Privacy Policy

Elhoussin Razouki, HAY EL QODS G A N 201, Tiflet 15400, Morocco is the data controller for personal data processed through Ctrbuddy. Contact us at support@ctrbuddy.com for any privacy question.

Paddle.com acts as our Merchant of Record and is an independent controller for the payment data it collects at checkout. See the Paddle Privacy Policy.

• Account data: your email address, name, password (stored only as a secure hash) and, if you sign in with Google, your Google profile name, email and picture.
• Content you provide: prompts, chat messages, uploaded images and reference images, channel links, transcripts, and the names and descriptions of your projects, personas and styles.
• Persona photos: photos of a person’s face that you upload to create a persona. We use them only to generate images that look like that person at your request. We do not use them to identify people or build biometric templates for recognition.
• YouTube data: public information about channels you point us to, such as thumbnails, titles, avatars and video transcripts, which we use to build Channel DNA style profiles.
• Generated content: the images, text and scores we generate for you.
• Billing data: your plan, subscription status, Paddle customer and subscription IDs, credit balance and purchase history. Paddle collects your payment details. We never receive your full card number.
• Usage and integration data: credit transactions, generation requests, feedback and cancellation reasons you give us, and, for the MCP server, the apps you authorize, access tokens and tool usage logs.
• Technical data: IP address, browser and device information, and server logs needed to run and secure the Service.

• to create and secure your account and sign you in;
• to provide the Service, including generating, editing, storing and sharing your thumbnails;
• to manage subscriptions, credits, refunds and billing support;
• to send account emails such as verification, password reset and important service or policy updates;
• to prevent fraud, abuse and violations of our Terms, and to enforce rate limits;
• to understand how features are used and improve the Service;
• to comply with legal, tax and accounting obligations.

We do not use your data for advertising, and we do not sell or rent it.

If you are in the EEA, the UK or a similar jurisdiction, we rely on:

• Contract: to provide the Service you signed up for;
• Legitimate interests: to keep the Service secure, prevent abuse and improve features, balanced against your rights;
• Consent: where you give it, for example when you upload persona photos (you also confirm that the person pictured has consented). You can withdraw consent by deleting the persona;
• Legal obligation: to keep billing and tax records.

To generate results, we send the relevant prompts, images and context to the AI providers listed below. They process this data on our behalf to return a result. Under our agreements and their API terms, they do not use API data to train their models. We do not use your content or generated images to train our own models.

We share personal data only with providers that help us run the Service, under contracts that limit how they can use it:

We may also share data if the law requires it, to protect our rights or users’ safety, or as part of a business transfer such as a merger or sale, in which case this policy will continue to apply to your data. Projects you make public can be seen by anyone with the link.

Our providers may process data outside your country, including in the United States. Where data from the EEA, the UK or Switzerland is transferred, we rely on adequacy decisions or Standard Contractual Clauses and similar safeguards.

• We keep account data and content while your account is active.
• When you delete a project, persona or style, we remove it from the Service. Copies in our providers’ backups are removed on their normal backup schedule.
• When you ask us to delete your account, we delete or anonymize your personal data within 30 days, except where we must keep it longer.
• We keep billing and transaction records for as long as tax and accounting laws require, usually up to 10 years.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent at any time. Residents of California and other US states have the right to know, delete and correct their data and to not be discriminated against for using these rights. We do not sell or share personal data for cross-context behavioral advertising.

To use any of these rights, email support@ctrbuddy.com from the address on your account. We will respond within 30 days. You can also complain to your local data protection authority.

We use only cookies and local storage that are needed for the Service to work, such as keeping you signed in and remembering your theme. We do not use advertising or cross-site tracking cookies. Paddle sets its own cookies during checkout to process payments and prevent fraud.

We protect your data with encryption in transit, hashed passwords, access controls and scoped, revocable tokens for connected apps. No system is perfectly secure, so please use a strong, unique password. If a breach affects your data, we will notify you and the authorities as the law requires.

Ctrbuddy is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. If a change is material, we will tell you by email or in the app before it takes effect. The date at the top shows when this policy was last updated.

Questions or requests about your privacy: support@ctrbuddy.com, Elhoussin Razouki, HAY EL QODS G A N 201, Tiflet 15400, Morocco.