Privacy Policy

CASPY PRIVACY POLICY PART 1 – INTRODUCTION, DATA CONTROLLER AND SCOPE 1. INTRODUCTION This Privacy Policy ("Policy") explains how personal data is collected, processed, stored, protected, and shared within the scope of the Caspy mobile application, Caspy.co website, and related services. Caspy attaches importance to user privacy and aims to act in accordance with applicable data protection legislation. This Policy covers the following services: • Caspy mobile application • Caspy.co website • AI Labs (AI Lyrics, AI Clip and AI Music) • Spark (temporary content) feature • Premium membership services • Virtual credit system • Notification systems • DM services that may be offered in the future • Caspy's affiliated digital services 2. DATA CONTROLLER The data controller under this Policy is: 5Brand Advertising Agency Ltd. Contact Information: Support: support@caspy.co General Inquiries: info@caspy.co Management: manager@caspy.co Legal Requests: lawyer@caspy.co Website: caspy.co Address: Monomark House, 27 Old Gloucester Street, London, England WC1N 3AX, United Kingdom 3. APPLICABLE LAW Caspy aims to comply with the following regulations: • KVKK (Personal Data Protection Law No. 6698) • GDPR (General Data Protection Regulation) • UK GDPR • Data Protection Act 2018 • Apple App Store Privacy Requirements • Google Play User Data Policies This Policy may be updated from time to time in accordance with applicable legislation. 4. CASPY'S 18+ POLICY Caspy is designed only for users aged 18 and over. Caspy knowingly does not: • collect children's data, • create children's profiles, • provide services directed at children. Accounts of users determined to be under the age of 18: • may be suspended, • may be deleted, • may be blocked from access. If Caspy becomes aware that children's data has been processed, it may initiate deletion processes within a reasonable time. 5. CATEGORIES OF DATA COLLECTED Caspy may process the following data categories. 5.1 Account Data During registration: • Email address • Username • Artist name • Password information (in encrypted format) • Authentication information may be processed. 5.2 OAuth Data If logging in with Google or Apple, the following information may be obtained: Google • Name • Email • Google account ID • Profile photo Apple • Apple ID • Email address • Anonymous email address provided by Apple • Authentication information If Apple's "Hide My Email" feature is used, the real email address may not be shared with Caspy. 5.3 Profile Data Within user profiles: • Profile photo • Biography • Artist descriptions • Spotify links • Apple Music links • YouTube Music links • Verified status • Premium status may be processed. 5.4 User Content Uploaded by the user: • Capsule videos • Posts • Comments • Images • Cover images • Audio recordings • Sparks (temporary videos and images, together with their text overlays) • AI outputs (lyrics, storyboards, images, videos and AI-generated music tracks) may be processed and stored. 5.5 Social Interaction Data Caspy may process the following interactions: • Follows • Likes • Reposts • Rating scores • Comments • Spark views and Spark emoji reactions • Blocks • Mute actions • Reports 5.6 Notification Data Within the scope of notification services: • Push token • Device platform • Notification preferences • Notification history may be processed. 5.7 Analytics and Recommendation Data Caspy may use the following signals: • Watch time • Completion rate • Skip behaviors • Like behaviors • Rating behaviors • Follow behaviors • Comment history • Content preferences • Genre preferences These data may be used to run recommendation systems. 5.8 Premium and Purchase Data Within the scope of Premium memberships: • Purchase ID • Subscription status • RevenueCat ID • Purchase history • Credit balance • Credit consumption may be processed. 5.9 AI Labs Data and Self Portrait Privacy Within the scope of AI services (AI Lyrics, AI Clip, AI Music) and Self Portrait Beta: • Prompts and brief texts • Song lyrics written or selected by the user • Music briefs, genre, mood and vocal-style selections • Reference images and audio files • User's uploaded profile and facial photos • AI generation outputs (lyrics, storyboards, images, video renders and generated audio tracks) and moderation logs may be processed. Photos uploaded under Self Portrait Beta are processed strictly to anchor the user's visual identity within their requested AI clips and assets. Facial and image data are never used for biometric identification, tracking across third-party apps or websites, or advertising profiling. Facial data is never used to train public foundation AI models and is not shared with unauthorized third parties. Users can delete their uploaded reference photos at any time within the app. 5.10 Security and Moderation Data Caspy may process the following data: • Report logs • Ban logs • Suspension logs • Moderation notes • Security logs • Suspicious activity logs 5.11 Device Permissions and Local Data The following device permissions and data may be processed in the Caspy mobile app: • Camera and Photo Library Permission: Used to record/select Capsule videos and Sparks, upload profile pictures, and provide AI Labs reference images. • Microphone and Audio Permission: Used during Capsule and Spark video recording and audio segment trimming for AI video generation. • Push Notification Permission: The device push token is processed and delivered through Firebase Cloud Messaging (Android) and the Apple Push Notification service (iOS) to send real-time notifications for likes, comments, follows, Spark reactions, credit balance updates, and AI generation task completion alerts. • Local Data: Language preference, theme preference, onboarding selections, and draft contents may be stored locally on the device. 