Privacy Policy

1. Who we are and scope

nrrtv is an AI-powered tool that generates short-form vertical videos from a topic or niche you choose. The Service creates a script, AI-generated images (or sourced stock footage), an AI voiceover, captions, and hashtags, and can optionally publish the finished videos to your connected social-media accounts.

This Policy applies to:

• the nrrtv website and web application;
• accounts you create with us;
• content you generate, upload, or process through the Service; and
• any social accounts you connect to the Service for publishing.

This Policy does not apply to third-party platforms you connect (such as TikTok, YouTube, or Instagram), which are governed by their own privacy policies.

2. Information we collect

2.1 Information you provide

• Account data: name, email address, password (stored hashed), and, if you use social login, the basic profile information that provider shares.
• Billing data: subscription tier, credit balance, and transaction history. Payments are processed by Stripe, our third-party payment processor. Stripe collects and processes your payment details (including card data) on our behalf; we do not store your full card number and receive only limited billing information from Stripe (such as country, card brand, and last four digits). See Stripe's own privacy notice for how it processes your payment data.
• Content inputs: the niches, topics, prompts, scripts, uploaded reference material, brand elements, and settings you submit to generate videos.
• Communications: messages you send to support, survey responses, and feedback.
• Referral data: if you participate in the referral program, the referral codes and the accounts linked through them.

2.2 Information we generate about your use

• Generated content: scripts, images, voiceovers, captions, hashtags, and final videos produced for you, together with generation metadata (niche, style preset, number of scenes, credits consumed, resolution).
• Usage data: features used, generations run, credits spent, timestamps, and in-app actions.

2.3 Information collected automatically

• Device and log data: IP address, browser type, device identifiers, operating system, referring URLs, and access times.
• Cookies and similar technologies: see Section 10.

2.4 Information from connected social accounts

If you connect a social platform to publish videos (via OAuth), we receive and store:

• OAuth access and refresh tokens used to publish on your behalf;
• your account identifier(s), handle, and basic profile info on that platform;
• publishing metadata (post status, post IDs, timestamps, and errors returned by the platform).

We use these tokens only to perform the publishing actions you request. We do not read your private messages or unrelated account data. You can disconnect any platform at any time (Section 9), which revokes and deletes the associated tokens.

2.5 Sensitive data

We do not intentionally collect special-category / sensitive personal data. Please do not submit sensitive personal information as generation input unless necessary, and never submit another person's personal data without a lawful basis.

3. How we use your information

We use personal data to:

1. Provide the Service — create your account, generate videos, manage credits and subscriptions, and publish to your connected accounts;
2. Process payments — via our payment processor, including handling renewals, refunds, and credit purchases;
3. Operate AI generation — send your inputs to the AI and infrastructure providers that power script, image, voice, and video generation (Section 5);
4. Communicate with you — service notices, transactional emails, security alerts, and, where permitted, product updates and marketing (which you can opt out of);
5. Improve and secure the Service — analytics, debugging, abuse and fraud prevention, and enforcing our Terms;
6. Comply with law — tax, accounting, and legal obligations, and responding to lawful requests.

4. Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to create your account, run generations, and provide the Service you signed up for.
• Legitimate interests — to secure and improve the Service, prevent fraud and abuse, and conduct basic analytics, balanced against your rights.
• Consent — for optional cookies, certain marketing, and connecting social accounts for publishing. You may withdraw consent at any time.
• Legal obligation — for tax, accounting, and compliance requirements.

5. AI generation and content processing

To create your videos, your inputs (topics, prompts, scripts, and any reference material) and the intermediate outputs are processed by our own systems and by third-party AI and cloud providers, which may include image-generation models, text/script models, text-to-speech providers, stock-footage providers, and hosting/CDN infrastructure. A current list of these providers is in Section 12 and available on request at [email protected].

Important notes:

• We instruct our providers to process your inputs solely to deliver the Service. We do not use your content, prompts, or connected-account data to train our own generalized AI or machine-learning models, and we select providers that offer equivalent commitments or model-training opt-outs where available. Some providers' terms vary — see Section 12 for the current list of sub-processors.
• You are responsible for the content you generate. Do not prompt the Service to reproduce a real, identifiable person's likeness or voice, or to create content that infringes third-party rights (see the Terms of Service and our Acceptable Use Policy).
• AI output can be inaccurate and may contain factual mistakes or visual inconsistencies. Content generated for factual niches should be reviewed before publishing.

6. Google API Services and YouTube data

If you connect Google/YouTube to sign in or to upload videos, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We access Google user data only to provide user-facing features you request (account sign-in and uploading videos to your YouTube channel).
• We do not use Google user data to develop, improve, or train generalized or non-personalized AI/ML models.
• We do not sell Google user data, and we do not transfer it to others except as necessary to provide or improve the feature, comply with law, or as part of a merger/acquisition after appropriate notice.
• Your use of YouTube features is also subject to the YouTube Terms of Service and the Google Privacy Policy.
• You can review or revoke nrrtv's access to your Google account at any time via Google Security Settings.

