Privacy Policy

1. Who we are and what this covers

Youkla ("Youkla", "we", "us") is operated by Youkla. This Privacy Policy explains what personal data we collect when you use youkla.com and the Youkla apps and services (together, the "Service"), why we collect it, who we share it with, how long we keep it, and the rights you have over it.

Youkla is an online service that turns what you give it into new media with the help of AI models.

We are the data controller for the personal data described here. If you have any question about this policy, write to [email protected].

2. The data we collect

We collect only what the Service needs to work. Here is the full list.

Category	What it includes	Why we need it
Account	Name, email address, profile picture from your sign-in provider, sign-in method	To create and secure your account and to contact you about it
Content you upload	Photos, text, and files you add to the service	To make what you asked for. Nothing else
Content we make	Images, videos, audio, and documents generated for your account	To show them to you, let you download them, and keep them in your library
Billing	Plan, payment status, invoices, Stripe customer id	To bill you and to answer billing questions. We never see full card numbers
Usage and device	Pages visited, actions taken, browser type, approximate location from IP address, error reports	To keep the service working, find bugs, and prevent abuse
Messages	Anything you write to support, including screenshots you attach	To answer you

We do not collect government identifiers, precise location, biometric templates, or health data, and we do not build profiles of you from third-party sources.

3. Photos and other files you upload

Files you upload are stored in a private folder tied to your account, under a random file name that cannot be guessed.

We use an upload only to produce the result you asked for. It is sent to an AI model for that one job and to no one else.

Our AI providers process your content under paid business terms that forbid them from using it to train their models. We do not train models on your content either.

Delete an item and its file is removed from our storage. Ask us to close your account and every file, record, and generated result tied to it is deleted.

4. Children

You may upload photos of your own children. By doing so you confirm you are their parent or legal guardian, or have that person's permission.

Anyone under 18 may not create an account. If you believe a child has given us personal data directly, or that a photo of a child was uploaded without a parent's or guardian's permission, write to [email protected] and we will delete it.

5. Why we process your data, and the legal basis

Where the GDPR, UK GDPR, or a similar law applies, we rely on the following legal bases:

Performing our contract with you. Creating your account, generating what you asked for, storing it in your library, billing you, and answering your support requests.
Consent. Handling photos of other people, including your children, which you confirm you have permission to upload. Marketing emails, where you opted in. Analytics and advertising cookies on marketing pages, where the law requires consent. You can withdraw consent at any time; withdrawing it does not affect processing that already happened.
Legitimate interests. Keeping the Service secure, preventing abuse and fraud, measuring which features fail, and improving the Service. We balance these interests against your rights and do not rely on them for anything you would not reasonably expect.
Legal obligations. Keeping billing records for tax and accounting law, and answering lawful requests from authorities.

We do not use your personal data for automated decisions that have legal or similarly significant effects on you.

We never sell personal data. We never share it with data brokers or advertisers for their own use. We share it only with the service providers below, who process it on our instructions, under contracts that limit what they may do with it.

Provider	What they do for us	Where
Cloudflare R2	Encrypted storage and delivery of the files you upload and the files we make for you	Global edge network
Stripe	Payments and subscription billing. Card numbers go to Stripe, never to our servers	United States / EU
Mailgun	Transactional email: sign-in codes, receipts, ready notifications	United States / EU
Google (Gemini API)	AI text and image generation under paid API terms that exclude training on your data	United States
ElevenLabs	Voice narration generation	United States
PostHog	Product analytics so we can see which screens fail or confuse	United States / EU
Google Analytics, Meta Pixel, TikTok Pixel	Aggregate traffic and ad measurement on marketing pages	United States

We may also disclose data if the law requires it, to protect the rights and safety of you, us, or others, or as part of a merger or sale of Youkla, in which case this policy continues to apply to your data.

7. Cookies, analytics and advertising

The Service uses a small number of cookies and similar technologies:

Strictly necessary. Signing you in, remembering your session and your preferences. These cannot be switched off without breaking the Service.
Analytics. PostHog and Google Analytics tell us which screens are used, which fail, and where people get stuck. Data is aggregated; we do not use it to identify you.
Advertising measurement. On marketing pages only, Meta Pixel and TikTok Pixel let us see whether an ad led to a sign-up. They do not run inside the app after you sign in.

You can block cookies in your browser settings, opt out of ad measurement through Meta and TikTok's own ad settings, and use browser extensions that block trackers. Blocking necessary cookies will prevent sign-in.

8. International transfers

Our providers operate in the United States and the European Union. When personal data leaves the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework, and we take additional measures where a transfer risk assessment calls for them.

9. How long we keep data

Account data stays for as long as your account exists.
Uploaded files and generated content stay until you delete them, or until we delete your account at your request.
Billing records are kept for as long as tax and accounting law requires, typically seven years.
Server logs and analytics events are kept for up to 12 months.
Support conversations are kept for up to 24 months so we can follow up on earlier issues.

When data is no longer needed we delete it or anonymise it so it can no longer be linked to you.

10. How we protect data

Every connection to the Service is encrypted with TLS.
Files are stored encrypted at rest, in per-account folders, under random file names that cannot be guessed or enumerated.
Our database is encrypted in transit and access to it is limited to the systems that need it.
Payment card details are entered directly into Stripe and never pass through our servers.
Access to production systems is restricted to the people who operate the Service, protected by multi-factor authentication, and logged.

No system is perfectly secure. If we discover a breach that affects your personal data we will tell you and the relevant authority without undue delay, as the law requires.

11. Your rights

Depending on where you live you have some or all of the following rights, and we honour them for everyone, wherever you are:

Access. Ask for a copy of the personal data we hold about you.
Correction. Ask us to fix data that is wrong.
Deletion. Ask us to delete your data. Most content you can delete yourself inside the Service; for the whole account, write to us.
Portability. Receive the data you gave us in a machine-readable format.
Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause it while we check a request.
Withdraw consent. For anything we do on the basis of consent.
Complain. Lodge a complaint with your data protection authority. In the EU that is the authority of the country where you live; in the UK it is the Information Commissioner's Office.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use and share it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. We have not sold personal information in the preceding 12 months.

Other US states. Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising and profiling. We do not engage in profiling that produces legal or similarly significant effects.

To exercise any right, write to [email protected] from the email address on your account, or use the contact page. We verify requests by confirming control of that email. We answer within 30 days, or within the shorter period your local law requires, and we never charge for a request unless it is clearly unfounded or repetitive. You may authorise someone else to make a request on your behalf; we will ask for proof of that authorisation.

12. Marketing emails

We send transactional emails you cannot opt out of while you have an account: sign-in codes, receipts, and notices that something you made is ready. We send marketing emails only if you asked for them, and every one has an unsubscribe link.

13. Links to other sites

The Service may link to sites we do not control, such as Stripe's checkout or a payment receipt. Their privacy policies apply there, not this one.

14. Changes to this policy

When we change this policy we update the date at the top. If a change reduces your rights or changes how we use existing data in a way you would not expect, we email account holders before it takes effect.

15. Contact

Youkla, operator of Youkla
Privacy requests: [email protected]
Everything else: [email protected]

These Terms and any dispute arising from the Service are governed by the laws of the country in which Youkla is established, without regard to conflict-of-law rules, and subject to the mandatory consumer protection rules of the country where you live.