This Privacy Policy explains how KRILX collects, uses, stores, and shares personal data when you use our AI creation, account, payment, and community services.
KRILX (“KRILX,” “we,” “us,” or “our”) is the product and service described in this Policy. The legal entity that operates the Service and acts as controller is [FULL LEGAL NAME OF SERVICE OPERATOR], with registered address at [REGISTERED ADDRESS]. The configured product name does not establish the operator’s legal identity.
For privacy requests or questions about this Policy, contact legal@krilx.com. For account and product support, contact support@krilx.com. If applicable law requires us to appoint a Data Protection Officer or local representative, their contact details are [DPO / LOCAL REPRESENTATIVE NAME AND CONTACT].
This Policy is intended to describe the processing undertaken for the current Service. The operator must confirm the legal entity, registered address, applicable jurisdiction, and any required DPO or representative details before publication.
This Policy covers personal data processed when you visit or use our websites and mobile applications, create or manage an account, use AI generation tools, purchase or use credits or subscriptions, publish or interact with content, contact support, or otherwise communicate with us.
This Policy does not govern third-party websites, services, payment pages, AI model terms, or applications that we do not operate. Those providers publish their own privacy notices and terms. Our Terms of Service and Acceptable Use Policy separately govern use of the Service.
Account and identity data: account and user identifiers; email address; name; password and authentication information managed through our authentication provider; email-verification and login codes and their purpose, expiry, and verification status; and account creation, update, active, or disabled status. We do not receive or store your plaintext password through our application database as part of ordinary authentication.
Profile and preference data: avatar image or avatar storage key; public handle; biography; profile visibility and activity preferences; language preference; theme preference; and settings such as default voice, aspect ratio, subtitles, subtitle font and position, and notification or marketing preferences. The application settings schema also supports optional third-party API credentials such as OpenAI, Pexels, or ElevenLabs credentials; do not provide such credentials unless the relevant feature is enabled and you are authorized to do so.
Payment, subscription, and credit data: selected plan and billing interval; subscription status and period dates; payment amount and currency; transaction references and provider payment identifiers; purchase type and credit-pack or plan identifiers; payment status; credit balance, grants, deductions, refunds, and ledger labels; and related metadata. Payments are initiated through hosted Flutterwave checkout. We do not intend to collect full payment-card numbers or security codes in our own application database; the payment provider may collect and process them directly.
Content and generation data: prompts, negative prompts, scripts, lyrics, text to be spoken, reference images and audio, uploaded cover or thumbnail files, generation settings and model selection, tool and task identifiers, job status and progress, error information, generated scripts, images, audio, video, thumbnails, file names, file sizes, media types, dimensions, durations, and associated metadata. We process these items to carry out a generation or editing request and may store them in your task history, creations library, database, or object storage.
Community data: content titles, descriptions, style tags, published media, visibility selection (including public or unlisted), comments and replies, likes, views, follows, blocks, and related identifiers and timestamps. Public profile details and public creations may include your handle, avatar, biography, and interactions.
Device, network, and service data: IP address and request metadata made available to our hosting or security providers; country or regional information made available by the edge platform; browser, operating system, app version, language, request method and URL, response status, timestamps, duration, and technical error or diagnostic information. We do not identify an in-app collection of precise GPS location in the reviewed implementation.
Payment localization data: when determining a localized credit-pack price, the backend reads request-region information from Cloudflare and may request currency or IP-geolocation information from external services. The implementation references ipapi.co, ipwho.is, freeipapi.com, and latest.currency-api.pages.dev. We do not use this feature to provide precise physical location tracking.
Communications and support data: the content and contact details of messages you send us and records of our responses. For account verification, login, two-factor authentication, or email changes, we use your email address and send a time-limited one-time code through Mailgun.
Information from others: we may receive transaction confirmation and limited payment details from Flutterwave; authentication and account information from Supabase; and public content or reports submitted by other users. We may also receive technical and security data from hosting, storage, and model infrastructure providers.
To create, authenticate, secure, and administer accounts; verify email addresses; support login, password reset, two-factor authentication, and account changes; maintain profiles, preferences, and sessions; and respond to support requests.
To provide the features you request: receive prompts and uploads, calculate credit usage, create and manage queued generation jobs, route content and generation parameters to the applicable inference environment, return generated content, and maintain generation history and your creations library.
