Privacy Policy

1.Who is responsible for your data

ITERO LTD is the controller of the personal data described in this policy. You can contact us about privacy at any time at support@fypzo.com.

When you pay, Stripe and Link (Stripe's merchant of record) collect your payment details and act as independent controllers for that data under their own privacy policies. Google acts as an independent controller when you use Sign in with Google.

2.What we collect

Account details. Your email address and, if available, your name and profile picture. If you sign in with Google, Google shares your name, email address and profile picture with us. We never see your Google password.

Product details and photos. Product names, prices, selling points, descriptions, target audience and product page links that you enter or import, and the product photos you upload or import from a product page.

Links you paste. Links to videos you want broken down, and links to product pages you ask us to read.

Content you create. Uploaded images and clips, scripts, voice-overs, rendered videos, project names and saved library videos; for AI motion videos, the image and motion clip you upload and the confirmations you give.

Billing information. Your plan, credit balance and history, purchases, subscription status, and the customer and subscription IDs Stripe gives us. Payments are handled by Stripe: we never receive or store your full card number.

Removal requests and emails. If you use the removal form or email us, your email address and what you tell us.

Technical data. We use your IP address to apply daily usage limits, limit free credits per network and prevent abuse. We store only a salted one-way hash of it (made with SHA-256 and a secret key), never the address itself. Our hosting providers also process IP addresses, browser details and request logs to deliver the site and keep it secure.

Cookies and local storage. See Cookies and local storage.

3.Public videos and the viral library

When you paste a video link, we fetch the public video and its public details (such as the caption, the creator's handle and engagement numbers) to make a breakdown. The video is analyzed on our processing server and by our AI provider, and our copy is deleted once the analysis is done. We keep the link, the public numbers, the breakdown and low-resolution still frames. We do not host or redistribute the video.

The viral library is built from public TikTok videos collected through Apify. It shows public creator handles, captions, engagement numbers and a small cover image. We use this public information based on our legitimate interest in showing which video formats work, and we do not use it to contact or profile creators. Creators can ask us to remove a video at any time with the removal form or by emailing support@fypzo.com, and can object under data protection law.

4.How we use data and our legal bases

Under the UK GDPR and EU GDPR we need a legal basis for each use of personal data:

To provide Fypzo: create your account, sign you in, make breakdowns, scripts and videos, save your products and projects, and help you when you contact us. Basis: performing our contract with you.
To take payments and manage credits: purchases, subscriptions, credits and refunds, and tax and accounting records. Basis: contract and legal obligation.
To keep Fypzo safe and fair: usage limits, free-credit limits per network, fraud and abuse prevention, security and fixing errors. Basis: our legitimate interests in protecting the service and its users.
To send service emails: sign-in links and important notices about your account, these policies or the service. Basis: contract and legitimate interests. We do not send marketing emails; if we start, we will ask for your consent where the law requires it, and you can unsubscribe at any time.
To improve Fypzo: aggregated breakdown data and error logs that do not identify you, used to improve templates and features. Basis: legitimate interests.
To handle removal requests and legal claims, and to comply with the law. Basis: legal obligation and legitimate interests.

We do not use your photos, product details or outputs to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Where we rely on legitimate interests, you can object (see Your rights).

We do not sell your personal data. We share it only with the service providers below, which process it for us under contracts that limit what they can do with it, and with authorities when the law requires it.

Vercel (USA): hosts the website and app, and keeps short-term request logs.
Supabase: hosts our database (account, products, projects, credits and billing records).
Cloudflare (USA): stores files (uploads, product photos, rendered videos and covers) in R2; provides DNS, network security, the connection to our processing servers and the forwarding of emails sent to support@fypzo.com; and sends our sign-in emails through Cloudflare Email Service (it receives your email address and the sign-in link).
Google (USA): Sign in with Google, if you choose it, and the mailbox where we receive support emails.
Stripe and Link: checkout, payments, tax, receipts and subscription management.
OpenRouter (USA): routes our AI requests to model providers, currently Google (Gemini) to analyze videos and Anthropic (Claude) to write scripts from the breakdown and your product details.
Replicate (USA): runs AI models, currently Kokoro for voice-overs (it receives the script text) and, for AI motion videos, Kling by Kuaishou and DreamActor by ByteDance (they receive your image and motion clip). Replicate may pass a request to the model's developer, which may process it outside the UK and EU.
Apify (Czech Republic): collects public TikTok data for the viral library. It does not receive data about you as a user.

Our processing servers, which analyze and render videos, are run by us and reached through Cloudflare. If ITERO LTD is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that deal and stays protected by this policy.

