Privacy policy

What we collect

Account: your email address, the name you choose and, if you sign in with Google, your basic Google profile (name and email).

Your work: projects, cards, prompts, uploads, generated images, videos and voices, notes and your conversations with Yuumeh-chan.

Voices you clone: if you make a voice of your own, the recording you give us and the voice made from it. It's private to your account: only you can voice lines with it, and you can delete it at any time. Lines you voice with it on a canvas you share can be heard by the people you share it with, like anything else on it. We use it only to voice the lines you ask for, never to identify you or anyone else.

Payments: your plan, purchases, credit balance and history. Card details are handled by Stripe; we never see or store your full card number.

Referrals: if you share or use a referral code, we keep who referred whom, when, and the credits each of you got. To stop people referring themselves, we keep a keyed hash of each card you pay with (a scrambled value made from Stripe's card fingerprint, which can't be turned back into card details). People who sign up with your code see your first name unless you turn that off; you see how many people signed up and subscribed with your code, not who they are.

Security: when you sign up we check your IP address against abuse limits. We store it only as a keyed hash and a shortened range (for example 81.2.69.x), never in full. We also use Cloudflare Turnstile to tell people from bots.

Usage: a record of actions in Yuumeh (for example a project created or a generation started), pages visited and sign-ins. We use it to run the service, prevent abuse, fix problems and understand how Yuumeh is used.

Connected apps: if you connect your own Claude or Grok (account menu → Connectors), we keep a scrambled copy of each access key (never the key itself), when it was made and last used. What your connected AI reads and changes in Yuumeh is handled like your own actions.

Why we use it (and our legal basis)

To provide Yuumeh: your account, canvas, generations, sharing and support (performing our contract with you).

To take payments and keep financial records (contract, and our legal obligations).

To keep Yuumeh secure and stop sign-up abuse, fraud and misuse, including referral abuse (our legitimate interest in protecting the service and its users).

To send you product news, tips and offers by email (our legitimate interest in telling customers about Yuumeh; for UK email law, the "soft opt-in" for existing customers). You can say no when you sign up, switch it off in Settings → Email updates, or unsubscribe from any of these emails, and we'll stop. Account emails (sign-in, security, payments) aren't marketing and still come.

To improve Yuumeh using usage records (legitimate interest). We don't sell your data and we don't use your projects to train AI models.

Who we share it with

We use these service providers, who process data for us under contract: Supabase (database, sign-in and file storage), Lovable (hosting the app), Cloudflare (network delivery and bot checks), Stripe (payments and tax), KIE.ai (runs the image, video and language models — your prompts, reference media and Yuumeh-chan's working context are sent to it to produce results), Topaz Labs (upscaling — the pictures and videos you upscale are sent to it, and it returns the larger versions), ElevenLabs (voices: the lines you have voiced are sent to it, and if you clone a voice, your recording is sent to it to make the voice, which it keeps until you delete it) and Mailchimp (Intuit: our email updates — your email address and name, and account details such as your plan, credits and when you signed up, so we can send updates that fit; we remove you from it when you delete your account). An exchange-rate service receives no personal data.

People you share a project with see its content, and your name and cursor while you're on the canvas.

If you connect your own AI assistant (such as Claude), it receives the canvas content, prompts and media links it asks for, on your instruction. Its provider (e.g. Anthropic) handles that data under your agreement with them, not ours.

We may disclose data if the law requires it, to protect people's safety, or as part of selling or reorganising the business (the new owner would be bound by this policy).

International transfers

Some providers process data outside the UK, including in the United States and the European Economic Area. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to protect it.

How long we keep it

Account data and your work: until you delete it or your account.

A voice you clone and its recording: until you delete the voice or your account. Either way it's deleted at ElevenLabs as well. A recording that doesn't become a voice is deleted straight away.

Sign-up security records: 90 days.

Payment and credit records: six years after the end of the financial year they relate to, as UK tax law requires. After you delete your account these are kept without your name or email.

Backups roll over and are deleted within 30 days.

Your rights

You can ask to see, correct, delete or move your data, object to or restrict how we use it, and withdraw consent where we rely on it.

Download a copy of your data or delete your account at any time from Settings. For anything else, email us; we reply within one month.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies and storage

Yuumeh uses only what it needs to work: your sign-in session and a few preferences (like your last generation settings) kept in your browser, plus Cloudflare's bot check when you sign up. We don't use advertising or cross-site tracking cookies.

Children

Yuumeh is for people aged 18 and over. If we learn that a child has an account, we'll delete it.

Changes

If we change this policy in a way that matters, we'll let you know by email or in Yuumeh before the change applies.