Legal and Policies

Privacy Policy

This policy explains how we handle personal data when we act as a controller, that is, for our own purposes such as running your account, securing the service, understanding how the platform is used, and our sales and marketing.

When you upload or generate production content and metadata in the platform, we handle the personal data inside that content as a processor on your organisation’s instructions. That processing is governed by our Data Processing Agreement with your organisation, not by this policy. We do not use your production content or metadata for any purpose other than providing the service to you. If you are an individual whose personal data appears in a customer’s production data, please contact that customer (the controller) to exercise your rights, and we will support them in responding.

We are a business-to-business service, intended for organisations (studios, post houses, VFX vendors and similar), not consumers. For any privacy question, or to exercise your rights, contact support@origamiplatform.io. We have not appointed a Data Protection Officer; privacy queries are handled through that address.

The personal data we collect (as controller)

Session replay in the platform runs only if you accept analytics there. It records our application interface as you use it, with what you type hidden. Text on screen, such as project, clip and file names, can appear in a recording. It is not set up to record the pictures or sound of your media. We do not seek to collect special-category personal data; please do not enter it into free-text fields.

Why we use it, and our lawful basis

Where we rely on legitimate interests, we have weighed those interests against your rights and keep a record of that assessment, available on request.

Who we share it with

We share personal data with the service providers that help us run Origami. Each is bound by contract to protect it. Most act only on our instructions; some, such as Stripe and Google, also use it for their own purposes as set out in their privacy notices. Our current providers include Amazon Web Services (cloud hosting and storage, UK region), WorkOS (authentication), PostHog (product analytics, EU-hosted), HubSpot (CRM and marketing, EU-hosted), Sanity and Vercel (our marketing website), Google Analytics and Microsoft Clarity (website analytics, with your consent), LinkedIn (advertising and campaign measurement on our website, with your consent), Hetzner (operational logs and audit records, Finland), Cloudinary (logos and profile photos), Atlassian (support desk), Google Workspace (our email), Resend (transactional email delivery, including billing notices and VAT invoices), Stripe (payment processing; card and bank details go directly to Stripe and we receive only non-sensitive summaries such as card brand, last four digits and decline codes), and Slack (operational and security alerts). The providers that process customer production data on our customers’ behalf are listed in the Sub-processors section below.

We may also disclose personal data to professional advisers, to a buyer in connection with a corporate transaction, or where required by law or to protect our rights or the security of the service. We do not sell your personal data.

International transfers

Our platform, your media and the production metadata database are hosted in the United Kingdom (AWS London region). Some providers listed above are outside the UK. Where personal data is transferred to a provider outside the UK, we rely on an appropriate safeguard under UK data protection law: an adequacy decision; the UK-US Data Bridge where the provider is certified under the EU-US Data Privacy Framework and its UK Extension; or the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.

How long we keep it

• Account and identity data: user accounts are deactivated when an account closes, and deleted or anonymised within 90 days, apart from the records listed below.
• Application and security logs: 30 days, then archived for up to 400 days.
• The audit log of who did what in the platform: 13 months, then archived for 7 years. Records of who accepted which version of our terms: up to 7 years after the account closes. We keep both so that we can establish and defend legal claims. Records of AI app requests: 12 months.
• Support and feedback records: 90 days, or longer where needed to resolve an issue.
• Sales and marketing data: 1 year from your last engagement with us, or until you ask us to stop, whichever is sooner.
• Billing records (invoices, credit notes, statements and transaction history): at least 6 years, as required by UK tax and accounting law. These are kept even after an account closes.

Where data is no longer needed, we delete it or irreversibly anonymise it.

Your rights

Under UK data protection law you have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time where we rely on it. We do not make decisions about you that produce legal or similarly significant effects solely by automated means.

To exercise any right, contact support@origamiplatform.io. We will respond within one month, and will tell you if we need longer for a complex request. You can also complain to the Information Commissioner’s Office (ICO), ico.org.uk, 0303 123 1113, although we would welcome the chance to resolve your concern first.

Cookies

We use cookies and similar technologies as described in the Cookie Policy section below.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and, where changes are significant, tell you directly.

Cookie Policy

This explains how the Origami Platform website and application use cookies and similar technologies. A cookie is a small file stored on your device. We group the cookies we use into those that are strictly necessary (always on, because the service cannot work without them) and those that are not strictly necessary (set only with your consent, which you give through our cookie banner and can change at any time).

Strictly necessary cookies

These keep you signed in, keep your session secure, and remember your cookie choices. They do not require consent.

Analytics and marketing cookies (consent required)

We use HubSpot, Google Analytics, Microsoft Clarity and PostHog on our marketing website to understand how visitors use the site and to support our sales and marketing. These cookies are set only after you accept them in our cookie banner.

