What we collect,

and why.

This policy explains what personal data Kly-O ("we", "us") collects, how we use it, and the rights you have. It applies to your use of the Kly-O website and service.

1. Information we collect

Account details — when you sign up we collect your name and email address (and, if you choose social sign-in, basic profile details from that provider), handled through our identity provider.

Payment details — when you buy credits or subscribe, your card and billing details are collected and processed by Stripe. We do not store your full card number; we keep a record of your purchases and credit balance.

Content you provide — the prompts, text and files you submit to generate media, and the media you generate.

Usage data — basic technical information such as your device, browser and how you use the service, used to keep it running and secure.

Consent records — where you accept terms that carry responsibility, such as confirming you have the right to use a person's likeness, we record that you accepted and when. We keep this so both sides have a clear record of what was agreed.

2. How we use your information, and why we are allowed to

We use your data to run the service, produce the media you ask for, take payment and track your credit balance, keep your library and settings across your devices, keep the service secure, prevent abuse, answer your questions, and meet our legal obligations.

Under UK and EU data-protection law we need a lawful basis for each of those. Running your account, generating your media and taking payment are necessary to perform our contract with you. Keeping the service secure, preventing fraud and abuse, and keeping records of consents are our legitimate interests. Where the law requires us to keep financial records, that is a legal obligation. Where we rely on consent — for example non-essential cookies — you can withdraw it at any time.

3. Who we share it with

We share data only with the service providers we need to run Kly-O: our identity provider (accounts and sign-in), Stripe (payments), Resend (email we send you), Sentry (error reports, with prompts and files stripped out before they are sent), and the AI model providers who process your prompts to create your results — Replicate, Google, Anthropic, Deepgram, ElevenLabs, Kling and Vidu. These providers process data on our behalf under their own security and privacy commitments. We do not sell your personal data.

4. Your prompts and generations

To create your results, the prompts and files you submit are sent to the relevant AI model provider. Those providers may process this content to fulfil your request in line with their terms. Please avoid submitting sensitive personal information in prompts.

5. Automated processing

Generation is automated. Prompts and images are checked automatically before and during a render, both by us and by the model provider, and a request may be refused without a person reviewing it. These checks decide whether a single generation runs; they do not produce decisions with legal or similarly significant effects about you. If a refusal looks wrong, email us and a person will look at it.

6. Copies we keep of what you make

You should know exactly what happens to a finished generation, because we keep a copy of it. When a video or image finishes, a copy of the file is saved on our server alongside the prompt that made it, the model used and the email address of the account that ordered it. The site owner reviews these for quality, safety and abuse, and syncs them to a private machine. They are held in a rolling buffer that clears the oldest files once it is full, and they are not published, sold or shared with anyone outside Kly-O.

The owner also receives an automatic email the first time each account generates something on a given day, which includes that account's email address and the text of the prompt. Its purpose is to spot abuse and failures early.

If you would rather we did not keep a copy of a particular generation, or you want the copies of your work deleted, email us and we will remove them.

7. Data retention

We keep your account and purchase records for as long as your account is active and as needed to meet legal, tax and accounting requirements. Copies of your generations are kept in the rolling buffer described above and are removed on request, or when the buffer rotates. Error reports are kept for 90 days and carry no prompts, files or credentials. You can ask us to delete your account, after which we remove or anonymise your personal data — including the stored copies of your generations — except where we must keep it by law.

8. Your rights

If you are in the UK or EU you have the right to ask for a copy of the personal data we hold about you, to have inaccurate data corrected, to have your data deleted, to restrict or object to how we use it, and to receive it in a portable form. You can also complain to your data-protection regulator — in the UK that is the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can put it right. We answer requests within one month.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. You can also complain to your local data protection authority (in the UK, the Information Commissioner's Office).

9. Cookies

We use essential cookies to keep you signed in and to run the service securely. We do not use them to build advertising profiles.

10. International transfers

Some of our providers operate outside the UK/EEA. Where your data is transferred abroad, we rely on appropriate safeguards as required by data-protection law.

11. Children

Kly-O is not intended for anyone under 18, and we do not knowingly collect data from children.

12. Training AI models

We do not use your prompts, uploads or generations to train our own AI models, and we do not sell them or hand them to anyone for that purpose.

Your prompts and any images you upload are sent to the model provider you chose in order to produce what you asked for. What each provider then does with that material is governed by their own terms, and it differs between them — some state that they do not train on API inputs, others reserve the right to. We cannot control or guarantee their behaviour. If this matters to you, avoid putting confidential material, personal data about other people, or anything you could not bear to have retained into a prompt.

13. Keeping your information secure

We protect your information with measures appropriate to the risk: encrypted connections, access controls, private storage that is not reachable from the open internet, and secrets held in the hosting platform rather than in our code. Files you generate are stored in a private bucket and served only to the account that made them.

No service can promise perfect security, and we do not. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours where the law requires it, and we will tell you directly where the risk to you is high.

14. Complaints

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data-protection regulator, at ico.org.uk.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the date above.

16. Contact

For any privacy question or request, email us at support@kly-o.com.