6.International transfers

Some of these providers are in the United States or other countries outside the UK and the European Economic Area. When personal data is transferred there, we rely on adequacy decisions and regulations (such as the EU-US Data Privacy Framework and its UK Extension, for providers certified under it), or on the European Commission's Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement (IDTA), with extra safeguards where needed. You can ask us for more information at support@fypzo.com.

7.AI motion videos

When you make an AI motion video, the character image and motion clip you upload are sent to third-party AI models run on Replicate (currently Kling by Kuaishou and DreamActor by ByteDance) to generate the video; their handling of that data is also governed by their own terms. Our processing server deletes your uploads within 24 hours (sooner once the video is done) and its copy of each job, including the finished video, within 7 days. The finished video is kept with your account so you can download it again; you can ask us to delete it (see Deleting your account). We also keep a record of the confirmations you gave for each video.

8.Cookies and local storage

We use only cookies that are strictly necessary for Fypzo to work: they keep you signed in and protect the sign-in process. We do not use analytics, advertising or tracking cookies, which is why we do not show a cookie banner. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.

We also use your browser's local storage to keep an unfinished remix on your device while you sign in or check out, and to remember small preferences such as hints you have dismissed. This data stays in your browser.

9.How long we keep data

Account, products, photos, projects and videos: until you delete them or your account, or ask us to delete them. Deleting a product in the app removes it. Deleting a project hides it from your lists; its files are removed when your account is deleted or when you ask us.
Uploads: files you upload but do not use are deleted after about a day.
Processing servers: videos fetched for analysis are deleted once the analysis is done, and job records within 2 days. The render server keeps job files and finished videos for up to 7 days; the copy of your video stays in your account.
AI motion videos: see AI motion videos.
Billing records (purchases, credit history and Stripe IDs): as long as tax and accounting law requires, usually 6 years after the end of the financial year, even if you delete your account.
IP hashes and usage counters: until you delete your account or ask us to delete them.
Removal requests and support emails: as long as we need them to handle the request and keep a record of how we did.
Sign-in sessions: up to 30 days, unless you sign out sooner.

10.Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you and get a copy;
correct data that is wrong or incomplete;
have your data deleted;
receive your data in a portable format (export);
object to, or ask us to restrict, how we use your data, including any use based on legitimate interests;
withdraw consent where we rely on it.

To use these rights, email support@fypzo.com from the address on your account. We reply within one month and may need to confirm your identity. You can also complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/ or to the data protection authority in your EU country, though we would appreciate the chance to help first.

If you live in California or another US state with a privacy law, you have the right to know what we collect, to access, correct and delete it, and to opt out of the sale or sharing of personal data (we do neither; see We do not sell your data). We will not treat you differently for using these rights.

11.Deleting your account

You can delete individual products in the app. To delete your whole account, email support@fypzo.com from the address on your account; we will delete it within 30 days and confirm by email. Cancel any active subscription in Billing first, or we will cancel it for you.

Deleting your account removes your profile, products, photos, projects and videos. We keep only what the law requires or allows, such as billing records (see How long we keep data) and records of removal requests. Deleted data may remain in backups for a short time until they are overwritten.

12.Children

Fypzo is not meant for anyone under 18, and you must be 18 or older to create an account. We do not knowingly collect personal data from children, including children under 13. If you think a child has given us personal data, email support@fypzo.com and we will delete it.

13.We do not sell your data

We do not sell personal data, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA); we have not done so in the past 12 months. We do not use advertising or tracking cookies.

For the CCPA: in the past 12 months we collected these categories of personal information, from you and, if you use Sign in with Google, from Google: identifiers (name, email address, account IDs, hashed IP address), commercial information (plan, purchases, credits), user content (product details, photos, uploads, outputs) and internet activity (request logs kept by our hosting providers). We use and disclose them only for the purposes described in this policy. We do not use or disclose sensitive personal information.

14.Security

We protect your data with encryption in transit (HTTPS), access controls, owner-only access to your photos and videos, short-lived signed links for uploads, and by storing IP addresses only as salted hashes. No system is perfectly secure; if a data breach affects you, we will tell you and the authorities as the law requires.

15.Changes to this policy

We will post any update on this page with a new "Last updated" date. If we make a material change, such as using your data for a new purpose or adding a new kind of service provider, we will tell account holders by email or in the app before it takes effect.

16.Contact

For any privacy question or request, email support@fypzo.com. The controller is ITERO LTD; its registration details are shown at the top of this page.