Privacy

We process only the data needed to run, secure, bill, and improve Unfaced.

Videos you publish through Unfaced can be declared as AI-generated with each platform's own label where one exists (YouTube's altered-content setting, TikTok's AI-generated content label). Whether that label is set depends on a setting that may be off, so check each video's disclosure before it goes public.

• Account and contact data, such as your email, locale, login events, and marketing preference. If you subscribe to weekly creator ideas without an account, we also keep the signup source and confirmation, send, and unsubscribe timestamps.
• Workspace content, including briefs, scripts, uploads, brand assets, generated media, review decisions, series settings, and publication metadata.
• Connected-platform identifiers, permissions, encrypted access and refresh tokens, and publishing results. We do not receive your platform password.
• For YouTube, TikTok, and Instagram, we use the permissions you grant to identify the connected channel, publish only after your confirmation, retrieve performance statistics for your own posts, and show those statistics in Unfaced. We do not use connected-platform data for advertising or sell it.
• Billing records such as plan, customer and transaction identifiers, credits, invoices, and tax status. Card and bank details are handled by our payment provider, not stored by Unfaced.
• Technical and security data such as IP address, device and browser information, logs, error traces, rate-limit events, and cookie or analytics identifiers when enabled.

We use account, content, generation, publishing, and billing data to perform our contract with you (GDPR Article 6(1)(b)). We use necessary logs, fraud controls, service analytics, backups, and security measures for our legitimate interests in operating a reliable and safe service (Article 6(1)(f)). We process tax, accounting, and lawful-request data to meet legal obligations (Article 6(1)(c)). Optional marketing and non-essential analytics rely on consent where consent is required (Article 6(1)(a)).

We do not sell personal data. We do not use your private uploads to train a general-purpose model unless you separately opt in.

A provider receives data only when its specific function is used.

We name the platforms you sign in with or connect, and the stock library we credit. Every other provider that runs the service for us is listed by category. The current list of those subprocessors is available on request through the contact in the imprint.

• Apple: Sign in with Apple and App Store purchase processing (account or purchase data as applicable).
• Google: Google sign-in, and YouTube connection or publishing (account or channel data as applicable).
• TikTok: account connection, creator information, publishing, and statistics for your connected TikTok account (profile, post metadata, media, and performance data as applicable).
• Meta: Instagram account connection, publishing, insights, and comments for your connected professional Instagram account (profile, post metadata, media, insights, and comments as applicable).
• Pexels: stock photos and videos, credited where they appear (search terms and request metadata).
• Payment providers: web checkout, subscriptions, mobile-store purchases, invoicing, and tax (billing and transaction data).
• RevenueCat: validates mobile-store purchases, manages subscription entitlements and synchronizes purchase status with Unfaced (internal account ID, store transaction and subscription identifiers, purchase history and app/device metadata). Google Play or Apple processes the payment; Unfaced does not receive your card or bank details.
• Analytics providers: optional website and studio analytics loads after you accept analytics (usage/device data and pseudonymous identifiers; in the studio also your account ID, email address and name). Optional mobile product events use Unfaced’s own analytics service. Mixpanel receives mobile app-opening, screen and funnel events only after you enable product analytics in App settings (internal account ID, pseudonymous install identifiers, app version and locale; no scripts, prompts or email address). The Mixpanel project uses its EU endpoint and IP geolocation is disabled.
• Hosting and infrastructure providers: application compute, database, storage, delivery, security, logs, and backups (EU region where configured).
• AI generation providers: speech, text, image, and video generation for the videos you make (script text, prompts, reference media, and generation metadata).
• Email delivery provider: transactional and lifecycle email (email address and message metadata).
• Error-monitoring provider: error monitoring when enabled (technical diagnostics that may contain account or request identifiers).

Some providers operate outside the European Economic Area. Where required, transfers rely on an adequacy decision, the European Commission's standard contractual clauses, and supplementary safeguards. Provider terms and locations can change; the live subprocessor list will be updated before a new material recipient is used.

We keep account and workspace data while your account is active. Draft media may be removed on the product retention schedule; final exports remain until you delete them or close the account. You can delete a video and its files from your library at any time, and deleting your account removes your workspace, videos, and files. Copies already published to a connected platform are not removed. Delete them on the platform itself. Consent-gated mobile product-interaction events are kept for at most 180 days and are deleted immediately when you turn that analytics setting off. Newsletter records are kept while you are subscribed; after unsubscribe, a suppression record may be retained so we do not send again. Deleted data may remain in protected backups for a limited rotation period. Billing and tax records are retained for the period required by law. Security logs are kept only as long as reasonably needed to investigate abuse and incidents.

The 180-day limit and immediate deletion on withdrawal described above apply to Unfaced’s first-party product-event database. Turning product analytics off also stops new mobile events to Mixpanel and resets its local identity; it does not automatically erase events already held by Mixpanel. Contact us to request deletion of data held by our processors. Purchase records processed through RevenueCat may remain for subscription management, fraud prevention and applicable accounting obligations.

We use access controls, encryption in transit, encrypted connected-platform tokens, isolated workers, audit and cost records, and protected backups. No online system is risk-free; contact us promptly if you believe your account or content has been exposed.

Depending on the law that applies, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent at any time without affecting earlier processing. You may complain to your local data-protection authority. We may need to verify your identity before acting on a request.

Essential cookies keep you signed in and protect the service. Optional analytics is used only under the consent rules that apply to you. Website analytics loads only after you choose “Accept analytics” in the cookie notice; with “Essential only” it never loads, and neither does it when your browser sends Do-Not-Track or Global Privacy Control. Your choice is stored in a cookie for six months, and you can change it at any time under “Cookie settings” in the footer. The weekly creator-ideas email requires a separate signup and email confirmation. Every edition includes an unsubscribe link. Account holders do not receive weekly idea emails; service and security messages may still be sent.

Automated systems generate and rank creative output and may apply safety or abuse controls. They do not make decisions that produce legal or similarly significant effects about you. A human review step remains available before publishing unless you deliberately enable an earned auto-publish setting.

Use the controller contact details below for privacy requests. We will update this notice when data use or providers materially change and will announce important changes through the service or by email.