Privacy Policy

1. Controller

Fewral, Lenny Hyka, Letzigrabenstrasse 102, 8047 Zürich, lenny.hyka@fewral.com

2. Data Processed

We process the following personal data:

• Name and email address (upon registration)
• Payment data (processed by Stripe; saved payment methods are held by Stripe, not in our database)
• Content you enter or upload and the videos generated from it (texts, uploaded audio, voice-overs, subtitles)
• Usage data (IP address, browser type, session information)
• Google/YouTube data when you connect YouTube: basic channel information and permission to upload videos
• TikTok data when you connect TikTok: basic profile information and permission to post videos
• Ad view data when you watch rewarded ads for credits (see section 9)

3. Purpose & Legal Basis

We process your data for the following purposes and on the following legal bases:

• Provision of the platform and performance of our services – Art. 6(1)(b) GDPR (contract performance)
• Security, operation and improvement of the website as well as technically necessary cookies – Art. 6(1)(f) GDPR (legitimate interest)
• Consent – Art. 6(1)(a) GDPR: anonymous usage statistics with Umami and Sentry performance sampling in the browser, only if you agree (see section 7). You can withdraw consent at any time with effect for the future.
• Consent – Art. 6(1)(a) GDPR and § 25(1) TDDDG: loading the AppLixir rewarded-ads player, only if you allow "Advertising" and start an ad (see section 9). Crediting a completed ad view to your account is based on Art. 6(1)(b) GDPR.
• Statutory obligations, e.g. keeping accounting records – Art. 6(1)(c) GDPR.

4. Data Sharing

We only share your data with service providers that process it on our behalf where necessary for operation. We do not sell your data. Providers are bound by data processing agreements.

• Hostinger (VPS hosting of our self-hosted Supabase database, authentication and file storage, deployed with Coolify)
• Stripe (payment processing; Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA)
• Google Gemini API (Google): generating and editing story scripts from the text you enter
• OpenRouter (OpenRouter, Inc., USA): voice synthesis and transcription; requests may be routed to the underlying model providers
• Deepgram (Deepgram, Inc., USA): subtitle timing and transcription of uploaded audio
• Amazon Web Services (AWS Lambda, region eu-central-1 / Frankfurt): video rendering
• Sentry (Functional Software, Inc., USA): error monitoring
• Umami Cloud (Umami Software, Inc., USA; data hosted in the EU): consent-based usage statistics
• Our email delivery provider for account emails (sign-up confirmation, password reset)
• Google (YouTube Data API) and TikTok (Content Posting API), only if you connect these platforms; see section 8
• AppLixir Inc. (USA): rewarded video ads, only with your advertising consent. AppLixir and its ad partners also process data under their own responsibility; see section 9

5. Storage Period

We store account data and your generated videos until you delete them or your account. Sentry error reports are deleted after at most 90 days. Server logs are kept for a short period for security purposes. Payment and accounting records are kept for 10 years as required by Swiss law (Art. 958f CO). Connection tokens for YouTube/TikTok are deleted when you disconnect the platform or delete your account.

6. Your Rights

You have the right to access, correct, delete and obtain a copy of your data, and to withdraw any consent you gave. Contact us by email at the address in section 1. You may lodge a complaint with the Swiss FDPIC (EDÖB) or, if you live in the EU/EEA, with the data protection authority of your country.

7. Cookies and similar technologies

We distinguish two groups. Strictly necessary cookies and local storage are needed to deliver the service you asked for — logging in, saving your drafts, remembering your privacy choice — and are set without consent under Art. 5(3) of the ePrivacy Directive and § 25(2) TDDDG. Everything else is set only after you have agreed, and you can withdraw that agreement at any time under Settings → Privacy or via "Cookie settings" in the footer. Withdrawing is as easy as agreeing and takes effect immediately. Advertising cookies are set only by our ad partner AppLixir and its ad partners, and only if you have allowed "Advertising" and start a rewarded ad (see section 9). We do not sell your data.

