Privacy Policy

1. Who we are

Sapyora is operated by MED CONNECT SYSTEMS S.R.L., a company registered in Romania (Trade Register no. J23/8426/2023, sole registration code (CUI) 49285180, EUID ROONRC.J23/8426/2023, VAT ID RO49285180), with registered office at Str. Steaua Roșie 31, Bl. K, Ap. 13, Otopeni, Ilfov County, Romania. We are the data controller for the personal data described here.

For data protection matters, contact us at contact@sapyora.com (mark your message “Data protection”). You may also lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or your local data protection authority.

2. What we collect

Account data: your email address and, optionally, a display name.

Usage and content data: the video links, declared public or restricted source-access status, text/PDF materials and generated articles you provide, your credit balance and processing history, and in-app preferences (language, theme).

Compliance records: the user, date and time, interface language, material reference or source type, action and version of the mandatory acknowledgement displayed before text/PDF processing or private sharing and before processing or privately sharing a restricted YouTube source. We do not collect the recipient’s identity or an IP address for this record.

Content reports: the reported material and URL, category, description, good-faith statement and, where required, the reporter’s name and email. Reports concerning child safety may be submitted without those identity fields.

Payment data: when you buy a membership or credits, our payment provider (Lemon Squeezy, as Merchant of Record) processes the payment and shares with us your email, a customer identifier and order metadata. Your card details never reach us.

Public library: if you choose to publish an eligible article derived from a public YouTube source, that article and your chosen username become publicly visible. Restricted or paid-source results are not eligible. Publishing is voluntary, per article, and reversible.

Technical data: basic logs and security information needed to operate the Service.

3. How AI processing works

To generate an article, the video transcript or text extracted from a user-supplied text/PDF material and our prompts are sent to one or more AI model providers acting as processors. We use business/API offerings under which customer API data is not used to train models by default. The exact and current providers, purposes, regions and transfer safeguards are listed at sapyora.com/subprocessors. Your YouTube or Sapyora account credentials, passwords and session cookies are not used to retrieve a transcript and are never sent to an AI provider.

4. Why we use your data (legal bases)

To provide the Service and your account (performance of a contract); to keep the Service secure and prevent abuse (legitimate interest); and to comply with legal obligations. We do not sell your personal data.

5. Processors we use

We use infrastructure, communications, payments, analytics, monitoring, request-routing and AI model providers to operate the Service. The complete and up-to-date list — including each provider's role, region and transfer mechanism — is on our Sub-processors page at sapyora.com/subprocessors.

6. Cookies

Essential cookies (always on): to keep you signed in and to remember your language and theme.

Analytics cookies (only with your consent): we use PostHog (EU-hosted, IP anonymised) to understand product usage. These are set only if you accept them in our cookie banner; you can choose “Essential only” to decline, and analytics will not run. We use no advertising or cross-site tracking cookies.

We also use Sentry for error monitoring (to keep the service reliable and secure); it does not set advertising cookies.

7. Data retention

Account and content: kept for as long as your account is active. When you delete your account, your personal data, editable article copies, all text/PDF materials and restricted-source YouTube results are deleted. For public YouTube videos only, we retain the pristine canonical output generated before any user edits, without any link to your identity, so an identical request can be served without repeating the AI processing.

Billing records (transactions, invoices, payment events): kept for 10 years, as required by accounting law, de-linked from your deleted account.

Mandatory content acknowledgements and content reports: retained for as long as reasonably necessary to demonstrate compliance, investigate notices and establish, exercise or defend legal claims, then deleted or anonymised according to the applicable retention schedule.

Technical and error logs: typically 30–90 days.

Backups: deleted data leaves backups within the normal rotation cycle (up to ~30 days).

8. Your rights

You can export a full copy of your data (JSON) and delete your account yourself, at any time, from the account menu in the app — no request needed. You can also ask us for access, correction, deletion, a copy of your data, or object to certain processing by writing to contact@sapyora.com; we respond within one month. EU/EEA and UK residents have these rights under the GDPR/UK GDPR. You may also complain to your local data protection authority.

9. International transfers

Most of our infrastructure runs in the EU. Some providers may process data outside the EU/EEA. Depending on the provider, transfers rely on an adequacy decision such as the EU-US Data Privacy Framework and/or Standard Contractual Clauses in a data processing agreement. The exact current mechanism for each provider is listed at sapyora.com/subprocessors.

10. Security

We use industry-standard measures (encryption in transit, access controls, row-level security). No system is perfectly secure, but we work to protect your data.

11. Children

The Service is not intended for children under the age of digital consent in their country. We do not knowingly collect their data.

12. Changes & contact

We may update this Policy; material changes will be announced. Questions: contact@sapyora.com.