If you accept non-essential cookies, HubSpot may also load LinkedIn’s advertising and measurement tags, which let us measure our LinkedIn campaigns and may set LinkedIn’s own cookies. They do not load if you reject non-essential cookies.

Managing your choices

When you first visit our website, our banner lets you Accept or Reject non-essential cookies, with equal prominence. You can reopen the banner and change your choice at any time using the Cookie settings link in the website footer. You can also block or delete cookies through your browser settings, although the site and the application may not work correctly without the strictly necessary ones.

Terms of Use

Version 2026-10-11, effective 11 October 2026.

These Terms of Use (“Terms”) are a contract between Origami Platform Ltd (“Origami”, “we”, “us”) and the organisation that subscribes to or uses the Origami Platform (“Customer”, “you”).

The Origami Platform is a business service and we sell to businesses only. The Customer is bound when the person who creates its account, or who buys a subscription for it, accepts these Terms, and that person confirms they are acting for a business and have authority to bind it. Using the platform also means you agree to these Terms. If you do not agree, do not use the platform. These Terms govern self-serve use of the platform. Where you and Origami sign a separate written agreement, that agreement prevails over these Terms to the extent of any conflict (except as stated in Liability), and may add agreed terms specific to you.

These Terms apply to your use of the platform however you buy it, including through AWS Marketplace or a reseller. A marketplace’s own terms govern payment, invoicing, cancellation and refunds through it. These Terms govern everything else.

Key terms to read. These Terms restrict what you may do with what you see and learn here. In particular:

• You must not reverse engineer, copy or imitate the platform, by any method, including with AI tools (Protecting the platform).
• You must not use the platform, or what you learn from it, to build or advance a competing product, and an organisation must not develop one for 12 months after its access ends (Competing products).
• Your liability is not capped for deliberately breaking those rules, for infringing our intellectual property, or for claims other people bring against us because of your content or your use of the platform (Liability and Indemnity).
• If you switch on AI apps, what they retrieve goes to a provider you choose, and that choice is your responsibility (AI apps).

Each person who uses the platform under your account (an “Authorised User”) is asked to accept these Terms in the platform when they first sign in and again when the Terms change. We record who accepted, when, and which version. Each Authorised User accepts for themselves, for their own use of the platform. You are responsible for what your Authorised Users do, and each Authorised User is also personally bound by Protecting the platform, Competing products (other than the 12-month restriction, which binds organisations only), Confidentiality, Liability, Remedies and Governing law, including after they leave your organisation.

The service

Origami provides a post-production and VFX workflow platform that moves production metadata and assets through the pipeline, as described in our documentation and, where you have one, your signed agreement. We may improve, change or add to the platform from time to time, and will not materially reduce its core functionality during a paid term without notice. Some camera, codec and file formats belong to others. We support them as their owners allow, and may withdraw support for one if we lose the right to offer it.

Demos, trials and previews

If we give you a demo account, a trial, a preview or beta feature, or a demonstration of the platform (“Evaluation Access”), you may use it only to decide whether to subscribe, and only for as long as we allow. We may end Evaluation Access at any time. Our Evaluation Terms also apply to it.

Everything in Protecting the platform, Competing products and Confidentiality applies to Evaluation Access in full, whether or not you go on to subscribe.

Accounts and access

You are responsible for your account, your Authorised Users, and keeping credentials secure. We require multi-factor authentication when you sign in with an email and password, and unique credentials for each user. If you sign in with Google, you rely on the protection of that Google account and should switch on its two-step verification. Every person must sign in with their own login. Logins must not be shared, and you must not create one login for a team, a role or a shared mailbox, because our records of who did what depend on it. Accounts are for your own people and the people you invite to work on your productions (see People you invite). You must give us accurate information about who you are and who you work for, and you must not let anyone use an account that is not theirs. You must tell us promptly of any unauthorised access. We may set reasonable usage limits.

People you invite

You decide who has access to your projects, including people from other organisations such as vendors, facilities and freelancers, and what each of them can see and do. You are responsible for those choices, for what the people you invite do in your projects, and for removing access promptly when it is no longer needed, for example when someone leaves a production.

Someone invited from another organisation accepts these Terms for themselves when they sign in. If their organisation is also a Customer, it is responsible for them as one of its Authorised Users, and you remain responsible for the access you gave them to your projects.

As between the organisations working in a project, content in it is treated as belonging to the organisation that owns the project and its licensors, unless you agree otherwise between you. When a project is deleted or its owner’s account ends, everyone’s access to it ends. We are not a party to the arrangements between you and the people you invite, and we are not responsible for what they do with content you gave them access to.

