Privacy Policy
This policy explains what data Fatih Sancar collects when you use IntactShot, why we process it, and what rights you have.
1. What we collect
- Account data: your email address and a cryptographic hash of your password (we never see the plaintext — authentication runs through Supabase Auth). If you sign in with Google instead, we receive your email address from Google and no password exists at all.
- Content data: the images you upload — product photographs or app screenshots — the product or app page links you paste, the prompts you write, your brand profile, and the videos we generate.
- Usage data: generation records (duration, chosen avatar/voice, credits spent) and technical error logs.
- Billing data: your subscription status and Dodo Payments customer ID. We never see or store your card details — those are processed solely by Dodo Payments.
2. Why we process it
- To provide the Service and generate your videos (performance of a contract);
- To manage your subscription and credit balance;
- To prevent abuse and keep the Service secure (legitimate interest);
- To meet legal obligations (invoicing, accounting).
We do not sell your data or share it with third parties for advertising.
3. Processors we share data with
To run the Service, parts of your data are passed to the processors below. Each receives only what its function requires:
- Supabase — database, authentication, file storage, and the account emails we send you, such as the link that confirms your address. Your account, your uploads and your finished videos live here.
- Google — only if you choose to sign in with Google, which tells us the email address on that Google account.
- OpenRouter — the gateway through which our script-writing model runs, and through which the Kling renderer runs if you choose it in Studio. Your uploaded image, your product description and (for Kling) your script are sent here. OpenRouter routes to DeepSeek (analysis of the image you upload and writing of the script) and, only if you choose the Kling renderer, Kuaishou (the Kling video model, which also generates the spoken voice for that clip).
- Fal.ai — the gateway through which most generation models run. Your uploaded image and your script text are sent here. We hold no direct relationship with most of the model providers; Fal.ai runs two of them on our instruction: Google (the composite frame, in every video) and ElevenLabs (the spoken voice, for the default HeyGen renderer).
- HeyGen — the default renderer. Animates the talking presenter clip from your uploaded image and the ElevenLabs voice. We hold a direct account with HeyGen; your data is sent to them, not routed through Fal.ai. Used unless you choose the Kling renderer in Studio, in which case OpenRouter/Kuaishou renders that clip instead.
- Dodo Payments — payments, invoicing and tax (Merchant of Record).
- Railway — the hosting on which the app and its job queue run.
- Sentry — error monitoring. When something in the app fails it receives the technical details of that failure: the error, the code path it came from, the page you were on, and your browser version. It is configured not to receive your IP address, it sets no cookie, and it never records your screen. We use it to find and fix faults, nothing else.
- PostHog — product analytics, and only if you accept analytics cookies. It receives which features you use, which pages you visit, where you click and scroll, and a replay of your visit reconstructed from the pages you saw. What you type into a field is masked before it is sent, and the images and videos inside your account — your uploads and your finished ads — are blocked from that replay. It also runs the in-app chat widget you can use to reach us: a message you send this way, and the email address you give it to receive a reply, go to our support inbox. If we ask you a question in a short in-app survey, your answer is stored there too — answering is always optional and declining changes nothing about your account. Stored in the European Union.
We do not train any model and we do not hand your content to anyone to train on. The models above are third-party services used through their providers’ APIs.
These providers operate servers outside Türkiye and outside the European Economic Area, principally in the United States. Those transfers are made on the basis of the transfer safeguards in each provider’s data processing terms — in practice the European Commission’s Standard Contractual Clauses, and for providers certified under it, the EU–US Data Privacy Framework.
4. Retention
We keep account and content data for as long as your account exists. There is no automatic expiry: a video you generated stays in your library until you delete it or delete the account. You can delete an individual video from the app at any time.
When you delete your account (Settings → Delete account), your generated videos, uploaded images, brand profile, generation records and account record are permanently deleted, and your login is removed from our authentication provider. One thing to expect: if you still have an active subscription, deletion first cancels it, and if that cancellation cannot be completed the account is not deleted and you are told to cancel from the Billing page first — we will not leave a deleted account being charged.
Two things deliberately survive. Billing records are held by Dodo Payments as Merchant of Record, for as long as tax and accounting law requires, and deleting your account here does not erase them there. On our own side we keep a minimal log of payment events — the payment provider’s event reference, the kind of event and when it happened — because it is what stops a repeated payment notification from being counted twice. The payment details inside those entries are erased with the rest of your account; what remains identifies no one.
5. Your rights
You have the right to access your data, have it corrected, request its deletion, receive a copy in a portable form, restrict or object to processing, and withdraw any consent you gave. You can exercise the deletion right directly in the app (Settings → Delete account). For anything else, write to support@intactshot.com and we will respond within 30 days.
If you think we have handled your data wrongly you can also complain to a supervisory authority: in the EU, the data protection authority of the country you live in; in Türkiye, the Personal Data Protection Authority (KVKK).
6. Children
The Service is for adults. It is not directed at children, we do not knowingly collect data from anyone under 18, and accounts are open only to people of that age or over. If you believe a minor has created an account, write to us and we will delete it.
7. Cookies
We set the cookies required to keep you signed in, plus one that remembers your cookie choice. We also offer an optional analytics category, switched off by default: nothing in it loads unless you turn it on, and turning it back off stops it and deletes what it stored. There is no advertising, remarketing or cross-site tracking on this site. Dodo Payments sets its own necessary cookies during checkout. Every cookie is named and explained in our Cookie Policy, where you can also change or withdraw your choice.
8. Contact
Data controller: Fatih Sancar, an individual based in Denizli, Türkiye. A postal address is available on request by email. For any privacy question, or to exercise any of the rights above: support@intactshot.com. We answer within 30 days, as required by the GDPR.