To store and deliver user content, avatars, generated media, thumbnails, and optional post covers; support download, editing, and sharing; and operate Explore, public or unlisted posts, profiles, comments, likes, follows, and blocking according to your choices.
To process payments, verify transactions, issue subscriptions and credits, manage renewals and cancellations, maintain transaction and credit ledgers, detect suspected fraud, and provide billing support.
To operate, protect, debug, and maintain the Service; monitor task status and errors; protect accounts and infrastructure; investigate suspected misuse or security incidents; enforce our Terms and Acceptable Use Policy; and prevent fraud, abuse, and illegal activity.
To determine regional currency or pricing where supported; send transactional service emails; provide notices about account, security, billing, or changes to the Service; comply with legal obligations; respond to lawful requests; and establish, exercise, or defend legal claims.
The reviewed code includes service and error logging and Cloudflare Worker observability. The web application also has API diagnostics that can record request method, URL, status, timestamp, duration, and error message. Logs may incidentally contain personal data, such as identifiers embedded in a URL or technical error information. We use logs for operations and troubleshooting and seek not to place passwords, verification codes, or full payment credentials in them.
The reviewed application code did not show an integrated third-party analytics or cross-context behavioral advertising service. The mobile project includes a Google Mobile Ads package dependency, but an active ad request or advertising measurement flow was not identified in the audit. If advertising or analytics collection is enabled, we will update this Policy and obtain consent where required before such processing.
Where the GDPR, UK GDPR, Nigeria Data Protection Act, or similar laws apply, our legal basis depends on the processing and applicable law. We may rely on performance of a contract or steps taken at your request before entering a contract, including account, generation, storage, billing, and support functions.
We may rely on our legitimate interests, balanced against your rights, to secure and improve the Service, prevent fraud and abuse, troubleshoot errors, administer business operations, and defend legal claims.
We may process data to comply with legal obligations, including accounting, tax, consumer-protection, safety, and lawful disclosure requirements, and to protect vital interests or the rights and safety of users and others where legally permitted.
Where required, we rely on your consent, including for non-essential cookies or similar technologies, optional marketing, or other processing that requires consent. You may withdraw consent at any time, without affecting processing that occurred before withdrawal or processing based on another legal basis.
Where we rely on legitimate interests, you may have the right to object as described in Section 11. The specific legal basis may vary by jurisdiction and by the purpose for which data is used.
We and our service providers may process personal data in countries other than the country where you live, including in the locations where Supabase, Cloudflare, Modal, Hugging Face, Flutterwave, Mailgun, and other providers operate. Those countries may have data-protection laws different from those in your country.
Where required by applicable law, we will use an appropriate transfer mechanism, such as an adequacy decision, standard contractual clauses, or another legally recognized safeguard, and take any additional measures required in the circumstances. Information about applicable safeguards may be requested from the privacy contact in Section 15.
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining account and generation history, resolving disputes, enforcing agreements, protecting security, and meeting legal, tax, accounting, and reporting obligations. The applicable period depends on the data type, the user’s choices, the purpose, and legal requirements.
Account and profile information is generally retained while the account is active and as needed to handle closure, disputes, security, and legal obligations. Prompts, task records, scripts, generated files, and creation history may remain in the account until deleted or until account closure and associated deletion processing. Public posts may remain visible until you remove them or we remove them, subject to backups, prior sharing, legal holds, and moderation needs.
Payment, subscription, transaction, and credit-ledger records may be retained after account closure for tax, accounting, fraud-prevention, chargeback, dispute, and other legal purposes. Verification codes are created with a ten-minute expiry and are subject to attempt limits; this expiry is not a complete retention period for all related verification records.
The account-deletion function currently disables the profile and records a deletion request scheduled for 30 days after the request. The repository audit did not identify an automated worker that completes account deletion when that scheduled date arrives. Therefore, the recorded schedule alone should not be understood as proof that all account data is automatically deleted at that time. The operator must complete deletion requests, define and communicate actual retention periods, and update the deletion workflow before representing that scheduled deletion is automatically completed.
Some data may remain in encrypted or access-restricted backups until they are overwritten under the applicable backup cycle, or may be retained in a minimized form where required to comply with law, prevent fraud, establish or defend legal claims, or protect safety. Publicly shared content may also remain in copies made by others before removal.
The current implementation does not specify fixed retention durations for most account, generation, support, payment, diagnostic-log, or backup records. The operator must document and apply a retention schedule consistent with applicable law and the statements in this Policy.