You are responsible for the recipients and destinations you choose for a delivery or transfer. We send what you tell us to where you tell us, and we cannot recall it once it has been delivered.

Acceptable use

Your use of the platform must comply with our Acceptable Use Policy, which forms part of these Terms.

Your content

You and your licensors own all content, media, and metadata you upload to or generate in the platform (“Customer Content”). We claim no ownership of it. You grant us a non-exclusive, worldwide licence to host, store, process, transmit and display Customer Content only as needed to provide and secure the platform, and as instructed by you. We do not use Customer Content for any other purpose. Where Customer Content contains personal data, we process it as your processor under the Data Processing Agreement. You are responsible for having the rights needed to upload Customer Content and for its lawful use.

Our intellectual property

We and our licensors own the platform, the software we supply to run on your equipment (including Origami Link and any panel or plug-in we supply for another application), our documentation, and all related intellectual property, including the design, structure, behaviour and appearance of each of them (together, the “Origami Materials”).

We grant you a non-exclusive, non-transferable, revocable right to use the Origami Materials for your own business, on the productions you work on, during your subscription and subject to these Terms. During Evaluation Access the right is narrower, as set out in Demos, trials and previews. Software we supply to run on your equipment is licensed, not sold, and you must stop using it and remove it when your right to use the platform ends. You are responsible for the equipment and network it runs on. It may update itself, and it includes third-party and open-source components that are licensed under their own terms. All rights we do not expressly grant are reserved.

If you give us feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use it for any purpose, with the right to sublicense. We will not identify you as the source without your agreement.

Protecting the platform

You must not do any of the following, or help or allow anyone else to, whether directly or through a contractor, an affiliate, a tool or an automated system:

• Copy, modify, translate, adapt, resell, sublicense or create derivative works from the Origami Materials. You may copy our published documentation for use inside your organisation.
• Decompile, disassemble or reverse engineer the Origami Materials, or otherwise try to discover their source code, architecture, algorithms, data models, file and network formats, non-public interfaces, prompts or model behaviour.
• Do either of those things by any method. This includes using an artificial intelligence system, coding agent or other automated tool to inspect, map, describe, replicate or re-create the Origami Materials; intercepting or analysing network traffic; inspecting client-side code; and systematically submitting inputs and analysing the outputs.
• Scrape, crawl, harvest or extract in bulk any part of the Origami Materials or their output, other than exporting your own Customer Content with the features we provide for that.
• Use the Origami Materials, or screenshots, recordings, descriptions or output of them, to train, fine-tune, prompt or evaluate an artificial intelligence system so that it reproduces or imitates the platform or any of its features.
• Create a specification, feature map, design, test suite or other description of the Origami Materials for use in building, or briefing someone else to build, software that performs similar functions, including through a clean-room process.
• Benchmark or test the platform in order to publish the results, or share them with anyone who develops a Competing Product, without our written consent. You may share results in confidence with your own clients and advisers.
• Remove or obscure any notice, or get round any technical limit, metering or control.

These restrictions apply whatever the method and whether or not any of our code is copied. Nothing in these Terms removes a right you have under sections 50A to 50BA of the Copyright, Designs and Patents Act 1988, or under any other law, that section 296A of that Act or any other rule says cannot be excluded by agreement. Those rights belong only to someone using the platform lawfully and within these Terms. The right to decompile exists only to make another program work with the platform: it does not allow you to use what you obtain to create software substantially similar to the Origami Materials, or to pass it to anyone who does not need it for that purpose. Before relying on it, you must ask us in writing for the information you need and give us a reasonable opportunity to provide it.

Competing products

A “Competing Product” is software, or a hosted software service, that is supplied commercially to others and could be used in place of the platform or a substantial part of it. Tools you build to use inside your own organisation, and the post-production services you deliver to your clients with them, are not a Competing Product. You must not:

• Access or use the Origami Materials, or let anyone else do so, in order to design, build, train, improve, test or market a Competing Product or any other software intended to replace the platform, or to copy, replicate or imitate any feature, function, workflow or interface of the platform.
• Use anything you learn from the Origami Materials, including through Evaluation Access, for any of those purposes.
• Access the platform if you develop, or are planning to develop, a Competing Product, or on behalf of someone who does, unless we have agreed in writing first.
• Obtain access by giving false or misleading information about who you are, who you work for or why you want access, or by using someone else’s account.
• Share access, credentials, screens, recordings or unpublished documentation with anyone who develops a Competing Product.

