Privacy Policy
This policy explains what data Fatih Sancar collects when you use IntactShot, why we process it, and what rights you have.
1. What we collect
- Account data: your email address and a cryptographic hash of your password (we never see the plaintext — authentication runs through Supabase Auth). If you sign in with Google instead, we receive your email address from Google and no password exists at all.
- Content data: the images you upload — product photographs or app screenshots — the product or app page links you paste, the prompts you write, your brand profile, and the videos we generate.
- Usage data: generation records (duration, chosen avatar/voice, credits spent) and technical error logs.
- Billing data: your subscription status and Lemon Squeezy customer ID. We never see or store your card details — those are processed solely by Lemon Squeezy.
2. Why we process it
- To provide the Service and generate your videos (performance of a contract);
- To manage your subscription and credit balance;
- To prevent abuse and keep the Service secure (legitimate interest);
- To meet legal obligations (invoicing, accounting).
We do not sell your data or share it with third parties for advertising.
3. Processors we share data with
To run the Service, parts of your data are passed to the processors below. Each receives only what its function requires:
- Supabase — database, authentication and file storage. Your account, your uploads and your finished videos live here.
- Google — only if you choose to sign in with Google, which tells us the email address on that Google account.
- OpenAI — analysis of the image you upload and writing of the script (GPT-4o mini).
- Fal.ai — the gateway through which every generation model runs. Your uploaded image and your script text are sent here. We hold no direct relationship with the model providers; Fal.ai runs three of them on our instruction: Google (the composite frame, in every video), MiniMax (the spoken voice) and HeyGen (the talking presenter clip).
- Lemon Squeezy — payments, invoicing and tax (Merchant of Record).
- Railway — the hosting on which the app and its job queue run.
- Resend — delivery of the account emails we send you, such as the link that confirms your address. It receives your email address and the contents of that message, nothing else.
We do not train any model and we do not hand your content to anyone to train on. The models above are third-party services used through their providers’ APIs.
These providers operate servers outside Türkiye and outside the European Economic Area, principally in the United States. Those transfers are made on the basis of the transfer safeguards in each provider’s data processing terms — in practice the European Commission’s Standard Contractual Clauses, and for providers certified under it, the EU–US Data Privacy Framework.
4. Retention
We keep account and content data for as long as your account exists. There is no automatic expiry: a video you generated stays in your library until you delete it or delete the account. You can delete an individual video from the app at any time.
When you delete your account (Settings → Delete account), your generated videos, uploaded images, brand profile, generation records and account record are permanently deleted, and your login is removed from our authentication provider. One thing to expect: if you still have an active subscription, deletion first cancels it, and if that cancellation cannot be completed the account is not deleted and you are told to cancel from the Billing page first — we will not leave a deleted account being charged.
Billing records are held by Lemon Squeezy as Merchant of Record, for as long as tax and accounting law requires, and deleting your account here does not erase them there.
5. Your rights
You have the right to access your data, have it corrected, request its deletion, receive a copy in a portable form, restrict or object to processing, and withdraw any consent you gave. You can exercise the deletion right directly in the app (Settings → Delete account). For anything else, write to support@intactshot.com and we will respond within 30 days.
If you think we have handled your data wrongly you can also complain to a supervisory authority: in the EU, the data protection authority of the country you live in; in Türkiye, the Personal Data Protection Authority (KVKK).
6. Children
The Service is for adults. It is not directed at children, we do not knowingly collect data from anyone under 18, and accounts are open only to people of that age or over. If you believe a minor has created an account, write to us and we will delete it.
7. Cookies
We set the cookies required to keep you signed in, plus one that remembers your cookie choice. There is no analytics, advertising or third-party tracking on this site today; the optional category exists, is switched off by default, and nothing in it loads unless you turn it on. Lemon Squeezy sets its own necessary cookies during checkout. Every cookie is named and explained in our Cookie Policy, where you can also change or withdraw your choice.
8. Contact
Data controller: Fatih Sancar, an individual based in Denizli, Türkiye. A postal address is available on request by email. For any privacy question, or to exercise any of the rights above: support@intactshot.com. We answer within 30 days, as required by the GDPR.