Privacy Policy
This policy explains what Yallery, Inc. collects when you use the Yallery Studio creative workspace at yallerystudio.com, why, and what you can do about it. It is written to be read, not to be survived.
1. What we collect
| What | Why | Kept |
|---|---|---|
| Email address, and company name if you give one | To identify the account and to reach you about it | While the account exists |
| Password hash | To sign you in. We never store the password itself | While the account exists |
| Prompts and files you send | To generate what you asked for | See section 3 |
| Generated outputs | To deliver them to you at a URL | See section 3 |
| Generation records: model, size, timing, credits spent | To bill you and to show your usage | 7 years, for accounting |
| Payment records | To take payment and issue receipts | 7 years, for accounting |
| Server logs: IP address, request time, response status | To operate the service, find faults and stop abuse | 30 days |
| The IP address an account was created from | To give free starter credits once per network, not to every new account from the same one. Our staff can see it while it is kept | 30 days, then deleted automatically |
| Where your sign-up came from: the campaign tags in the link you followed, the site that linked to us, the first page of ours you opened, and the country you signed up from | To know which of our own efforts bring people here, and which are wasted. No profile is built from it and it is never combined with anything you make | 12 months, then it stops being linked to your account and only the totals remain |
We do not use advertising trackers, we do not profile you, and we do not follow you across other people’s websites. What we measure is our own: how many people arrive, from where, and whether the Service then worked for them. Inside the Service it stays with us entirely. On this marketing site we also keep a plain count of visitors, described in the Cloudflare row below — cookieless, with nothing stored in your browser and no way to recognise you on a later visit.
This site stores two things in your browser, neither of which carries an identifier: your language setting, and — only if you arrived through a campaign link — the tags from that link, so that signing up a few pages later is still credited to it. The second one is deleted when you close the tab.
The country is worked out on our own servers, from the address your sign-up arrives on, using a copy of a public database that we hold ourselves. Nothing about your address is sent anywhere to do it, and the address itself is not kept with the result — only the two-letter country. That database is GeoLite2: this product includes GeoLite2 ipv4 and ipv6 country data created by MaxMind, used under CC BY-SA 4.0.
2. What we never do with your content
We do not train models on your prompts, inputs or outputs. We do not sell them, we do not share them with other customers, and we do not publish them as examples without asking you first in writing.
Our staff do not read your prompts as a matter of routine. Someone may look at a specific job if you ask us to investigate it, or if we are required to by law.
3. How long we keep prompts and outputs
Today we keep them indefinitely. Generated files stay in our object storage so the URLs we returned to you keep working, and the prompt is stored with the job record. We would rather tell you that plainly than publish a deletion promise we do not yet keep.
You can ask us to delete the content of your account at any time by writing to cooperation@yallery.app, and we will do it within 30 days. Records we must keep for accounting — what was billed, when, and how much — survive that deletion, because the law requires them.
4. Who else processes your data
Running the Service means handing parts of it to other companies. These are all of them:
| Who | What they receive | Where |
|---|---|---|
| DigitalOcean | Everything: our servers, database and file storage | United States, Germany |
| RunPod | Prompts and input files, while a GPU generates the result | United States, Europe |
| Pruna AI | Prompts and input files for the hosted image models | European Union |
| OpenAI | Only the prompt text of a video retake request, which is expanded into a fuller motion description before generation | United States |
| Stripe | Your email and payment details. Card numbers go to Stripe directly and never touch our servers | United States |
| SendGrid (Twilio) | Your email address, to deliver account mail such as a password reset | United States |
| Cloudflare | The DNS records for our domains, and — on this marketing site only — an audience count: which page was opened, from roughly where, and what linked to it. It is cookieless and stores nothing in your browser. Your requests to the Service itself go straight to our servers, not through Cloudflare | Global |
We do not sell personal data to anyone, for any purpose.
5. Where your data goes
We are a United States company and our infrastructure spans the United States and the European Union. If you are in the EEA or the UK, using the Service means your data is transferred to the United States. Where a transfer needs a legal basis, we rely on the European Commission’s Standard Contractual Clauses with the providers above.
6. Your rights
Wherever you are, you can ask us to show you the personal data we hold about you, correct it, delete it, or send it to you in a portable form. If you are in the EEA or the UK you also have the right to object to processing and to complain to your local data protection authority.
One address for all of it: cooperation@yallery.app. We answer within 30 days. We will ask you to write from the address on the account, because that is the only way we can tell it is you.
7. Security
Traffic is encrypted in transit. Passwords are stored as bcrypt hashes, so they cannot be read back out of our database.
No system is perfect. If we discover a breach affecting your personal data, we will tell you and the relevant authority without undue delay.
8. Children
The Service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has an account here, write to us and we will remove it.
9. Changes
If we change this policy in a way that materially affects you, we will email the address on your account before it takes effect. The date at the top always says when it last changed.
10. Contact
Yallery, Inc.
22125 Northeast 13th Place, Sammamish, WA 98074, United States
cooperation@yallery.app