Privacy Policy

1. Who we are and scope

nrrtv is an AI-powered tool that generates short-form vertical videos from a topic or niche you choose — including script, AI images or stock footage, voiceover, captions, and hashtags — and can optionally publish finished videos to your connected social-media accounts.

This Policy applies to the nrrtv website and web application, accounts you create, content you generate or upload, and any social accounts you connect for publishing. It does not apply to third-party platforms you connect (TikTok, YouTube, Instagram), which are governed by their own policies.

2. Information we collect

2.1 Information you provide

• Account data: name, email address, password (stored hashed), and basic profile info from social login providers.
• Billing data: subscription tier, credit balance, and transaction history. Payments are handled by Paddle (Merchant of Record); we do not store your full card number.
• Content inputs: niches, topics, prompts, scripts, reference material, brand elements, and settings you submit.
• Communications: support messages, survey responses, and feedback.
• Referral data: referral codes and linked accounts if you join the referral program.

2.2 Information we generate about your use

• Generated content: scripts, images, voiceovers, captions, hashtags, and final videos, plus generation metadata.
• Usage data: features used, generations run, credits spent, timestamps, and in-app actions.

2.3 Information collected automatically

• Device and log data: IP address, browser type, device identifiers, OS, referring URLs, and access times.
• Cookies and similar technologies — see Section 10.

2.4 Information from connected social accounts

If you connect a social platform via OAuth, we receive OAuth access and refresh tokens, your account identifier/handle, and publishing metadata (post status, IDs, timestamps, errors). We use tokens only to perform publishing actions you request and do not read private messages or unrelated account data. You can disconnect any platform at any time (Section 9).

2.5 Sensitive data: We do not intentionally collect special-category data. Please do not submit sensitive personal information as generation input.

3. How we use your information

1. Provide the Service — create your account, generate videos, manage credits and subscriptions, and publish to connected accounts.
2. Process payments — via our payment processor, including renewals, refunds, and credit purchases.
3. Operate AI generation — send your inputs to AI and infrastructure providers that power script, image, voice, and video generation.
4. Communicate with you — service notices, transactional emails, security alerts, and (where permitted) product updates.
5. Improve and secure the Service — analytics, debugging, abuse and fraud prevention, and enforcing our Terms.
6. Comply with law — tax, accounting, and legal obligations, and responding to lawful requests.

4. Legal bases for processing (GDPR / UK GDPR)

• Performance of a contract — to create your account, run generations, and provide the Service.
• Legitimate interests — to secure and improve the Service, prevent fraud, and conduct basic analytics.
• Consent — for optional cookies, certain marketing, and connecting social accounts. You may withdraw consent at any time.
• Legal obligation — for tax, accounting, and compliance requirements.

5. AI generation and content processing

Your inputs and intermediate outputs are processed by our systems and by third-party AI and cloud providers (image-generation models, text/script models, text-to-speech, stock footage, hosting/CDN). A current list is in Section 12 and available at [email protected].

• We do not use your content, prompts, or connected-account data to train our own generalized AI models.
• You are responsible for the content you generate. Do not prompt the Service to reproduce a real person's likeness or voice without authorization.
• AI output can be inaccurate. Content for factual niches should be reviewed before publishing.

6. Google API Services and YouTube data

If you connect Google/YouTube, our use of Google API data adheres to the Google API Services User Data Policy, including Limited Use requirements:

• We access Google user data only to provide features you request (sign-in and uploading to your YouTube channel).
• We do not use Google user data to develop or train generalized AI/ML models.
• We do not sell Google user data.
• Your use of YouTube features is also subject to the YouTube Terms of Service and Google Privacy Policy.
• You can revoke nrrtv's access at any time via Google Security Settings.

We publish to social platforms through Post for Me (postfor.me), which processes your OAuth authorization and post metadata solely to carry out publishing on our behalf (see Section 12).

7. When we share information

We do not sell your personal data. We share it only as follows:

• Service providers / sub-processors — AI providers, cloud hosting, payment processor, email, analytics, publishing intermediaries, and support tools, each under contract.
• Social platforms you connect — we transmit your video and post metadata to the platform(s) you choose.
• Legal and safety — to comply with law, enforce our Terms, protect our rights, or respond to lawful requests.
• Business transfers — in a merger, acquisition, or sale of assets, subject to this Policy.
• With your consent — for any other disclosure you direct.

8. International data transfers

We and our providers may process data in the EU (where we are established) and, via some sub-processors, in the US and other countries. Where required, we use EU Standard Contractual Clauses (and UK Addendum) or an adequacy decision. Request a copy at [email protected].

9. Your rights and choices

Depending on where you live, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Portability — receive your data in a machine-readable format
• Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint with your data protection authority

Social accounts: disconnect any platform from account settings at any time — this revokes and deletes associated OAuth tokens.

Marketing: unsubscribe via the link in any marketing email or in your settings.

To exercise any right, contact [email protected]. We will respond within 30 days and may need to verify your identity.

9.1 EEA / UK residents

You may lodge a complaint with your local supervisory authority. As we are established in Cyprus, our lead supervisory authority is the Office of the Commissioner for Personal Data Protection (Cyprus). Data-protection enquiries: [email protected].

10. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand usage. Strictly necessary cookies are set automatically; non-essential cookies (functional, analytics, marketing) require consent where required by law. Full details are in our Cookie Policy.

11. Data retention

• Account and content data — kept while your account is active; deleted immediately upon account deletion.
• Lapsed subscriptions (failed payment) — retained for a 90-day grace period, then deleted.
• Generated videos and assets — available while account is active; older files may be removed after 12 months; all assets deleted on account deletion.
• Billing records — retained as required by tax/accounting law (typically up to 7 years). Paddle also retains its own records.
• OAuth tokens — deleted promptly upon disconnection or account deletion.
• Logs — typically 12 months.

12. Sub-processors

A current, itemized list is maintained at nrrtv.ai/subprocessors and available on request. Key sub-processors:

• Paddle (paddle.com) — Payments (Merchant of Record): billing, card processing, and tax.
• Post for Me (postfor.me) — Social publishing: OAuth authorization and posting to your connected accounts.

13. When we act as a processor

For personal data within content you create (e.g. if you upload material about your own customers), you are the controller and we act as your processor. If you require a Data Processing Agreement (DPA), contact [email protected].

14. Children's privacy

The Service is not directed to children. We do not knowingly collect personal data from children below the applicable digital-consent age without appropriate consent. If you believe a child has provided us data without such consent, contact [email protected] and we will delete it.

15. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and hashing of credentials. No system is perfectly secure. If we become aware of a personal-data breach affecting you, we will notify you and any regulator as required by law.

16. Third-party links and platforms

The Service may link to or integrate with third-party sites and platforms. We are not responsible for their privacy practices. Review their policies before providing information.

17. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, notify you by email or in-app. Continued use after the effective date constitutes acceptance.

18. Contact us