Privacy Policy

SV SOCIAL MEDIA LTD is the data controller: a company registered in Cyprus under number HE 472394, at Ellados 50B, Ypsonas, 4183, Limassol, Cyprus. For anything in this policy, including a request to see or delete your data, write to support@bagleflix.com.

When you create an account: your email address, and a display name and country if you choose to give them. If you arrived through someone’s referral link, we record which account referred you.

When you rent or buy: which title, when, the amount charged, the currency, and the reference ids Stripe gives us for the payment. We never receive or store your card number — that goes straight to Stripe.

When you watch: which episode and how far through it you are, so you can pick up where you left off, and a record that a view happened, so the creator can be paid and can see how their title is doing.

When you publish as a creator: your plan, its status, and the Stripe references for it, plus everything you enter about your titles.

When you use the support chat: the messages you write. If you are signed in, we also count how many messages you have sent in the last hour so that nobody can run up our bill — for visitors who are not signed in, that counter uses your IP address instead.

We do not collect your date of birth, your address, your phone number, or anything about you from other companies.

To perform our contract with you — running your account, taking payment, giving you access to what you paid for, remembering your place in a film, and paying creators what they have earned. Without this data there is no service.

Our legitimate interests — keeping the platform secure, preventing fraud and abuse, limiting the support chat, and understanding what is working so we can improve it.

Our legal obligations — keeping accounting records, and reporting creator earnings where tax law requires it.

We do not send marketing emails and we do not profile you for advertising. If that ever changes we will ask your permission first, separately.

BAGLE FLIX sets no advertising or analytics cookies. There is no tracker on this site and no third party watching you browse it. If you visit without signing in, nothing is stored on your device at all.

Once you sign in, one essential cookie holds your session so that you stay signed in and we know which purchases are yours. It is required for the service to function, so there is nothing to consent to and no banner to click. Deleting it signs you out.

We keep this list short on purpose. Each of these companies acts on our instructions under a data processing agreement, and each is named because your data genuinely passes through it.

Supabase — the database and sign-in system. Your account and purchase records live here, on servers in Stockholm, in the EU.
Bunny.net — delivers the video. Sees the request for a video stream and your IP address, so it can serve you from a nearby server.
Stripe — takes the payments and holds the card details we never see.
Resend — sends the emails, from EU servers.
Vercel — runs the website itself.
Anthropic — powers the support chat. What you type there, plus a summary of your own account status, is sent to Anthropic to produce an answer. It is not used to train their models. Do not type anything into that chat you would not want processed this way.

We do not sell your data, and we do not share it with advertisers.

Your account and purchase data stays in the EU. Some of the suppliers above operate outside it — video delivery, hosting and the support chat in particular. Where data reaches a country without an EU adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses.

Your account and what goes with it — your profile, your purchases, your watch progress — stay while your account is open. Ask us to delete the account and we remove them.

Records of payments have to be kept for seven years under Cyprus accounting and tax law, even after an account closes. Those are reduced to what the law requires: what was paid, when, and by which account.

Support conversations are kept only as long as needed to resolve the question. The hourly message counter is kept for a few hours and then discarded.

Under the GDPR you can ask us to show you the data we hold about you, correct it if it is wrong, delete it, hand it over in a portable form, restrict what we do with it, or object to processing we base on legitimate interests.

Email support@bagleflix.com. We will reply within one month, and we will not charge you or make it difficult. If your request would clash with a record we must keep by law, we will tell you exactly which part and why.

If you think we have handled your data badly, tell us first — but you have the right to complain directly to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority in the EU country where you live.

Access to your data is enforced by the database itself rather than only by the website, so a bug in a page cannot expose another person’s account. Video is served through short-lived signed links, which is why a film cannot be watched by copying a URL. Card details never reach our servers.

No system is perfect. If a breach ever affects your data, we will tell you and the Cyprus authority within 72 hours of discovering it, and we will tell you what actually happened.

BAGLE FLIX is not for children under 16, and we do not knowingly hold data about them. If you believe a child has created an account, email us and we will remove it.

If we start collecting something new or add a supplier that touches your data, we will update this page and change the date at the top. For anything that materially affects you, we will email you rather than quietly edit the page.

See also our Terms of Service and, if you publish here, the Creator Terms.