Your content is processed to make the video you request.

1. Scope and our role

This policy applies to the StoryFluxa website, creator workspace, account and billing features, AI video workflows and supported social publishing connections. It does not replace the privacy policies of TikTok, Google/YouTube, Meta/Instagram, Stripe or other third-party services you choose to use.

2. Data we collect

Account and support information

• Email address, authentication identifiers and secure session information.
• If you continue with Google, Google provides Supabase Auth with your verified email address, name, profile image and Google account identifier for authentication. StoryFluxa does not receive your Google password.
• Server-controlled records showing the legal terms version, acceptance method and acceptance time when an account is created or Google sign-in is used.
• Messages and diagnostic information you send to support.

Content and project information

• Reference videos or public links, product footage, presenter videos, voice samples, transcripts, scripts, captions, covers, music and finished renders.
• Project settings, generation status, provider job identifiers, usage, errors and credit records.
• Voice and content-rights confirmations, including the time you confirmed you had permission to use a voice, likeness, media or music.

Connected social account information

• When social publishing is enabled and you connect an account: the platform account identifier, display name, granted permissions, authorization tokens, token expiry, publishing choices and post status returned by the platform.
• We do not ask for or store your TikTok, Google/YouTube or Instagram password.

Billing and technical information

• Stripe customer and subscription identifiers, payment status, plan, credit balance and transaction history. StoryFluxa does not receive your full card number.
• IP address, browser and device details, request logs, cookie identifiers, security events and performance/error logs.

3. How we use data

• Authenticate users by email and password or, when selected, through Google as an identity provider, and keep each workspace private.
• Automatically associate a verified Google identity with an existing Supabase user that has the same verified email address so the user retains one workspace and credit account.
• Upload, transcribe, rewrite, generate voice, synchronize lips, render, store and deliver videos and related assets.
• Publish content to a social account only after the user selects the account, post settings and publishing action.
• Process subscriptions, credits, usage and service-related communications.
• Secure the service, prevent abuse, troubleshoot failures and comply with legal obligations.
• Improve reliability and usability using operational information. We do not sell personal data or use connected-platform data for targeted advertising.

Where applicable law requires a legal basis, we rely on performance of our contract, legitimate interests in operating and protecting the service, compliance with law, and consent where the law or a platform requires it.

4. AI and media processing

Depending on the feature and server configuration, StoryFluxa may send the minimum necessary text, audio, video or image inputs to model and media-processing providers. These may include Runpod-hosted workers, OpenRouter and its selected model provider, OpenAI, Google, ElevenLabs or Sync Labs.

• Reference audio may be sent for transcription.
• Transcripts, product briefs and scripts may be sent for rewriting or safety review.
• Authorized voice samples and text may be sent for voice generation.
• Presenter video and generated audio may be sent for lip synchronization or rendering.

StoryFluxa does not use customer content to train a StoryFluxa general-purpose AI model. We do not authorize third parties to use connected Google user data or social authorization data to train general-purpose AI models. Provider retention and training controls must be configured consistently with this policy before a provider is enabled in production.

5. TikTok, YouTube and Instagram data

• TikTok: access is used to identify the selected creator account, load allowed posting choices, send a draft or publish a post, and check status.
• YouTube: Google user data and the YouTube upload permission are used to upload the selected Short and set the title, description, audience and visibility chosen by the user.
• Instagram: access is used to identify an authorized professional account, create the selected Reel and check publishing status.

Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We request the narrowest permissions needed, do not sell connected-platform data, and do not transfer it for advertising or data-broker purposes.

You can revoke StoryFluxa from the relevant platform settings. Revocation stops future API access but does not automatically delete content that was already published on that platform.

6. When data is shared

We share data only as needed to provide the service, protect users, complete a transaction or follow law. Categories of recipients may include:

• Authentication: Supabase Auth manages email/password and Google OAuth identities and secure application sessions; Google acts as the identity provider only when you choose Google sign-in.
• Hosting and storage: Vercel, Supabase and Cloudflare R2.
• AI and media processing: the configured Runpod workers and, when enabled, OpenRouter/model providers, OpenAI, Google, ElevenLabs or Sync Labs.
• Payments: Stripe.
• User-directed publishing: TikTok, Google/YouTube and Meta/Instagram.
• Professional and legal recipients: advisers, authorities or transaction counterparties when reasonably required and legally permitted.

We require service providers to process data for the contracted service and apply appropriate safeguards. We do not sell your uploaded content or social account data.

7. Cookies

StoryFluxa currently uses essential cookies and similar storage for authentication, session continuity, security and saved workspace state. Stripe or connected platforms may set their own cookies when you visit their checkout or authorization pages. If StoryFluxa later adds non-essential analytics or advertising cookies, we will provide any notice and choice required by applicable law before using them.

8. Retention and security

• Account and project content is normally retained while your account is active or until you delete it or request deletion.
• Google sign-in uses the resulting Supabase application session; StoryFluxa does not store a Google access token or refresh token for authentication-only login.
• Social publishing authorization tokens are retained until they expire, you disconnect the account, the platform revokes them, or your StoryFluxa account is deleted.
• Billing, credit, fraud-prevention, security and legal records may be retained for the period required by tax, accounting, dispute and legal obligations.
• Backups and provider logs may take additional time to age out under controlled retention schedules.

StoryFluxa uses private object storage, row-level access controls, short-lived signed media links, server-only provider credentials and access checks. No internet service can promise absolute security, so please report suspected unauthorized access promptly.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete or restrict certain processing, withdraw consent, or object to some uses. You may also:

• Disconnect a social account in StoryFluxa when that control becomes available and revoke the app directly in the platform's account settings.
• Delete individual project assets where the workspace provides a delete control.
• Request account and data deletion using our data deletion instructions.
• Contact us to ask what personal data is associated with your account.

We may verify your identity before completing a request. You may appeal or contact your local privacy authority where applicable.

10. International transfers

StoryFluxa and its providers may process data in countries other than your own. Where required, we use contractual or other recognized safeguards for international transfers. The availability and location of a specific processor may depend on the provider configuration used for your generation.

11. Children

StoryFluxa is a commercial creator tool and is not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to create an account. Do not upload a minor's voice, likeness or personal data unless you have all legally required parental or guardian permissions.

12. Changes to this policy

We may update this policy when the product, providers or legal requirements change. We will update the effective date and provide additional notice when a material change requires it.

13. Contact

Data controller/operator: StoryFluxa AI (individual operator).

Privacy and support email: support@storyfluxa.com.