Privacy Policy

This policy explains how ShuruAI (“ShuruAI”, “we”, “us”) handles personal data when you use shuruai.app and the ShuruAIstudio, marketplace and API (the “Service”). We are the controller of the personal data described here.

It should be read with our Terms of Service. Where this policy talks about content you upload, we mean the material described there as “Your Content”.

Information you give us

• Account details: your email address and, if you choose one, a password. Passwords are stored by our authentication provider in hashed form; we cannot read them.
• Profile details: the display name, avatar and any public profile information (such as a username or bio) you add.
• Your Content: photos, videos, audio and script files you upload, the prompts and instructions you write, and the actors, projects and settings you create. If you build an actor from a real person, this includes images, video or audio of that person.
• Marketplace details: listings you publish, the terms you accept when listing, and licences you buy or sell.
• Messages: what you send us when you contact us.

Information created when you use the Service

• Outputs: the images, videos, audio and scripts the Service generates for you, and the history of your generation requests.
• Credits and billing records: your plan, billing dates, credit balance and a ledger of credits added, spent and refunded.
• Technical data: IP address, browser and device information and timestamps, recorded in server and authentication logs when you use the Service.

Information from payment providers

Card payments are handled by Square and PayPal payments by PayPal. You enter your payment details with them, not with us, and we never receive or store your full card number. We keep the references they return, such as a customer ID, a saved-card reference used for renewals, payment and order IDs, and the payment status. If you connect a payout account to receive marketplace earnings, Stripe collects the identity and bank details it needs, and we keep your Stripe account ID and its status.

• To create and secure your account and sign you in, including sending confirmation and sign-in emails.
• To generate the Outputs you ask for, store them, and show your work back to you.
• To run your plan: take payments, add and deduct credits, refund failed generations and process creator payouts.
• To run the marketplace, including reviewing actors for likeness consent and content suitability before listing.
• To publish work and profiles that you choose to make public.
• To keep the Service safe: automated checks on generation prompts, detecting abuse and fraud, and enforcing our Terms.
• To troubleshoot problems, and to understand and improve how the Service performs.
• To reply to you and to tell you about changes to the Service, these policies or your account.
• To meet legal, tax and accounting obligations.

Where data protection laws such as the GDPR or UK GDPR apply, we rely on these legal bases:

• Contract: to provide the Service you signed up for, including generation, storage, billing, credits, the marketplace and payouts.
• Legitimate interests: to keep the Service secure, prevent abuse and fraud, moderate content, and improve the Service, balanced against your rights.
• Consent: for things you switch on yourself, such as publishing work publicly or allowing us to feature it in our marketing. You can withdraw consent at any time; this does not affect what we did before.
• Legal obligation: to keep financial records and respond to lawful requests.

Images, video or audio of a person can reveal sensitive information. Where you upload material of another person, you are responsible for having their consent, as the Terms require.

To generate an Output, we send the relevant prompts, instructions and uploaded files to the AI model and infrastructure providers that run the generation, and receive the result back. Prompts are also checked by automated moderation, which may include an AI classifier.

These providers process the data on our behalf to perform the request. We do not sell your content, and we do not use your uploads, prompts or Outputs to train AI models of our own.

We do not sell your personal data. We share it only with:

• AI model and infrastructure providers that generate Outputs and run moderation checks.
• Hosting, database and file storage providers that run the Service and store your account, content and Outputs.
• Payment processors: Square and PayPal for payments, and Stripe for creator payouts.
• Email delivery providers that send account confirmation, sign-in and password-reset emails.
• Other users and the public, but only for what you choose to publish: showcase items, public profiles and marketplace listings. Buyers of a marketplace licence can use the licensed actor or script.
• Authorities and advisers where the law requires it, or where needed to protect people, enforce our Terms or defend legal claims.
• A buyer or successor if we are involved in a merger, acquisition or sale of assets, under the same protections as this policy.

Service providers may use your data only to provide their service to us.

Generated files are stored at long, unlisted links so they load quickly in the studio and can be downloaded and shared. Unlisted links are not published or indexed, but anyone who has a link can open the file. Only share links with people you want to see the file.

• Account, content and Outputs: for as long as your account is open, or until you delete the item or ask us to delete it.
• Billing and credit records: for as long as tax and accounting law requires, even after the account is closed.
• Marketplace licences: records of licences bought and sold are kept while those licences remain in effect and as long as needed for payouts and accounting.
• Logs: for a limited period for security and troubleshooting.
• Deleted data can remain in backups for a limited time before it is overwritten.

We use encryption in transit (HTTPS), access controls that limit each account to its own data, restricted administrative access, and payment processors that handle card data so it never reaches our servers. No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities as the law requires.

Our providers operate in several countries, so your data may be processed outside the country where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as adequacy decisions or standard contractual clauses.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct it. You can update your profile yourself in your account settings.
• Delete it. There is no self-serve account deletion yet; contact us from the email address on your account and we will delete your account and data, except what we must keep by law.
• Export it. You can download your Outputs from the studio, and you can ask us for a copy of your account data in a portable format.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent where we rely on it, such as for public sharing.
• Complain to your local data protection authority. We would appreciate the chance to resolve your concern first.

We respond within the time the law requires, usually one month. We may need to confirm your identity first. We do not discriminate against you for exercising these rights.

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18, and the Terms forbid creating content of minors. If you believe a child has given us personal data, contact us and we will delete it.

We use only what the Service needs to work. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics.

• Sign-in cookies set by our authentication provider keep you signed in and protect your session. The Service cannot work without them.
• Local storage in your browser remembers interface preferences such as your theme and whether the sidebar is collapsed. It stays on your device.
• Payment pages:when you pay, Square’s card form or PayPal’s checkout loads and may set its own cookies for fraud prevention, under their own policies.

You can clear cookies and local storage in your browser settings; doing so signs you out.

We will update this policy when our practices change. The date at the top shows the latest version. For material changes we will tell you by email or in the product before they take effect.

Questions about this policy or your personal data can be sent to ShuruAI from the email address on your account. We will verify that a request comes from the account holder before acting on it.