Privacy Policy

Account data: your name, email address, profile picture if you add one, along with your plan and credit balance.

Business details you enter yourself: brand name, industry, description, target audience, city, website and colours. We use these to generate work that fits your brand.

What you send us: the text, images and files you submit to the studios, and the output they produce.

Usage data: the pages you visit, the studios you use, and the result, timing and credit cost of each generation.

Technical data: IP address, browser, device and language. We use these for security, abuse prevention and rate limiting — not to build a profile of you.

Payment data: handled entirely by Stripe. Your card number never reaches our servers and we do not store it. We keep only your Stripe customer reference, your subscription status and your invoice history.

To run the service: process your generations, store your work, and manage your credits and subscription.

To contact you about your account: payment confirmations, password resets and essential service notices.

To improve the product: understand what customers actually use, where they get stuck, and fix failures.

To measure our own advertising and learn which channels bring real subscribers.

To protect the platform: detect fraud and credit-system abuse, and defend accounts against unauthorised access.

We do not sell or rent your personal data, and we do not share it with data brokers or with outside advertisers for their own purposes.

Essential cookies: these hold your login session and keep you signed in, and protect our forms from abuse. They cannot be turned off inside the platform because signing in depends on them.

Usage analytics: we use Google Analytics 4 to measure visits, pages and traffic sources. It sets cookies named _ga and _ga_* holding a random browser identifier — not your name or email.

Advertising measurement: we use the Meta Pixel to measure the results of our ads on Facebook and Instagram. It sets cookies named _fbp and _fbc; _fbc is only created if you reached the site by clicking one of our ads.

Server-side measurement — stated plainly, because you cannot see it in your browser: some measurement does not happen in your browser at all. When a purchase or a sign-up completes, our server sends that event directly to Google Analytics and to the Meta Conversions API. The event carries a one-way hashed (SHA-256) copy of your email address and of your account identifier, together with the subscription value and the cookie identifiers above. We never send your email in the clear, your name, or any of the content you create.

Payments: Stripe sets its own cookies on the checkout pages to prevent fraud during payment.

How to stop tracking: you can delete or block cookies in your browser settings — note that blocking the essential ones will break sign-in. To opt out of Google Analytics specifically, Google publishes an official browser add-on at tools.google.com/dlpage/gaoptout.

To control Meta advertising and its measurement, use your ad preferences on Facebook or Instagram at accountscenter.facebook.com/ads. At the device level you can also turn off app tracking on iOS or reset your advertising ID on Android.

If you would rather we excluded your account from advertising measurement altogether, contact us and we will do that.

Stripe — payments, subscriptions and invoice records.

Google — visit measurement through Google Analytics 4.

Meta Platforms — advertising measurement through the Meta Pixel and the Meta Conversions API.

Infrastructure providers: hosting, database and storage, plus the mail service we send account email from.

The AI infrastructure the Pyra AI engine runs on: your prompt and any attached images are sent there to produce your generation, and nothing else — your name and email address are not.

These providers may process data outside the UAE, including in the European Union and the United States. By using the platform you understand that your data may be transferred and processed abroad under the contractual terms we have with each provider.

The content you generate — images, copy, campaigns, voiceovers — belongs to you.

We keep a copy so it appears in your asset library and you can come back to it.

We do not use your content or your brand details to train AI models, we do not show it to other customers, and we do not sell it.

We look at specific content only in narrow cases: to answer a support request you send us, to investigate an abuse report, or where the law requires it.

Account data and content: for as long as your account is active.

On a deletion request: we delete your personal data and content within 30 days of verifying the request.

Billing and invoice records: kept for the period UAE accounting and commercial rules require — five years — even after an account is closed.

Security records such as login attempts and rate-limit counters: kept briefly, no longer than the purpose requires.

Measurement data held by Google and Meta: governed by their own retention settings. The default retention for Google Analytics events is 14 months.

We use SSL/TLS encryption to protect your data in transit.

Each account’s data is isolated in the database itself through Row Level Security, so one account cannot reach another’s data.

We apply rate limiting and protection against repeated login attempts.

We never store card data — it stays with Stripe.

No system is completely secure. If a breach affects your personal data, we will notify you and act to limit the impact.

Access your data and get a copy of it.

Correct your account details — available to you directly on the settings page.

Delete your account and data: send the request from our contact page and we will action it within 30 days, except for records we are legally required to keep, such as billing.

Object to your data being used for advertising measurement, by the routes described in section 3.

Withdraw consent to marketing email at any time, without affecting the essential service email about your account.

If you believe we have not handled your request properly, you have the right to complain to the competent supervisory authority.

The service is intended for businesses and for people aged 18 or over.

We do not knowingly collect data from anyone under 18. If we find such an account, we delete it and its data.

We may update this policy as the service and the tools we use change.

The last-updated date is shown at the top of this page. If a change is material — a new measurement tool, or a new purpose for using your data — we will tell you by email or inside the platform before it takes effect.