Privacy Policy

1. Who we are

Hunaipot ("Hunaipot", "we", "us") is the controller of the personal data described in this policy. This policy covers hunaipot.com (the "Site") and the Hunaipot application at app.hunaipot.com (the "Platform").

We handle personal data under the UK GDPR and the Data Protection Act 2018, and under the EU GDPR where it applies to you.

2. What we collect

• Account data: name, email address, password hash, plan and billing cycle, and your communication preferences.
• Billing data: the subscription and transaction records we need for accounting. Card details are entered directly with our payment provider and we never see or store the full card number.
• Content data: prompts, reference images, briefs, persona settings, and the images, videos, and text generated under your account.
• Support and booking data: what you send us by email, and the name, email, and answers you give when you book a call through our scheduling provider.
• Usage data: IP address, approximate location derived from it, device and browser type, pages viewed, referring page, and actions taken on the Site and Platform.
• Cookie data: as described in section 8.

We do not ask you for special category data, and you should not send it to us. We do not knowingly collect data from anyone under 18; the Services are for adults only.

3. Why we use it, and our legal basis

• To provide the Services (create your account, run generations, deliver done-for-you work, provide support). Basis: performance of our contract with you.
• To take payment and keep accounts. Basis: contract, and legal obligation for tax and accounting records.
• To keep the Services safe (fraud prevention, abuse detection, moderating content against our acceptable use rules, securing accounts). Basis: legitimate interests in running a lawful and secure service, and legal obligation where we must report unlawful material.
• To improve the Services (analytics, debugging, measuring which pages and features work). Basis: legitimate interests, and consent where cookies require it.
• To market Hunaipot, including using content generated on the Platform in our own promotional material as described in section 4. Basis: legitimate interests and the licence you grant us in our Terms of Service, and consent for marketing emails where the law requires it.
• To meet legal obligations and defend legal claims. Basis: legal obligation and legitimate interests.

4. Content generated on the Platform

Clause 7 of our Terms of Service gives Hunaipot a licence to use content generated on the Platform for marketing and other purposes that further our business. In practice that means a persona's images and videos may appear in our adverts, on our website, in showcases, or in case studies.

When we do that we present the content on its own. We do not publish your name, your email address, or the fact that you are the operator behind a persona, unless you have asked us to or have given a testimonial in your own name. Personas are synthetic characters and are not personal data about you.

If you would rather a particular item were not used, email hello@hunaipot.com. We will stop future use where we reasonably can, though we may not be able to recall material already distributed.

5. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our instructions, and only as far as they need it:

• hosting, content delivery, and security providers;
• our payment provider, for subscriptions and one-off purchases;
• our scheduling provider, for calls you book with us;
• email and customer support providers;
• analytics and error monitoring providers;
• AI model and generation providers, which receive the prompts and reference material needed to produce an output;
• professional advisers, and a buyer or successor if the business is sold or reorganised.

We also disclose data where we are required to by law, by a court, or by a regulator, and where it is necessary to report unlawful material or to establish or defend legal claims.

6. International transfers

Some of our providers are outside the UK and the EEA, including in the United States. Where data is transferred there, we rely on UK or EU adequacy decisions where they exist, and otherwise on standard contractual clauses together with the UK International Data Transfer Addendum, plus any additional safeguards that are appropriate.

7. How long we keep it

• Account and content data: while your account is open, and for up to 12 months after you close it, so that an account can be restored and disputes resolved.
• Billing and tax records: 6 years from the end of the relevant financial year, as UK law requires.
• Support and booking records: up to 3 years.
• Moderation and abuse records: as long as needed to keep the Services safe and to meet reporting obligations.
• Content used in our marketing under section 4 may be kept and used after your account closes, as the licence in the Terms allows.

8. Cookies

We use cookies and similar technologies that are strictly necessary to run the Site and keep you signed in, and, with your consent, cookies that measure how the Site is used and how well our advertising performs. You can change or withdraw consent at any time through your browser settings or any cookie control we provide.

9. Security

We use encryption in transit, access controls, and staff confidentiality obligations, and we limit access to personal data to people who need it to do their job. No system is perfectly secure, so we cannot promise absolute security, but we will tell you and the regulator about a breach where the law requires it.

10. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw consent where we rely on it. You can object at any time to processing we carry out for direct marketing.

To exercise a right, email data@hunaipot.com with the subject "FAO DPO". We will respond within one month, and will tell you if we need longer because the request is complex. There is no charge unless a request is manifestly unfounded or excessive.

Erasing your account data does not end the content licence in our Terms, because that licence covers synthetic content rather than personal data about you. If material we have published does identify you, tell us and we will remove it.

11. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority in the EU country where you live.

12. Changes to this policy

We may update this policy. The date at the top of this page shows the current version, and we will give notice of significant changes by email or in the Platform.

13. Contact

Data protection queries: data@hunaipot.com, subject "FAO DPO". Anything else: hello@hunaipot.com.