Privacy Policy

1. Who is responsible

AURELIO CO LTD, a company registered in Cyprus under number HE 491147, Danaïs 5, Leda Gardens Block D, 8042 Paphos, Cyprus. Contact: help@popino.io.

We are the data controller for Popino. Privacy questions: privacy@popino.io.

2. What we collect

• Account: your email address and the date you signed up.
• Your content: character descriptions, photos you import, videos you upload, and the images and videos generated for you.
• Credits and purchases: your plan, credit balance and history, and payment records. Card details are handled by Stripe; we never see your full card number.
• Technical data: logs needed to run and secure the service (IP address, browser, errors, timestamps).

We don't sell your data and we don't use it for advertising profiles.

3. Photos and videos of people

• Photos and videos you upload may show faces. We use them only to generate the content you ask for. We do not create face templates or biometric identifiers to recognize or identify people, and we don't use your content to train AI models.
• You must only upload images of yourself or of people who gave you their consent (see our Acceptable Use Policy).
• Raw uploads are deleted from our storage once processed; characters and videos you keep are stored until you delete them or your account.

4. Why we use your data (legal bases)

• To provide the service you signed up for (contract): account, generations, credits, support.
• To keep it safe and prevent abuse and fraud (legitimate interest), including safety filters on inputs and outputs.
• To meet legal obligations: invoicing, tax, responding to lawful requests.
• Service emails (login links, receipts, “your video is ready”). We'll only send marketing emails if you agree, and you can unsubscribe anytime.

5. Who we share it with

We use these providers to run Popino. They only process your data on our instructions:

Some providers are in the United States. When data leaves the EU, transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Account, characters and videos: as long as your account is open. Deleted when you delete them or close your account (backups expire within 30 days).
• Raw uploads: deleted right after processing.
• Payment and invoicing records: as long as required by tax law (generally 7 years).
• Technical logs: up to 30 days.

7. Cookies

We only use cookies that are strictly necessary to keep you signed in and to secure the service. We don't use advertising cookies. If we add analytics later, we'll update this policy and ask for consent where required.

8. Your rights

You can ask to access, correct, export or delete your data, to restrict or object to its use, and to withdraw consent. Email privacy@popino.io from your account email; we answer within 30 days. In the EU you can also complain to your data protection authority (in Cyprus: the Commissioner for Personal Data Protection).

US residents (including California): you have the right to know what we collect, to request deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or “share” personal information for cross-context behavioral advertising.

9. Children

Popino is not for anyone under 18. We delete accounts and content when we learn they belong to a minor or depict a minor.

10. Security

Data is encrypted in transit (HTTPS) and access to your content is restricted to your account. Uploaded files are stored privately and served through unguessable links. No system is 100% secure, but we take reasonable measures and will notify you and the authorities of any breach as required by law.

11. Changes

We'll update this page when our practices change and notify you of significant changes.