• sb-*, supabase-* (cookie, Fewral/Supabase): login and authenticated access to your account. Strictly necessary. Duration: length of the session. Legal basis: Art. 6(1)(f) GDPR.
• fewral_consent (cookie, Fewral): stores your privacy choice and its timestamp so we can honour it and demonstrate it. Strictly necessary. Duration: 6 months. Legal basis: Art. 6(1)(c) and (f) GDPR.
• theme-mode, ui-language (cookies, Fewral): remember the appearance and language you selected yourself. Strictly necessary (interface customisation you requested). Duration: 12 months. Legal basis: Art. 6(1)(f) GDPR.
• tour_done_* and audio_upload_notice_seen (cookies, Fewral): remember completed tours and a one-off notice. Strictly necessary. Duration: 12 months. Legal basis: Art. 6(1)(f) GDPR.
• fewral:generator-draft:v1, fewral-sidebar-collapsed (local storage, Fewral): keep your unsaved draft and your sidebar layout on your own device. They never leave your browser. Strictly necessary. Duration: until you clear your browser storage. Legal basis: Art. 6(1)(f) GDPR.
• Umami Analytics (Umami Cloud, script from cloud.umami.is, data hosted in the EU): anonymous, aggregated reach measurement. It sets no cookies, stores nothing on your device and creates no cross-site profile. If you decline, we set the local-storage key umami.disabled on your device so the measurement stays off even before the next page load; that key is strictly necessary, because it exists only to enforce your refusal. Category: analytics — set only with your consent. Duration: until you clear your browser storage. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.
• Sentry (error monitoring): records technical error reports so we can keep the service secure and working. No cookies, no profiling. Legal basis: Art. 6(1)(f) GDPR. Performance sampling in your browser is switched on only with your analytics consent.
• AppLixir rewarded ads (AppLixir Inc., USA, and its ad partners; script from cdn.applixir.com): the video ad player and the ad technology it loads (for example Google IMA and programmatic ad demand) may set third-party cookies and read device identifiers to deliver ads, limit how often they are shown, measure them and prevent fraud. Their names and lifetimes are determined by AppLixir and its partners. Category: advertising — loaded only with your consent and only when you start an ad. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

8. Connected platforms: Google, YouTube and TikTok

When you connect YouTube, we use your channel information and upload permission only to let you publish through Fewral. When you connect TikTok, we use your basic profile information and posting permission only to let you publish through Fewral. We store connection tokens encrypted and do not sell or share them. You can disconnect a platform in the Upload manager ('Platform connections' section). For Google and YouTube, you can also revoke Fewral's access in Google's security settings. To request deletion of your connected-platform data or your account data, email us using the contact details in the imprint; we delete it unless legal retention obligations apply.

• Fewral's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• By using the YouTube feature, you agree to the YouTube Terms of Service.
• Google's Privacy Policy applies to Google's handling of your information.
• Revoke Fewral's Google access in Google's security settings.

9. Rewarded ads (AppLixir)

On the "Refill your balance" page you can voluntarily watch a short video ad to earn free credits. The ads are delivered by the ad network AppLixir Inc., USA. The AppLixir player is loaded only if you have allowed the "Advertising" category and click "Watch an ad"; before that, no data is sent to AppLixir. Without this consent you can use Fewral in full and buy credits as usual.

• AppLixir's privacy policy applies to AppLixir's processing of your data.

• Data processed by AppLixir and its ad partners: IP address, device and browser information, cookies and similar identifiers, and data about your interaction with the ad (for example whether it was played to the end). AppLixir and its ad partners may process this data under their own responsibility; their own privacy policies apply.
• Data we pass to AppLixir: your internal Fewral user ID (a random identifier, not your name or email address), so that AppLixir can confirm a completed view to our server.
• Data we store: the transaction ID of the view, your user ID, the credits granted (0 for views beyond the daily limit), the ad provider (AppLixir) and the time, in order to credit your account and enforce the daily limit. We keep these records until you delete your account.
• Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG for loading the ad player and the storage of and access to information on your device that it involves; Art. 6(1)(b) GDPR for crediting a completed view and enforcing the daily limit.
• Transfer to third countries: AppLixir is based in the USA, and its ad partners may process data in the USA or other third countries. Transfers take place on the basis of the EU Commission's standard contractual clauses or an adequacy decision, where applicable.
• Withdrawal: you can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer or under Settings → Privacy. After that, the ad player is no longer used, and if it was already loaded, the page reloads to remove it completely. Cookies that ad partners have already set on their own domains can be deleted in your browser settings.

10. International Data Transfers

Some providers are located in, or may access data from, countries without an adequate level of data protection, in particular the USA (Stripe, Google, OpenRouter, Deepgram, Sentry, Umami, TikTok when connected, AppLixir and its ad partners when you consent to advertising, and possibly the email provider). AWS rendering runs in Frankfurt (EU). Transfers take place on the basis of the EU-US and Swiss-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses as recognised by the FDPIC. On request we will provide you with copies of the applicable safeguards.

11. Scope & GDPR

This privacy policy addresses users worldwide, including the EU and the EEA. For individuals in the EU/EEA, the GDPR applies; for individuals in Switzerland, the revised Swiss Data Protection Act (revDPA) applies. You have the right to access, rectification, erasure, restriction of processing and data portability, as well as the right to object. You may also lodge a complaint with your competent data protection authority (in Switzerland: FDPIC).

12. Beta waitlist

When you join the beta waitlist, we store your email address, selected language, traffic source and signup time only to invite you to the beta. We keep this data until you are invited or ask for deletion using the contact address above. No newsletter and no sharing.