We use technical and organizational measures designed to protect personal data, which may include authentication, access controls, role restrictions, secure connections, protected service credentials, monitoring, and safeguards provided by our infrastructure and storage providers.
No system or transmission method is completely secure. We cannot guarantee absolute security. You are responsible for protecting your account credentials and should promptly notify us at support@krilx.com if you believe your account or information has been compromised.
Depending on your location and subject to applicable exceptions, you may have the right to request access to personal data; receive a copy or portability-format export; correct inaccurate or incomplete data; request deletion; restrict or object to certain processing; withdraw consent where processing is based on consent; and lodge a complaint with your local data-protection authority.
You may also have rights under applicable U.S. state privacy laws, such as the right to know or access, correct, delete, obtain a portable copy, or opt out of certain targeted advertising, sale, or profiling. The reviewed implementation did not identify sale or cross-context behavioral advertising; rights and definitions depend on the law that applies to you.
To exercise a right, contact legal@krilx.com. We may ask for information reasonably necessary to verify your identity and locate the data, and may ask an authorized agent to provide proof of authority. We will respond within the time required by applicable law and explain any lawful reason we cannot fulfill a request.
You may update certain account, profile, language, and privacy settings through the Service. Deleting local app data or signing out does not itself delete server-held account data. You may appeal a decision on a rights request by replying to our response or contacting the privacy contact. You may also complain to a competent supervisory authority.
The Service is intended for people at least 18 years old and is not directed to children. We do not knowingly permit children to create accounts or use the Service. If you believe a child has provided personal data, contact legal@krilx.com. We will take reasonable steps to investigate and, where appropriate, restrict the account and delete information, subject to legal obligations and safety requirements.
When you request a generation or editing feature, our systems process your prompt, settings, and relevant uploaded content through an automated model workflow to produce text, images, audio, video, or other requested output. The specific model and inference environment may vary by feature and availability. As described in Section 6, requests may be sent to Modal-hosted inference services, and generated assets may be returned to our database or Cloudflare R2 storage.
We may use automated filters, credit and plan checks, task queues, security controls, and fraud signals to determine whether to accept, route, limit, or review a request. These systems may produce errors or false positives. You may contact support to request review of an account or content restriction.
The reviewed Service is not designed to make solely automated decisions that produce legal or similarly significant effects about you. Do not use generated output as the sole basis for decisions with significant effects on an individual. If we introduce such processing, we will provide the notices, explanation, and rights required by law.
The reviewed implementation uses models to fulfill user generation requests. We do not state that private prompts or outputs are used to train a general-purpose model operated by us. Service providers may process data under their own terms to provide inference, security, and hosting; consult their applicable privacy terms and the Privacy Policy for material changes. We will update this Policy before introducing materially different model-training uses where required.
Our current architecture uses Supabase for authentication and database services; Cloudflare Workers and R2 for backend hosting, request handling, observability, and file storage; Modal for generation infrastructure; Hugging Face for access to certain model artifacts; Flutterwave for payments; and Mailgun for transactional email. Currency or regional features may also make server requests to ipapi.co, ipwho.is, freeipapi.com, and latest.currency-api.pages.dev. This list may change as the Service changes.
Third-party services may independently process information under their own privacy notices, security practices, and terms. We encourage you to review those notices. We are responsible for selecting and managing providers to the extent required by applicable law, but cannot control a provider’s independent processing or the operation of its service.
The mobile application includes a Google Mobile Ads software dependency, but the reviewed application code did not show active ad requests or advertising measurement. If advertising is activated, the relevant provider, data, and choices will be described in an updated notice before processing begins where required by law.
We may update this Policy to reflect changes in our services, processing, providers, or legal requirements. We will revise the Last Updated date and, where required by law, provide advance notice or obtain consent. Material changes may be communicated through the Service or by email. The updated Policy applies from its stated effective date, subject to any additional consent required by law.
Privacy requests and questions: legal@krilx.com. Account and product support: support@krilx.com.
Controller: [FULL LEGAL NAME OF SERVICE OPERATOR]. Registered address: [REGISTERED ADDRESS]. Data Protection Officer or local representative, if required: [DPO / REPRESENTATIVE NAME AND CONTACT].
The product configuration currently identifies the jurisdiction as the Federal Republic of Nigeria, but the operator’s legal identity, establishment, applicable regulator, and DPO or representative requirements have not been confirmed by the codebase. These details must be verified and completed before publication.