Y-O-X Studio Privacy Policy
Effective date: 22 October 2026 Controller: Y-O-X LTD (company number 16012843) Registered office: 100 Fenchurch Street, London, EC3M 5JD, England Public URL: https://www.y-o-x.com/privacy-policy.html Contact: we@y-o-x.com
This Privacy Policy explains how Y-O-X LTD ("Y-O-X", "we", "us" or "our") processes personal data when you use Y-O-X Studio, including its iOS application, website, APIs and related services (the "Service").
1. Who is responsible for your data
Y-O-X LTD is the controller of personal data processed for its own account, billing, security and Service operations. For privacy questions or rights requests, contact we@y-o-x.com.
2. Information we collect
Account and authentication data
- Email address and display name.
- Supabase user identifier and authentication/session data.
- Sign in with Apple information, including Apple’s stable user identifier and, where provided, the relay email address.
- Profile image and profile information you choose to save.
Content and production data
- Story text, prompts, chat messages and conversation history.
- Images, audio, video and other files you upload or create.
- Project, film, document, cast, approval, feedback and reaction records.
- Generated video, images, audio, music, voice and related production metadata.
Some features may process reference images or face-related information to create or manage cast assets. Do not upload personal data or a person’s likeness unless you have the necessary permission and legal basis.
Purchases and billing
- Apple transaction identifiers, product identifiers, subscription status and signed transaction information.
- Production-balance credits, grants, redemptions, refunds, revocations and usage records.
- Account, invoice, tax and fraud-prevention records needed to operate billing and meet legal obligations.
Apple processes App Store purchases under Apple’s terms and privacy policy. Y-O-X verifies signed transactions with its backend before granting subscription access or production balance.
Technical and security data
- Push notification token, if you allow notifications.
- Device, application, network and diagnostic information needed for security, support and reliability.
- Request, error, abuse-prevention and billing-dispute logs.
We do not use contacts, precise location, advertising identifiers or cross-app tracking for Y-O-X Studio.
3. Why we use information
We use personal data to:
- create and authenticate accounts;
- provide chat, project, film, media and production features;
- process uploads and generate requested content;
- store, display and sync your projects and conversations;
- manage approvals, feedback, usage and production balance;
- process and verify subscriptions and consumable purchases;
- respond to support requests;
- prevent fraud, abuse and unauthorised access;
- secure, maintain and improve the Service without using your content to train foundation models;
- comply with legal, tax, accounting and regulatory obligations.
Our legal bases may include performance of a contract, compliance with legal obligations, legitimate interests in operating and securing the Service, and consent where required. You may withdraw consent where processing depends on consent; this does not affect earlier lawful processing.
4. Who receives information
We disclose only the information needed for the relevant service. The production processor list must be kept current and must match the vendors actually used in production.
| Provider | Purpose | |---|---| | Supabase | Authentication, account records, database and backend services | | Anthropic | Language-model processing for studio chat | | BytePlus | Video and image generation | | ElevenLabs | Voice and music processing | | Google | Video or media review | | OpenAI | Speech-to-text or other explicitly enabled processing | | Apple | Sign in with Apple, App Store purchases and transaction services | | Hosting, storage and delivery providers | Infrastructure, media storage and file delivery, where used |
These providers receive data only for the features for which they are engaged. Y-O-X maintains processor agreements, including confidentiality, security, deletion and subprocessor obligations, with each provider. We update this list when the providers used by the Service change.
5. AI and content use
Y-O-X does not use your scripts, prompts, conversations or generated media to train foundation models. We process content only as needed to provide the Service, comply with law, prevent abuse, resolve disputes and maintain security. We review provider contracts and settings to support this commitment.
You retain rights in content you submit, subject to the rights of other people and materials included in it. AI-generated output may not be unique, error-free or suitable for every purpose. You are responsible for checking output and obtaining permissions for third-party material, names, voices, likenesses, music and locations.
6. Retention
- Account and project content is retained while your account is active and until you delete it, subject to backup, security and legal exceptions.
- Account deletion is intended to remove or anonymise account-associated projects, conversations, files, settings, session keys, usage records, approval and feedback records, push tokens and the account itself after the deletion workflow succeeds.
- A minimal deletion record may be retained to demonstrate that a deletion request was processed.
- Purchase, tax and accounting records are retained for up to seven years after the end of the relevant accounting period, but only to the extent needed for accounting, tax, fraud, chargeback or legal-claim purposes. Records are deleted or anonymised sooner when that purpose ends. This period is a Y-O-X retention policy, not a claim that UK or EU law universally requires seven years.
- Ordinary request, abuse-prevention and diagnostic logs are retained for 90 days and then deleted or anonymised. Logs connected to an active security incident, fraud investigation, billing dispute, complaint, legal claim or legal hold may be retained for as long as reasonably necessary for that specific purpose and then deleted or anonymised.
- Backups may retain limited data for a reasonable disaster-recovery window before secure deletion or expiry.
- Third-party providers may retain data under their own documented policies and contractual deletion windows. We request deletion or expiry where applicable but cannot control a provider’s independent legal obligations.
If an account-deletion step fails, we keep the account in place, report the failure and require the request to be retried so that deletion is not falsely represented as complete.
7. Sharing and international transfers
Service providers may process data outside the United Kingdom or European Economic Area. Y-O-X uses an adequacy decision where available. For a UK restricted transfer without adequacy, we use the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, complete a transfer risk assessment where required, and apply supplementary safeguards where necessary. For an EU restricted transfer without adequacy, we use the EU Standard Contractual Clauses and an appropriate transfer assessment and safeguards. The relevant countries, modules and safeguards are recorded in Y-O-X’s processor and transfer register.
We may disclose information when required by law, court order, regulator, fraud-prevention process or to protect the rights, safety and security of Y-O-X, users or others.
8. Your rights
Subject to applicable law, you may have rights to access, correct, delete, restrict or object to processing, obtain a copy of certain data, and complain to the relevant data-protection regulator. To exercise a right, contact we@y-o-x.com. We may need to verify your identity and will respond within the period required by law.
UK users may contact the Information Commissioner’s Office at ico.org.uk if they are dissatisfied with our response.
9. Children
The Service is not directed to children under 16. We do not knowingly collect personal data from a child under 16. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.
10. Security
We use technical and organisational safeguards appropriate to the risks, including authenticated access, account-scoped records, encrypted transport and protected credential storage. No system is completely secure, and you should use a strong, unique password and protect access to your devices and account.
11. Changes
We may update this Policy when the Service, law or processing changes. We will update the effective date and provide additional notice where required.
12. Contact
Y-O-X LTD 100 Fenchurch Street London EC3M 5JD England