For as long as your organisation has access to the platform and for 12 months after that access ends, it will not develop a Competing Product or help anyone else to develop one. This restriction binds organisations only: the Customer, and any organisation given Evaluation Access. It does not bind an individual personally. It is separate from the rest of this clause: if a court finds it unenforceable, the rest of this clause stands.

We may refuse or end access for anyone we reasonably believe develops a Competing Product or is acting for someone who does. Nothing in this clause stops you choosing or using another supplier’s product, or using general skills and knowledge that do not come from the Origami Materials.

If you create anything in breach of this clause or of Protecting the platform, you assign to us all intellectual property rights in it to the extent it derives from the Origami Materials, and until that assignment takes effect you hold those rights on trust for us.

Monitoring

We log access to the platform and look for patterns of use that suggest extraction or copying. If we reasonably suspect a breach of Protecting the platform or Competing products, we may suspend access at once while we investigate, and you will give us the information we reasonably ask for to establish what happened.

Services you connect

You can connect the platform to services run by others, such as on-set metadata services, editing applications, cloud storage and AI apps (“Connected Services”). You choose whether to connect one, you do so with your own account and credentials, and your use of it is governed by your agreement with its provider, not by these Terms. The provider acts for you and is not our sub-processor.

We act on the data a Connected Service gives us and do not check it. You are responsible for its accuracy, including where it changes how your media is processed, for example colour values that are applied to a render. If you disconnect a Connected Service, we stop using the credentials you gave us for it. Data already received stays in your project until you remove it.

AI apps

The platform can be reached from AI apps and assistants through a connection we provide (using the Model Context Protocol, or MCP). The connection is switched off for your organisation until one of your administrators switches it on, and your administrators control what it is allowed to do. We show a warning explaining what this means before it is switched on, and we record who accepted it.

An AI app acts as the Authorised User who connected it. It can see and do only what that person can, less anything your administrators have switched off. The connection gives an AI app no way to download your media or to read anything out of your storage. We limit the volume an AI app can retrieve and keep a record of each request it makes. You can switch the connection off again at any time, for the whole organisation, a project, a team or one person.

When an Authorised User uses an AI app, the information it retrieves leaves the platform and goes to the provider of that app. The provider is chosen by you and is not our sub-processor. It handles the information under its own terms, may process it outside the United Kingdom, and, depending on your arrangements with it, may keep it or use it to train its models.

You are responsible for:

• Deciding whether to switch the connection on, and which actions to allow.
• Which AI apps your Authorised Users may use, and the privacy, retention and training settings you hold with their providers.
• What your Authorised Users ask an AI app to do, and checking what it produces before relying on it.
• Meeting any obligation you owe to a studio or rights-holder about the use of AI tools on its production.

We are responsible for the security of the connection on our side, as we are for the rest of the platform. We are not responsible for what an AI app or its provider does with information once it has left the platform, for any disclosure that results from your settings or your choice of AI app, for the accuracy of anything an AI app produces, or for anything an AI app does in the platform at an Authorised User’s request.

Using an AI app to do your own work in the platform is permitted. Using one, or any other tool, to do what Protecting the platform or Competing products prohibits is not.

Fees

If you subscribe through the platform, the fees, the billing period and what your subscription includes are the ones shown to you before you pay, and they are confirmed by email. If you hold a negotiated agreement with us, the fees and payment terms in that agreement apply instead. All fees are exclusive of VAT and other applicable taxes.

Our Billing and Subscription Terms form part of these Terms and set out subscription billing, credits, cancellation and refunds.

Confidentiality

“Confidential Information” is information one party discloses to the other that is marked confidential or that a reasonable person would understand to be confidential. Ours includes the non-public parts of the Origami Materials, anything shown or supplied during Evaluation Access (other than what we show publicly, for example at a trade show or on our website), features we have not released, pricing we have not published, our security measures and our plans for the platform. Yours includes Customer Content.

Each party will protect the other’s Confidential Information with reasonable care, use it only for the purposes of these Terms, and share it only with people who need it for those purposes and are bound to keep it confidential. This does not apply to information that is public through no fault of the recipient, was already lawfully known to the recipient, is independently developed without using it, or is required to be disclosed by law.

These obligations continue for 5 years after your access to the platform ends or, if you never had an account, after the last time we showed or gave you the information, and for as long afterwards as the information remains a trade secret.

Security

We maintain a security programme designed to protect the platform and your data, including encryption in transit (TLS 1.2 or higher) and encryption at rest (content held on AWS S3 uses AES-256 server-side encryption; the platform metadata database is encrypted at rest by our infrastructure provider), multi-factor authentication for sign-in with an email and password, unique per-user credentials, role-based least-privilege access, logging and monitoring, and a documented incident-response process. We design our security programme with reference to the MPA Content Security Best Practices. We hold only the security certifications we tell you about in writing. You are responsible for deciding whether the platform meets the obligations you owe to a studio or rights-holder, and we are not bound by a studio’s requirements unless we have signed them.