5.12 Spark (Temporary Content) Data Sparks are short-lived videos or images that the user publishes for a self-selected period of 1, 2 or 3 days. Within the scope of Sparks, the following data may be processed: • Video and image content, together with cropping/framing information and text overlays • The selected display duration and the automatic expiry time • Viewer records (which users viewed the Spark and when) • Emoji reactions and likes Viewer records and reactions are visible only to the owner of the Spark. When the selected period expires, the Spark is automatically removed from the platform. 5.13 Future DM Data If a DM feature is offered, the following data may be processed: • Message contents • Media attachments • Sent time • Delivery information • Security metadata • Reported message contents 6. WHY DO WE PROCESS DATA? Data may be processed for the following purposes: • To create an account • To authenticate identity • To provide services • To publish content • To run AI services • To manage Premium memberships • To manage credits • To ensure security • To prevent fraud • To provide algorithmic recommendations • To fulfill legal obligations CASPY PRIVACY POLICY PART 2 – THIRD PARTY SERVICES, DATA TRANSFERS, RETENTION PERIODS AND USER RIGHTS 7. THIRD PARTY SERVICE PROVIDERS Caspy may use various third-party service providers to offer its services. These providers can only access data to the extent necessary. Caspy strives to implement reasonable security and privacy measures in the selection of service providers. 8. SUPABASE Caspy may use the Supabase infrastructure for the following services: • Authentication • Database services • File storage • Realtime services • API operations • Server functions The following data may be processed on Supabase systems: • Account data • Profile information • User content • Follow relationships • Like records • Moderation records Caspy evaluates that the use of Supabase is necessary for the provision of the services. 9. CLOUDFLARE STREAM AND CLOUDFLARE IMAGES Caspy may utilize Cloudflare Stream services for uploading, processing, and broadcasting video content (Capsules and Sparks), and Cloudflare Images services for uploading and delivering image content (Spark images and cover visuals). In this context: • Videos • Images • Thumbnails • Video and image metadata • Streaming records may be processed. The purpose of using Cloudflare Stream and Cloudflare Images is to: • Improve video performance • Provide global access • Offer secure broadcasting. 10. REVENUECAT Caspy may use RevenueCat services to manage premium memberships and in-app purchases. RevenueCat may process the following information: • Purchase records • Premium membership status • App Store transaction info • Google Play transaction info • Subscription IDs • Credit entitlements RevenueCat does not store credit card information on Caspy's behalf. Payment transactions are handled by the respective stores. 11. APPLE APP STORE For iOS users, certain purchasing and authentication processes may be carried out by Apple. Apple may share the following information with Caspy: • User ID • Purchase verifications • Subscription statuses • Sign In with Apple data Caspy does not have full control over data processed by Apple. Apple's own privacy policies may also apply. 12. GOOGLE Google services may be used for the following purposes: Google OAuth Authentication. Google Play Billing Purchasing transactions. Google Play Subscription Services Subscription management. Google Analytics (Future) Analytics services. Google's data processing activities may be subject to its own privacy policies. 13. PUSH NOTIFICATION INFRASTRUCTURE Push notifications are delivered through Firebase Cloud Messaging (Google, for Android devices) and the Apple Push Notification service (Apple, for iOS devices). Within the scope of the push notification infrastructure, the following information may be processed: • Device push token • Device platform information • Notification preferences This information is used solely to provide notification services. 