences does not delete your EIZO account or server records. A downloaded copy cannot be recalled from another person’s device.
When you browse or stream, EIZO and its hosting and media-delivery providers receive the network requests needed to deliver content, including your IP address and request metadata. Search queries are sent to EIZO to return results. Signing in sends your credentials over HTTPS; the app does not write your password to its preference store.
Notification permission is optional. The current app uses it for download-complete alerts and Android playback controls. Remote push registration and delivery are not enabled in this preview. Any future push service must be disclosed before activation. Background playback continues only after you start media, and can be stopped using the app or Android’s media controls.
The current app does not request access to your contacts, precise location, call logs, SMS, microphone or camera, and does not include an advertising SDK. Pulse animations use a bundled renderer and fetch the scene’s media assets; arbitrary document scripts are disabled. The website’s creator tools and optional integrations have additional data flows described elsewhere in this notice.
Optional usage and playback measurements #
Optional first-party analytics is off by default in this app and browser preview. You can choose it in Settings in the app or Privacy & safety on the website, and turn it off later. The choice is stored locally as eizo.analytics.consent.v1; separate devices and browsers have separate choices. Essential authentication, content delivery and abuse-prevention records are separate from optional measurements.
When enabled, coarse usage events contain an event ID, fixed screen area, event type, platform, device class (such as phone or tablet), app version/build and time. They do not contain your account ID, private message body, search text or an advertising identifier. These raw usage events are removed after 90 days by hourly cleanup. Playback measurements additionally include the content ID, playback ranges and watch time, completion, skips, device category and a daily pseudonymous viewer key derived using a server secret. Existing playback cleanup targets records older than 365 days. Aggregate content view totals can remain. Operational access logs and backups are separate from optional measurements. The managed database archive schedule is described in the retention section; it does not cover all external copies.
Turning off optional measurements stops subsequent optional events from this client. It does not retroactively delete server records. Use an account-data request to ask about retained personal data. No third-party advertising or analytics SDK is added by this feature.
Your controls
Official references
References explain relevant rules; they do not certify the service.