Warranties

We warrant that the platform will perform materially in accordance with our documentation during your subscription. Except as expressly stated, and to the fullest extent the law allows, the platform is provided “as is” and we exclude all implied warranties, including fitness for a particular purpose. Evaluation Access, including free trials, beta and preview features, is provided “as is” with no warranty.

We do not promise that the platform will be uninterrupted or free of errors, and we give no service level unless we have signed one with you. If the platform does not perform as our documentation describes, we will fix it or, if we cannot within a reasonable time, you may cancel and we will refund the fees for the period you could not use it. That is your only remedy for a breach of this warranty.

Keep your own copies

The platform is not a backup or an archive. You must keep an independent copy of all source media, and you must check what the platform produces before you rely on it, deliver it or delete the source. We are not liable for loss of or damage to media or data that an independent copy would have avoided, for the cost of re-shooting, re-rendering or re-delivering, or for a missed deadline or a charge your client makes because of one.

Liability

Nothing in these Terms limits or excludes either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded under English law. Subject to that, and to the fullest extent permitted by law:

• Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, goodwill, or business interruption.
• Each party’s total aggregate liability arising out of or in connection with these Terms is limited to the total fees paid or payable by the Customer in the 6 months before the event giving rise to the claim.

Neither of those two limits applies to your obligation to pay fees, to your liability under Indemnity, to your deliberate breach of Protecting the platform or Competing products, to your deliberate misuse of our Confidential Information, or to any infringement of our intellectual property rights. This is so whether or not you have paid us anything, including during Evaluation Access.

Where you and Origami sign a separate agreement, the liability provisions of that agreement apply in place of this clause only to the extent that agreement expressly sets a limit on liability.

Indemnity

You will indemnify us against claims, and the reasonable costs of dealing with them, brought against us by anyone else, including your clients, a studio or rights-holder, the people you invite and regulators, that arise from your Customer Content, from anyone you give access to, from a service you connect, or from your use of the platform in breach of these Terms or the law. This does not apply to the extent we caused the claim by breaking these Terms. We will tell you promptly about a claim, let you run the defence, and not settle it without your agreement.

Remedies

A breach of Protecting the platform, Competing products or Confidentiality could cause us harm that money alone would not put right. We may ask a court for an injunction or other order to stop or prevent it, in addition to any other remedy we have.

Suspension and termination

We may suspend or terminate access if you materially breach these Terms or the Acceptable Use Policy, fail to pay, or create a security risk, giving notice and an opportunity to cure where reasonable. You can cancel as set out in the Billing and Subscription Terms or, if you have one, your signed agreement. On termination, your right to use the platform ends. We will make Customer Content available for export for 30 days and then delete it in line with the Data Processing Agreement, unless the law requires us to keep it. What we hold, and for how long, is set out under What we keep, and for how long.

These clauses continue to apply after termination, however it comes about: People you invite, Our intellectual property, Protecting the platform, Competing products, Confidentiality, Keep your own copies, Liability, Indemnity, Remedies, General and Governing law.

Changes to these Terms

We may update these Terms. The current version is published here with its version identifier and effective date. A new version applies from its effective date to anyone who accepts it on or after that date. If you already hold an account and the change is material, we will tell you at least 30 days before it applies to you. Continued use after changes take effect means you accept them.

General

These Terms are the entire agreement on their subject matter and supersede prior discussions, subject to any separate signed agreement, which prevails except as stated in Liability. Neither party may assign without the other’s consent, except to a group company or buyer of the business. If a clause, or part of one, is unenforceable, it applies to the fullest extent the law allows and the rest stands. Failure to enforce a right is not a waiver. Neither party is liable for a failure or delay caused by something outside its reasonable control, including a failure of the internet, of a hosting, storage or transfer provider, or of your own equipment and storage. You confirm that you are not subject to UK, EU or US sanctions and will not use the platform in, or for anyone in, a sanctioned territory.

Governing law

These Terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction. We may also ask any court, in any country, for an urgent order to protect our intellectual property or Confidential Information.

Acceptable Use Policy

This Acceptable Use Policy (“AUP”) governs how you and your Authorised Users may use the Origami Platform. It forms part of the Terms of Use. By using the platform, you agree to it and are responsible for your users’ compliance. This policy defines what is and is not authorised. Accessing or using the platform outside this authorisation may also be a criminal offence under the Computer Misuse Act 1990.