14. AI SERVICE PROVIDERS Within the scope of Caspy AI Labs, the following providers may be utilized: • Google Gemini – lyric generation, storyboard planning, music direction and audio analysis • fal.ai – the provider gateway through which the media models below are accessed • MiniMax H3 (via fal.ai) – AI Clip video generation • MiniMax Music 3 (via fal.ai) – AI Music track generation • Nano Banana Pro (via fal.ai) – AI reference image generation and editing • ByteDance Upscaler (via fal.ai) – HD (1080p / 2K / 4K) export upscaling • Amazon Web Services – rendering and video composition infrastructure for AI Clips • Other AI providers that may be used in the future Certain inputs may be processed to run the AI services. Caspy may change, remove, or add providers over time. 15. DATA THAT MAY BE TRANSFERRED TO AI PROVIDERS When the user uses AI services, the following data may be sent to the relevant providers: • Prompts • Brief texts • Song lyrics • Music briefs and style/mood/vocal selections • Reference images • Reference videos • Audio files • Photos • Portraits • AI generation parameters This transfer is made solely for the purpose of providing the relevant AI service. Caspy does not use these inputs to train its own AI models. The data usage practices of third-party providers are governed by their own policies. 16. CROSS-BORDER DATA TRANSFER The service providers used by Caspy may be located in different countries. Therefore, personal data may be transferred to the following countries or regions: • United Kingdom • European Economic Area countries • United States of America • Other countries where service providers are located Caspy aims to implement necessary protection mechanisms within the scope of applicable legislation. 17. ALGORITHMIC RECOMMENDATIONS AND PROFILING Caspy may use algorithmic recommendation systems to improve user experience. These systems may be based on the following data: • Watch behaviors • Like history • Follow relationships • Music preferences • Genre preferences • Content interactions The purpose of these systems is to show more relevant content to users. Caspy does not guarantee the accuracy of any algorithmic outcome. 18. AUTOMATED DECISION MAKING Caspy may utilize automated systems in certain security and moderation processes. These may include: • Spam detection • Fake account detection • Deepfake detection • Moderation filters • Security analysis Final decisions may be subject to human review when necessary. 19. DATA RETENTION Caspy intends to retain personal data only for as long as necessary. Retention periods may be determined by the following factors: • Legal obligations • Contractual requirements • Security needs • Accounting requirements • Dispute risks 20. ACCOUNT DELETION AND DATA RETENTION PERIODS Users can delete their account at any time directly inside the app by navigating to Settings -> Delete Account. Account deletion can also be requested from the web, without installing or opening the app, at https://app.caspy.co/delete-account. Identity is verified by email code before the deletion is executed, and the outcome is identical to in-app deletion. Upon account deletion, the user profile, username, biography, Capsule videos, Sparks, posts, comments, likes, follow relationships, AI Labs projects and outputs, credit transaction details, and push notification tokens are immediately purged or anonymized. Sparks are additionally deleted automatically when the display period selected by the user (1, 2 or 3 days) expires, without requiring any action from the user. However, the following data may be retained for mandatory legal retention periods: • Payment and invoice records (pursuant to tax and accounting regulations) • Security and fraud prevention logs • Moderation and violation history records • Records pertaining to active legal claims These data are automatically erased or anonymized upon expiration of the applicable retention period. 21. USER RIGHTS Users may have the following rights depending on applicable legislation: Right of Access Requesting access to data. Right to Rectification Requesting the correction of incorrect data. Right to Erasure Requesting the deletion of data in certain situations. Restriction of Processing Requesting the limitation of data processing activities. Right to Object Objecting to certain processing activities. Data Portability Requesting data to the extent applicable. 22. APPLICATIONS UNDER KVKK Applications under the KVKK can be submitted to: lawyer@caspy.co Caspy may request additional information to verify the applicant's identity. 23. GDPR AND UK GDPR RIGHTS Users located in the EU or UK may have additional rights under relevant legislation. Caspy will reasonably attempt to evaluate these requests. 24. SECURITY MEASURES Caspy strives to implement reasonable technical and organizational measures to protect personal data. These may include: • Access controls • Authentication systems • Encryption technologies • Logging systems • Security reviews However, no system is 100% secure. 25. UPDATES TO THE PRIVACY POLICY Caspy may update this Policy at any time. Significant changes may be notified via: • In-app notification, • Email, • Website announcement. 26. CONTACT For requests regarding data protection and privacy: support@caspy.co, info@caspy.co, manager@caspy.co, or lawyer@caspy.co addresses can be used.