Privacy Policy

1. Controller and contact

1. The controller of your personal data (Art. 4(7) GDPR) is (the “Service”, “we”, “us”). We operate the Sharpy AI video generation platform.
2. Data-protection contact point: . General support: [email protected] and the contact form.
3. This notice is provided under Articles 13 and 14 GDPR. It describes what personal data we process, on what legal basis, for how long, who receives it, and what rights you have.

2. Data we collect

• Account and identity data. When you sign in with Google or Apple we receive and store your name (where the provider shares it), email address, provider account identifier, profile picture URL, the provider's profile payload, and login activity data (IP address, operating system, browser, last-login timestamp). We never receive or store your Google/Apple password; registration is OAuth-only.
• Content you create. Your prompts, uploaded images/frames, the generated videos, and per-generation metadata (model, status, credit cost, timestamps, failure reason).
• Billing data. Your wallet balance and its ledger history; orders (package, price, discount, coupon, timestamps) and the Paddle transaction identifier. Paddle is our merchant of record and handles your payment; card details never reach our servers.
• Contact-form messages. The name, email and message you submit. Messages are emailed to our support mailbox and are not stored in the application database.
• Technical data. IP address, user agent, request details and error context in server logs; the strictly necessary cookies listed in section 10. We run no analytics, advertising or cross-site tracking cookies, and we do not sell personal data.
• Administrative audit data. When our staff perform administrative actions, an append-only audit record is written containing the acting admin's user ID, the action, the affected record, and the admin's IP address and user agent. Audit payloads carry identifiers and changed values - never secrets.

3. Purposes and legal bases (Art. 6 GDPR)

• Contract - Art. 6(1)(b). Operating your account and sign-in, generating videos from your prompts, managing your credit wallet, processing orders, delivering receipts and refunds, and answering your support requests.
• Legal obligation - Art. 6(1)(c). Retaining accounting/tax records of purchases for the statutory period, and complying with lawful orders and mandatory reporting duties.
• Legitimate interests - Art. 6(1)(f). Securing the Service (rate limiting, session management, abuse prevention), debugging failures, maintaining audit trails of administrative actions, and enforcing our Terms and acceptable-use policies. Our legitimate interest is the integrity and safety of the platform; you may object (section 8).
• Consent - Art. 6(1)(a). We do not currently process personal data on the basis of consent; no optional (non-essential) cookies or marketing processing exist. If we ever ask for consent (for example for a newsletter), you may withdraw it at any time with effect for the future (Art. 7(3)) without affecting prior processing.

4. Recipients and processors

• AI model providers. Your prompt - and an uploaded image or keyframes when you use them - is sent to the third-party AI model you selected so it can generate the video. The provider acts on our instructions for that step under applicable data-protection terms; provider conditions apply to your use of its model.
• Paddle (merchant of record). Receives the data needed to process your payment, add buyer-local tax and issue receipts: your email and order details. Card data is handled exclusively by Paddle.
• Google and Apple. Authentication flows run through their OAuth services; they process your sign-in under their own privacy terms. We receive only the profile fields listed in section 2.
• Infrastructure processors. Hosting, S3-compatible object storage, cache/queue services and the transactional email transport run the Service under our instructions (Art. 28 processor agreements).
• Authorities. Only where a disclosure is required by applicable law.

We never sell your data, and we do not share it for advertising.

5. Retention

We keep personal data only as long as the purpose requires:

• Account data: for the lifetime of your account, then deleted on closure or deletion request.
• Uploads and generated content: uploaded reference files are deleted automatically after 2 days and generated videos or images after 15 days, whether or not you delete them yourself - download anything you want to keep before then; download links are short-lived (minutes) and files stay on private storage.
• Billing records: order and transaction records are kept for the period required by applicable tax and accounting law (proposed default: 10 years from purchase).
• Server and audit logs: server logs are kept for a limited operational window (proposed default: up to 12 months); administrative audit records follow the related account.
• Support messages: contact-form messages live in the support mailbox only and are deleted there once the conversation is resolved.

6. International transfers (Arts. 44-49 GDPR)

The Service runs on cloud infrastructure that may process data outside the European Economic Area (EEA): object storage in the configured cloud region, Paddle (payment), and the Google/Apple sign-in flows. Where personal data leaves the EEA we rely on the transfer mechanisms of Chapter V GDPR - an adequacy decision for the destination country, or Standard Contractual Clauses plus supplementary measures with the relevant processor. You can request details of the specific safeguards in place via the contact point in section 1.

7. Security measures (Art. 32 GDPR)

Access is role- and permission-restricted; administrative actions are audit-logged; provider API keys are encrypted at rest; uploads and outputs live on private storage and downloads use short-lived signed URLs; forms are CSRF-protected; session cookies are HttpOnly and SameSite, and marked Secure over HTTPS; traffic is TLS-encrypted. No system is perfectly secure - report concerns to .

8. Your rights

1. Where the GDPR (or equivalent local law) applies, you have the right to: access your data (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); and to object to processing based on legitimate interests (Art. 21), including profiling - we do not profile you.
2. How to exercise them: email [email protected] from your account email address (or identify your account clearly). Exercising a right is free of charge. We respond within one month of receipt (Art. 12(3)), extendable by two further months for complex or numerous requests, in which case we will tell you why.
3. Right to complain: you may lodge a complaint with the data-protection supervisory authority of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

9. Automated decision-making (Art. 22 GDPR)

We do not carry out solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Video generation is a technical service you trigger; upstream model safety filters may refuse individual prompts, which is a content-safety measure, not a decision about you with legal effect - and you can always contact support about a refusal.

10. Cookies

1. We use only strictly necessary cookies - the ones without which the Service cannot function. Under the ePrivacy Directive's necessity exemption these require no consent. For transparency we still show a cookie notice on first visit: it explains these cookies and lets you record your preference in your browser; it does not gate any cookie, because there is nothing optional to switch on. We set no analytics, advertising or tracking cookies; if we ever introduce a non-essential cookie, we will ask for your consent before setting it.
2. The cookies we set:
   • sharpy-session - keeps your signed-in session (and guest state such as form inputs). First-party, HttpOnly, SameSite=lax, Secure over HTTPS; expires after 120 minutes of inactivity. Necessary.
   • XSRF-TOKEN - protects forms against cross-site request forgery. First-party; session-scoped rotation. Necessary.
   • remember_web_* - keeps you signed in across browser restarts when you authenticated with “remember me”. First-party, HttpOnly; lifetime set by the framework's remember-me duration. Necessary for the sign-in you chose.
3. You can block or delete cookies in your browser settings; blocking the necessary cookies will stop you from signing in or submitting forms.

11. Account deletion

Email a deletion request from your account address to [email protected]. We then delete your account record, wallet and ledger, stored uploads and generated videos. Data we must retain under Art. 6(1)(c) - for example purchase records required by tax law - survives in restricted form for that statutory period only and is not used for anything else.

12. Children

The Service is not directed at children under 16 (or the minimum digital-consent age in your country of residence, if higher), and our Terms of Service set that age limit. We do not knowingly collect children's data; if you believe we hold any, tell us via the contact point in section 1 and we will delete it.

13. Changes to this policy

We may update this policy as the Service or the law changes; the “Last updated” date above reflects the current version. Material changes are announced in the Service or by email. Continued use after an update takes effect means you have read the revised policy - it does not constitute consent to any new processing that would require consent.