You must not

Security and access

• Access any account, data, or part of the platform you are not authorised to access, or circumvent any access control, authentication, or usage limit.
• Probe, scan, or test the vulnerability of the platform, or conduct any penetration testing, without our prior written consent (see Responsible disclosure below).
• Introduce malware, or any code or material intended to harm, disrupt, or gain unauthorised access to the platform or its data.
• Interfere with or place an unreasonable load on the platform, including through abusive automated traffic or misuse of the API.

Protecting the platform

• Do anything prohibited by Protecting the platform or Competing products in the Terms of Use, including reverse engineering the platform by any method or using it to build or advance a Competing Product.
• Use a script, bot, AI agent or other automated means to access the platform, other than through the connections we provide for that purpose and within their limits.
• Share your credentials, or show or record the platform for anyone other than your own people and those working on your productions.

Content and conduct

• Upload or process content you do not have the rights to use, or that infringes intellectual property, breaches confidentiality, or is unlawful, defamatory, obscene, or otherwise prohibited (including under the Online Safety Act 2023).
• Use the platform in any way that would breach your own content-security obligations, including obligations you owe to studios or rights-holders under the MPA Content Security Best Practices, the Trusted Partner Network, or a studio’s own requirements, or that would compromise the security of pre-release production media.
• Use the platform to send spam or unlawful marketing, or to harass any person.
• Breach any applicable law, including data protection, sanctions, and export-control law.

Responsible disclosure

We welcome reports of security issues. If you believe you have found a vulnerability, please contact support@origamiplatform.io and give us a reasonable opportunity to investigate and fix it before any public disclosure. Good-faith testing carried out under, and within the scope of, our prior written authorisation will not be treated as a breach of this policy.

Enforcement

If we reasonably believe this policy has been breached, we may investigate, remove or disable content, and suspend or terminate access, as set out in the Terms of Use. Where a breach creates a security or legal risk, or affects pre-release content, we may act immediately and will tell you as soon as we reasonably can. We will cooperate with law enforcement where appropriate. To report misuse, contact support@origamiplatform.io.

Evaluation Terms

Version 2026-10-11, effective 11 October 2026.

These Evaluation Terms apply when we show you the Origami Platform or let you try it before you subscribe: a demonstration given by our team in person or on a call, a demo account, a trial, or a preview of a feature we have not released. They form part of the Terms of Use, and words defined there mean the same here.

You accept these terms when you tick the box to book a demo, when you create or are given a demo account, or when you take part in a demonstration after being told they apply. You accept them for yourself and, where you are acting for an organisation, for that organisation. If you are not able to accept for your organisation, tell us before the demonstration. If you do not agree, do not book or attend a demonstration and do not use a demo account.

Key terms to read. What we show you is confidential. You must not reverse engineer, copy or imitate it, by any method, or use it to build or advance a competing product. An organisation given Evaluation Access must not develop a competing product for 12 months afterwards. Liability is not capped for deliberately breaking these rules or for infringing our intellectual property.

What you may do

You may use what we show or give you only to decide whether Origami is right for your organisation. This is a limited, revocable permission. It gives you no other right in the Origami Materials, and we may end it at any time.

What you must not do

Protecting the platform and Competing products in the Terms of Use apply to you as they apply to a Customer, and they cover everything you see, hear or are given, including the platform itself, recordings, screenshots, slides and documents. In particular, you must not:

• Record or capture a demonstration without our agreement, or pass a recording, screenshot or description of one to anyone who develops a Competing Product.
• Ask for or attend a demonstration, or use a demo account, in order to study, copy or imitate the platform, or on behalf of anyone who develops a Competing Product.
• Give false or misleading information about who you are, who you work for or why you want to see the platform.

The 12-month restriction in Competing products binds the organisation you act for, not you personally. As an individual you are bound by the rest: how you may use what you see, and keeping it confidential.

Confidentiality

What we show or give you, other than what we show publicly (for example at a trade show or on our website), is our Confidential Information, and Confidentiality in the Terms of Use applies to it. That includes anything about features we have not released and pricing we have not published.

No commitment, no warranty

Neither of us is obliged to enter into a subscription. A demonstration, demo account, trial or preview is provided “as is”, and features shown before release may change or never be released. How demo accounts are limited is set out in our Billing and Subscription Terms.

How long these terms last

These terms continue after the demonstration or trial ends, whether or not you subscribe. Liability, Remedies and Governing law in the Terms of Use apply to them.

Website Terms

These terms apply to this website, including our documentation, videos and images. By using the site you agree to them.

We and our licensors own the site and everything on it. You may read it, link to it and quote short extracts with a link back. Search engines and AI assistants may index our pages and refer to them when answering questions about Origami.

