QUYP

Privacy Policy

Last updated: October 24, 2026

This Privacy Policy explains how QUYP ("QUYP", "we", "us") collects, uses and protects personal data when you use the QUYP platform at http://95.179.252.61:8081/QUYP and its related subdomains (the "Service"). QUYP lets you create AI-generated virtual personas, produce images and videos for them, plan publications and publish that content to social media accounts you connect.

1. Data controller

QUYP is the data controller for the personal data described in this policy. You can reach us at support@quyp.com.

2. Data we collect

2.1 Account data

  • Email address, display name and a one-way hash of your password (we never store the password itself).
  • Interface language, time zone and notification preferences.
  • Workspace and subscription plan information, including purchased credits.

2.2 Content you create

  • Persona definitions (name, biography, personality, appearance attributes, content strategy). These describe fictional, AI-generated characters and are not intended to describe real people.
  • Prompts you write or generate, and the images and videos produced from them.
  • Publication plans, captions and the approval history of your posts.

2.3 Connected social media accounts

When you connect a social media account (for example Instagram, Threads, TikTok, X, Facebook, YouTube, Pinterest, LinkedIn or Bluesky) through the platform's authorization screen, we receive and store:

  • the account identifier, username or handle, and display name returned by the platform;
  • the access token and, where issued, the refresh token and their expiry times. Tokens are stored encrypted at rest and are used only to publish content you have scheduled or approved and to read the information needed to display the connected account and the status of your posts.

We do not read your private messages, your followers' data or any content beyond what is required to publish and to confirm the result of a publication. Disconnecting an account deletes its tokens immediately (see Section 7).

2.4 Technical and usage data

  • Server logs (IP address, user agent, requested URL, time) kept for security and debugging.
  • Generation and publishing records (which feature was used, when, how many credits were consumed, success or failure) kept for billing and abuse prevention.
  • Audit entries for security-relevant actions such as login, password changes and account connections.

2.5 Payment data

If you purchase a paid plan or credits, payment is processed by a third-party payment provider. We receive confirmation of the payment, the plan or product purchased and a customer reference. We do not store full card numbers.

3. How we use data

  • To provide, operate and secure the Service and your account.
  • To generate images, videos and text with AI providers on your instruction.
  • To publish content to the social media accounts you connected, at the times you chose or approved.
  • To measure usage against your plan, prevent abuse and enforce our Terms of Service.
  • To send transactional emails (verification, password reset, publication failures, billing).
  • To comply with legal obligations and respond to lawful requests.

Legal bases under the GDPR, where it applies: performance of a contract (Articles 6(1)(b)), legitimate interests in security and service improvement (6(1)(f)), consent where you connect a social account or opt into optional communications (6(1)(a)), and legal obligation (6(1)(c)).

4. Sharing with third parties

We share data only as needed to run the Service:

  • AI providers (image, video and text generation): receive the prompts and reference images needed to produce your content. Reference images depict AI-generated personas, not real people.
  • Social media platforms: receive the media and captions you chose to publish, through the account you connected. Their handling of that content is governed by their own policies.
  • Hosting and infrastructure providers: store and transmit data on our behalf under data processing agreements.
  • Payment providers: process payments.
  • Authorities: when required by law.

We do not sell personal data and we do not use data obtained from social media platforms for advertising, profiling or any purpose other than operating the features you asked for.

5. Platform-specific commitments

Data received from Meta Platforms (Instagram, Threads, Facebook), TikTok, X, Google (YouTube), Pinterest and LinkedIn is used in accordance with each platform's developer terms and policies. We request only the permissions needed to identify the connected account and publish content. We refresh or revalidate tokens solely to keep the connection working and we delete platform data when you disconnect the account or delete your QUYP account.

6. Retention

  • Account and content data: for as long as your account exists, then deleted within 30 days of account deletion (backups are rotated within 90 days).
  • Social account tokens: until you disconnect the account, the platform revokes access, or your account is deleted.
  • Billing records: as required by tax and accounting law.
  • Server logs: up to 90 days.

7. Your rights and choices

  • Disconnect a social account at any time from the Accounts page in your dashboard; the stored tokens are deleted immediately. You can also revoke access from the platform's own settings, in which case we treat the connection as revoked.
  • Access, correct or export your data from the dashboard or by contacting us.
  • Delete your account and data as described on our Data deletion page.
  • Where the GDPR or similar laws apply you also have the rights to restriction, objection, portability and to lodge a complaint with a supervisory authority.

8. Cookies

We use a strictly necessary session cookie to keep you signed in and a CSRF protection token. We do not use third-party advertising or tracking cookies on the Service.

9. Security

Passwords are hashed with a modern algorithm, access tokens are encrypted at rest, traffic is served over HTTPS and access to production systems is restricted. No system is perfectly secure; please use a strong, unique password and keep your email account safe.

10. Children

The Service is not directed to anyone under 18 and we do not knowingly collect data from minors.

11. International transfers

Our providers may process data outside your country. Where required we rely on appropriate safeguards such as standard contractual clauses.

12. Changes

We may update this policy. Material changes will be announced in the dashboard or by email before they take effect. The "Last updated" date at the top shows the current version.

13. Contact

QUYP, support@quyp.com.