Privacy Policy

1. Who we are

Sapyora is operated by MED CONNECT SYSTEMS S.R.L., a company registered in Romania (Trade Register no. J23/8426/2023, sole registration code (CUI) 49285180, EUID ROONRC.J23/8426/2023, VAT ID RO49285180), with registered office at Str. Steaua Roșie 31, Bl. K, Ap. 13, Otopeni, Ilfov County, Romania. We are the data controller for the personal data described here.

For data protection matters, contact us at contact@sapyora.com (mark your message “Data protection”). You may also lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or your local data protection authority.

2. What we collect

Account data: your email address and, optionally, a display name.

Usage data: the video links you submit, the articles generated for you, your credit balance and processing history, and in-app preferences (language, theme).

Payment data: when you buy a membership or credits, our payment provider (Lemon Squeezy, as Merchant of Record) processes the payment and shares with us your email, a customer identifier and order metadata. Your card details never reach us.

Public library: if you choose to publish an article, that article and your chosen username become publicly visible. Publishing is voluntary, per article, and reversible.

Technical data: basic logs and security information needed to operate the Service.

3. How AI processing works

To generate an article, the video’s transcript and our prompts are sent to Google’s Gemini API. We use the paid Gemini API tier, under which Google does not use your content to train its models. Your account credentials are never sent to the AI.

4. Why we use your data (legal bases)

To provide the Service and your account (performance of a contract); to keep the Service secure and prevent abuse (legitimate interest); and to comply with legal obligations. We do not sell your personal data.

5. Processors we use

Supabase (database, authentication), Google (Gemini AI processing), Fly.io (processing workers, EU region), Vercel (web hosting), Resend (transactional email), PostHog (product analytics, EU-hosted, only with your consent), Sentry (error monitoring, EU/DE region) and Lemon Squeezy (payments, as Merchant of Record). These providers process data on our behalf under data processing agreements. The full, up-to-date list — including each provider's region and transfer mechanism — is on our Sub-processors page at sapyora.com/subprocessors.

6. Cookies

Essential cookies (always on): to keep you signed in and to remember your language and theme.

Analytics cookies (only with your consent): we use PostHog (EU-hosted, IP anonymised) to understand product usage. These are set only if you accept them in our cookie banner; you can choose “Essential only” to decline, and analytics will not run. We use no advertising or cross-site tracking cookies.

We also use Sentry for error monitoring (to keep the service reliable and secure); it does not set advertising cookies.

7. Data retention

Account and content: kept for as long as your account is active. When you delete your account, your personal data, editable article copies and all text/PDF materials are deleted. For public YouTube videos, we retain only the pristine canonical output generated before any user edits, without any link to your identity, so an identical request can be served without repeating the AI processing.

Billing records (transactions, invoices, payment events): kept for 10 years, as required by accounting law, de-linked from your deleted account.

Technical and error logs: typically 30–90 days.

Backups: deleted data leaves backups within the normal rotation cycle (up to ~30 days).

8. Your rights

You can export a full copy of your data (JSON) and delete your account yourself, at any time, from the account menu in the app — no request needed. You can also ask us for access, correction, deletion, a copy of your data, or object to certain processing by writing to contact@sapyora.com; we respond within one month. EU/EEA and UK residents have these rights under the GDPR/UK GDPR. You may also complain to your local data protection authority.

9. International transfers

Most of our infrastructure runs in the EU. Providers based in the United States (Google, Vercel, Resend, Lemon Squeezy) are certified under the EU-US Data Privacy Framework and/or bound by Standard Contractual Clauses. The per-provider mechanism is listed on our Sub-processors page.

10. Security

We use industry-standard measures (encryption in transit, access controls, row-level security). No system is perfectly secure, but we work to protect your data.

11. Children

The Service is not intended for children under the age of digital consent in their country. We do not knowingly collect their data.

12. Changes & contact

We may update this Policy; material changes will be announced. Questions: contact@sapyora.com.