You must not copy the site or its contents in bulk, whether by scraping, crawling or any other automated means, in order to reproduce them, to build or describe a Competing Product (as defined in the Terms of Use), or to train an artificial intelligence system to reproduce or imitate the Origami Platform. You must not present our content as your own, or remove our notices from it.

The site describes the platform in general terms and is not a promise that any feature will be available to you. What you receive is set out in the Terms of Use and, if you subscribe, in what is shown to you before you pay. We are not liable for any reliance you place on the content of this site, except as the Terms of Use say about our documentation. These terms are governed by the laws of England and Wales.

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Use or other agreement (the “Agreement”) between Origami Platform Ltd (“Processor”, “Origami”) and the customer organisation (“Controller”, “you”). It governs Origami’s processing of personal data contained in Customer Content on your behalf and on your instructions. Where there is a conflict on data-protection matters, this DPA prevails over the rest of the Agreement.

Origami acts as your processor for this data. Origami’s processing of personal data as a controller (for example account, analytics and marketing data) is described in the Privacy Policy section above and is not covered by this DPA. Origami does not use Customer Content for any purpose other than providing the service to you.

Definitions

“UK Data Protection Law” means the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025). “Controller”, “processor”, “personal data”, “processing”, “data subject”, and “personal data breach” have the meanings given in UK Data Protection Law. “Sub-processor” means a third party engaged by Origami to process personal data under this DPA.

Roles and instructions

You are the controller and Origami is the processor of the personal data described in the Details of processing below. Origami will process that personal data only on your documented instructions, which include the Agreement, this DPA, and the instructions you give through your configuration and use of the platform, including any automated processing actions that the platform performs to deliver your jobs. Where you switch on AI apps or connect another service, sending data to that service when one of your users asks for it is processing on your instruction, and its provider is not Origami’s sub-processor. Origami will not process the personal data for its own purposes. It will act otherwise only if required by law, in which case it will tell you first unless the law forbids it. Origami will tell you if, in its opinion, an instruction infringes UK Data Protection Law. You warrant that your instructions and the personal data you provide comply with UK Data Protection Law, and that you have a lawful basis for the processing.

Confidentiality

Origami ensures that everyone authorised to process the personal data is bound by a duty of confidentiality.

Security

Origami will implement and maintain the technical and organisational measures set out below, taking account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to data subjects.

Sub-processors

You give Origami general authorisation to engage sub-processors to process the personal data, provided Origami imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to you for each sub-processor’s performance. Origami’s current sub-processors are listed in the Sub-processors section below. Origami will give you at least 30 days’ notice before adding or replacing a sub-processor that processes the personal data, by updating that list and notifying you. If you reasonably object on data-protection grounds within that period, the parties will work in good faith to resolve it, and if they cannot, you may terminate the affected part of the service.

Assisting you

Taking account of the nature of the processing, Origami will assist you by appropriate technical and organisational measures, insofar as possible, to respond to data-subject requests. If Origami receives a request directly, it will not respond (except to direct the individual to you) and will forward it to you without undue delay. Origami will assist you in complying with your obligations on security, breach notification, data protection impact assessments, and prior consultation, taking account of the nature of processing and the information available to Origami.

Personal data breaches

Origami will notify you without undue delay after becoming aware of a personal data breach affecting the personal data, and in any event within 72 hours. The notice will include the information then available to help you meet your own notification obligations, with further information provided in phases as it becomes known. Origami does not notify the ICO or data subjects on your behalf unless you instruct it to.

Return and deletion

On termination or expiry, or on your earlier request, Origami will, at your choice, delete or return the personal data and delete existing copies, unless the law requires it to be kept. Customer Content is available for export for 30 days after termination, matching the Terms of Use. Copies in backups are overwritten on their normal cycle, and the records listed under What we keep, and for how long are kept for the periods stated there.

Audits and information

Origami will make available to you the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, by you or your appointed auditor. The parties will agree reasonable scope, timing, and confidentiality, and Origami may satisfy this obligation by providing a recognised third-party audit report or security documentation under a non-disclosure agreement where available.

International transfers

Your media and the production metadata database are hosted in the United Kingdom, on AWS in London (eu-west-2), as is the application itself. Some of the providers listed under Sub-processors below are outside the UK and receive limited data, such as the project, job and file names that appear in a notification email, an operational alert or a log record. Origami will not transfer the personal data outside the UK without an appropriate safeguard under UK Data Protection Law (an adequacy decision, the UK-US Data Bridge where applicable, or the UK International Data Transfer Agreement or UK Addendum to the EU SCCs). This DPA and its Annexes are intended to satisfy Article 28(3) of the UK GDPR. Where the UK IDTA or the UK Addendum applies to a transfer, those clauses prevail over this DPA to the extent of any conflict in respect of that transfer.

