Privacy Policy
Kyrve
Last updated: [DATE] Effective: [DATE]
1. The short version
- You upload photographs. We send them to third-party AI companies, some of them outside the UK, including in the United States and China, so they can generate video.
- We keep your uploads for [30 days] and your generated videos until you delete them or close your account.
- We do not sell your data and we do not use your photographs to train AI models.
- If you upload a photograph of someone else, you are responsible for having their permission.
The rest of this policy sets that out properly.
2. Who is responsible for your data
[COMPANY NAME] Ltd is the data controller. We are registered in England and Wales, company number [NUMBER], registered office [ADDRESS].
We are registered with the Information Commissioner's Office, registration number [ICO NUMBER].
Contact us about anything in this policy at [PRIVACY EMAIL].
3. What we collect
3.1 Account data
Your email address, display name, and authentication details. If you sign in with Google, we receive your email address and name from Google.
3.2 Photographs you upload
Images you upload to fill template slots. These typically contain faces.
3.3 Content you create
Generated images and videos, the templates and settings you used, and any text you typed — names, dialogue, captions.
3.4 Usage data
Which templates you use, how many generations you run, credits consumed, and basic technical information: IP address, browser, device type, timestamps.
3.5 Payment data
Our payment provider, [PADDLE / LEMON SQUEEZY / STRIPE], handles your card details. We never see or store them. We receive confirmation of payment, your plan, and partial card details for identifying transactions.
3.6 Moderation records
Where our automated checks flag an upload or an output, we record what was flagged, when, and what we did about it.
4. Facial images
Photographs of faces are personal data about the person in them.
We use them for one purpose: generating the video you asked for. Specifically, we send them to third-party models which produce new images and video depicting a likeness of the person shown.
We do not use facial recognition. We do not create a biometric template, we do not attempt to identify anyone, and we do not match faces across accounts or against any database.
[LEGAL REVIEW NEEDED: whether this processing engages Article 9 UK GDPR as biometric data depends on purpose. We believe it does not, because we do not process for the purpose of uniquely identifying a person. A solicitor should confirm this before publication, and the answer changes what else this policy must say.]
5. Photographs of other people
If you upload a photograph of someone who is not you, that person is a data subject too, and we have no direct relationship with them.
You are responsible for having their permission. We ask you to confirm it and we rely on that confirmation.
If you are the person in an image someone else has uploaded, contact us at [PRIVACY EMAIL]. We will act on your request, remove the content, and tell you what we hold. You do not need an account to make this request.
6. Why we process your data, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account | To provide the service you signed up for | Performance of a contract |
| Process your uploads and generate video | It is the service | Performance of a contract |
| Take payment and manage credits | To charge you correctly | Performance of a contract |
| Screen uploads and outputs for harmful content | To keep the service safe and meet our legal obligations | Legitimate interests; legal obligation |
| Keep moderation and abuse records | To act on reports and defend claims | Legitimate interests |
| Diagnose faults and improve the service | To make it work properly | Legitimate interests |
| Send service emails (receipts, failures, changes) | To keep you informed | Performance of a contract |
| Send marketing emails | To tell you about new templates and features | Consent — you can withdraw it at any time |
| Show your work publicly | Only if you opt in | Consent |
Where we rely on legitimate interests, we have considered your rights and concluded our interest does not override them. You can ask us about that assessment.
7. Who we share your data with
7.1 AI model providers
To generate video we send your photographs and our instructions to third-party model providers. Your images leave the UK.
| Provider | Role | Location |
|---|---|---|
| fal.ai | Routes our requests to the models below | United States |
| OpenAI | Image generation (GPT Image) | United States |
| Image generation (Nano Banana) | United States | |
| MiniMax | Video generation (H3 Max) | China / Singapore |
| ByteDance | Video generation (Seedance) | China / Singapore |
This list changes as models change. We will keep it current, and the version in force is the one published here.
These providers process your images to produce output. We select providers who state they do not train on API inputs, but we cannot guarantee how a third party behaves. If that matters to you, do not upload the image.
7.2 Infrastructure
| Provider | Role | Location |
|---|---|---|
| [LOVABLE CLOUD / SUPABASE] | Database, authentication, file storage | [REGION] |
| [CLOUDFLARE] | Media storage and delivery | Global |
| [PADDLE / LEMON SQUEEZY / STRIPE] | Payments | [REGION] |
| [EMAIL PROVIDER] | Transactional email | [REGION] |
7.3 Everyone else
We also share data with our professional advisers, and with law enforcement or regulators where we are legally required to. We do not sell your data to anyone, ever.
8. International transfers
Your data is transferred outside the United Kingdom, including to the United States and to China.
Where a country has not been found to provide adequate protection — which includes China — we rely on [the UK International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses] and have carried out a transfer risk assessment.
[LEGAL REVIEW NEEDED: the transfer mechanism for Chinese providers must be confirmed and documented before launch. This is the single highest-risk item in this policy.]
You can ask us for details of the safeguards in place at [PRIVACY EMAIL].
9. How long we keep things
| Data | Retention |
|---|---|
| Uploaded photographs | [30 days] from upload, then deleted |
| Generated images and videos | Until you delete them or close your account |
| Account data | While your account is open, then [90 days] |
| Payment and transaction records | 7 years (tax law) |
| Moderation records | [2 years], or longer if needed for a legal claim |
| Usage logs | [12 months] |
10. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate;
- delete your data (this does not always apply — for example we must keep payment records);
- restrict or object to our processing;
- transfer your data to another service in a portable format;
- withdraw consent where we relied on it, at any time.
Email [PRIVACY EMAIL]. We will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — though we would appreciate the chance to put it right first.
11. Security
We protect your data with encryption in transit and at rest, access controls so you can only reach your own content, private storage with time-limited access links, and restricted staff access.
No system is perfectly secure. If a breach affects your rights we will tell you and the ICO as the law requires.
12. Automated decisions
We use automated systems to screen uploads and outputs for harmful content. A generation may be refused automatically.
This does not produce legal effects for you and you can always contact us to ask a human to look at it.
13. Cookies
We use cookies that are necessary for the service to work — keeping you signed in, remembering your preferences, and basic security.
[IF YOU ADD ANALYTICS OR ADVERTISING COOKIES YOU MUST ADD A CONSENT BANNER AND LIST THEM HERE. DO NOT SKIP THIS.]
14. Children
Kyrve is for people aged 18 and over. We do not knowingly collect data about anyone under 18. If we learn that we have, we will delete it.
You must not upload photographs of anyone under 18.
15. Changes
We may update this policy. If a change materially affects you we will tell you by email or in the app before it takes effect. The date at the top shows when it last changed.
16. Contact
[COMPANY NAME] Ltd [ADDRESS] [PRIVACY EMAIL]
ICO registration: [NUMBER]
[DRAFT — NOT YET REVIEWED BY A SOLICITOR. DO NOT PUBLISH IN THIS STATE.]