We publish to social platforms through the social-publishing provider Post for Me (postfor.me). When you connect an account and schedule or publish a video, Post for Me processes your OAuth authorization, the video, and post metadata solely to carry out the publishing you request, on our behalf. Post for Me is listed as a sub-processor in Section 12.

7. When we share information

We do not sell your personal data. We share it only as follows:

• Service providers / sub-processors — AI model providers, cloud hosting and CDN, our payment processor, email and analytics providers, publishing intermediaries, and support tools, each under contract and only as needed to run the Service (Section 12).
• Social platforms you connect — we transmit your video and post metadata to the platform(s) you choose, to publish on your behalf.
• Legal and safety — to comply with law, enforce our Terms, protect our rights, or respond to lawful requests and emergencies.
• Business transfers — in a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent — for any other disclosure you direct.

8. International data transfers

We and our providers may process data in countries other than yours, including the European Union (where we are established) and, via some of our sub-processors, the United States and other countries. Where required, we use appropriate safeguards for such transfers, such as the EU Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. You can request a copy of the relevant safeguards at [email protected].

9. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• Access a copy of your personal data;
• Correct inaccurate data;
• Delete your data ("right to be forgotten");
• Restrict or object to certain processing;
• Portability — receive your data in a machine-readable format;
• Withdraw consent at any time (without affecting prior processing);
• Lodge a complaint with your data protection authority.

Social accounts: you can disconnect any connected platform from your account settings at any time; this revokes and deletes the associated OAuth tokens we hold.

Marketing: you can unsubscribe via the link in any marketing email or in your settings. Transactional and service messages continue while you have an account.

To exercise any right, contact [email protected]. We will respond within the timeframe required by applicable law (generally 30 days). We may need to verify your identity first.

9.1 EEA / UK residents

You may lodge a complaint with your local supervisory authority. As we are established in Cyprus, our lead supervisory authority is the Office of the Commissioner for Personal Data Protection (Cyprus). We have not appointed a formal Data Protection Officer, as we are not required to under GDPR Article 37; for any data-protection matter you can contact us at [email protected].

10. Cookies and tracking

Today the Service uses only one strictly necessary cookie (to keep you signed in) and a small amount of first-party browser storage needed to run the app (including your theme preference). We set no analytics, advertising, or third-party tracking cookies, so no cookie consent banner is currently shown. If we add non-essential cookies in future, we will ask for your consent first.

Full details of every cookie and storage key we use, the third parties your browser contacts, and how to clear them are set out in our separate Cookie Policy.

11. Data retention

We keep personal data only as long as needed for the purposes in this Policy:

• Account and content data — kept while your account is active. When you delete your account, your account and content data are deleted immediately.
• Lapsed subscriptions (failed payment) — if a payment fails, generation stops and your account and content are retained for a 90-day grace period so you can restore access; after that they are deleted.
• Generated videos and assets — available to you while your account is active; older generated files may be removed after 12 months for storage management, and all assets are deleted on account deletion (or per the 90-day grace period above).
• Billing records — retained as required by applicable tax/accounting law (typically up to 7 years). Our payment processor, Stripe, also retains its own transaction records.
• OAuth tokens — deleted promptly upon disconnection or account deletion.
• Logs — typically 12 months.

12. Sub-processors

We use third-party service providers (sub-processors) to operate the Service. They process personal data only to provide services to us, under contract. Categories include:

• Payment processing — Stripe
• Social publishing and OAuth — Post for Me
• AI generation providers (text, voice, and image)
• Stock media providers
• Cloud hosting, storage, and content delivery (CDN)
• Web font delivery

A current list of our sub-processors is available on request at [email protected].

13. When we act as a processor

For personal data contained within the content you create (for example, if you upload material about your own customers), you are the controller and we act as your processor, processing that data only on your instructions to provide the Service. If you require a Data Processing Agreement (DPA), contact [email protected].

14. Children's privacy

The Service is not directed to children. If you are below the age of majority in your jurisdiction, you may use the Service only with the consent and under the supervision of a parent or legal guardian. We do not knowingly collect personal data from children below the applicable digital-consent age without appropriate consent. If you believe a child has provided us data without such consent, contact [email protected] and we will delete it.

15. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and hashing of credentials. No system is perfectly secure; we cannot guarantee absolute security. If we become aware of a personal-data breach affecting you, we will notify you and any regulator as required by law.

16. Third-party links and platforms

The Service may link to or integrate with third-party sites and platforms. We are not responsible for their privacy practices. Review their policies before providing information.

17. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, notify you by email or in-app. Continued use after the effective date constitutes acceptance.

18. Contact us