Details of processing

• Subject matter: provision of the Origami post-production workflow platform to the Controller.
• Duration: for the term of the Agreement and any wind-down, return-or-delete period.
• Nature and purpose: hosting, organising, transmitting, transforming and displaying production assets and metadata so that production metadata travels through the Controller’s pipeline. This includes automated processing actions the platform performs to deliver the Controller’s jobs. How long each kind of data is held is set out under Sub-processors below; production assets otherwise remain in the storage the Controller connects under its own account.
• Types of personal data: personal data incidentally contained in production metadata and assets, for example names and work contact details of crew, vendors or contacts, and delivery-destination account identifiers.
• Categories of data subjects: the Controller’s personnel, freelancers, vendors, and contacts whose details appear in the production data.
• Special-category data: none intended. The platform is not designed to process special-category data.

Technical and organisational measures

• Access control: multi-factor authentication for sign-in with an email and password (a Google sign-in relies on the protection of the Google account), unique per-user credentials, and role-based least-privilege access enforced at the application layer.
• Encryption: TLS (minimum 1.2) for data in transit; content held on AWS S3 uses AES-256 server-side encryption; the platform metadata database is encrypted at rest by AWS’s managed database service; and credentials you give us are stored with authenticated encryption.
• Logging and monitoring: application and security logging with automated redaction of secrets before storage. Application logs are kept for 30 days and then archived for up to 400 days. The audit log of who did what is kept for 13 months and then archived for 7 years. A record of each AI app request is kept for 12 months.
• Tenant separation: logical separation of customer data and project-level access controls.
• Incident response: a documented incident-response and breach-notification process.
• Personnel: a duty of confidentiality on staff with access, and access limited to those who need it.
• Sub-processor management: due diligence and flow-down of obligations.
• Resilience and deletion: database backups kept for 7 days, working copies of media cleared after about 24 hours, and deletion of data on termination.

This DPA is governed by the laws of England and Wales. Liability under this DPA is subject to the limitations set out in the Agreement. These measures are designed with reference to the MPA Content Security Best Practices.

Sub-processors

This lists the third parties that Origami Platform Ltd engages to help provide the Origami Platform. We keep it current and give notice of changes as described in the Data Processing Agreement above. We distinguish the providers that handle customer production data from those that support our own operations, because they map to our two roles under data protection law.

Sub-processors of customer production data

These process personal data that may be contained in Customer Content, where we act as your processor.

What we keep, and for how long

Working copies of your media, made while a job runs, are cleared after about 24 hours, or after the longer period set for a project. Files uploaded to a project (such as clip lists, sidecar and reference files) and the proxies we make for viewing and delivery are kept until we delete them. Metadata, file names, job history and project records are kept for the life of your account. Deleting a project removes it from the platform; the files we hold for it are deleted when your account closes, or earlier if you ask us. When your account closes, our team deletes what we hold for it within 30 days of the closure being confirmed. Database backups are overwritten within 7 days.

Some records are kept for fixed periods and are not deleted when an account closes: application logs (30 days, then archived for up to 400 days), the audit log of who did what (13 months, then archived for 7 years), records of AI app requests (12 months), and records of who accepted which version of our terms. Notification emails and operational alerts that have already been sent stay with the providers listed above under their own retention settings, and a session replay stays with the analytics provider for the period it sets. Your source media otherwise remains in the storage you connect.

Services you connect under your own account

Some transfer and storage services are used through your own account, not ours, so they are not our sub-processors. We integrate with them at your direction: IBM Aspera and Signiant MediaShuttle for high-speed file transfer, using your own account; and storage you connect (for example AWS, Wasabi, Backblaze, Storj or Lyvecloud), which remains under your own account and control.

The same is true of any other service you choose to connect, such as an on-set metadata service, an editing application or an AI app. Its provider acts for you under your own agreement with it, as set out under Services you connect and AI apps in the Terms of Use.

Our own service providers

These support our own operations and process our controller data, described in the Privacy Policy above, rather than Customer Content.

We also use internal tools (for example for meeting notes and source control) that do not process Customer Content.

We carry out due diligence before engaging a sub-processor, bind each by contract to data-protection obligations no less protective than ours, and remain responsible to you for their performance. We give at least 30 days’ advance notice of any addition to, or replacement of, a sub-processor that processes customer production data, so you can raise any reasonable objection. Notice is sent to the supervisor contact on your account and this page is updated. To keep your contact details current, contact support@origamiplatform.io.