Privacy Policy

Effective 17 August 2026. Elyum (company registration pending) (“Elyum”, “we”) operates elyum.ai. This policy explains what personal data we process, why, and your rights. Contact: [email protected].

1. What we collect

  • Account data — email, name, password hash (or the identifier from a sign-in provider such as Google), sessions (IP address, user agent), API keys (hashed) and OAuth grants.
  • Billing data — plan, credit ledger, coupon redemptions. Card details are handled by our payment provider when card checkout is enabled; we never store card numbers.
  • Content — what you upload (product photos, reference clips, creator photos, briefs, product descriptions) and what you generate (images, videos, scripts), plus review decisions (keep/kill).
  • Usage & logs — generation records (model, timing, credits, status), audit events, mail we send you (outbox), technical logs for security and debugging.

2. Why (legal bases)

To provide the service you asked for (contract): accounts, metering, generation, delivery. To keep the service secure and prevent abuse (legitimate interest): rate limits, caps, audit, fraud checks. To send transactional mail (contract) — password resets, verification, receipts. To improve the product (legitimate interest) using aggregate usage; we do not train models on your content. Marketing mail only with consent.

3. Where your content goes

To generate output, your inputs (prompts, uploaded images/clips, creator photos) are sent to third-party AI model providers via our inference gateway; providers may cache outputs at unguessable URLs for a limited retention window. We mirror outputs to storage we control and serve them from there. Sub-processors: hosting and database, our AI gateway and the model providers it routes to (image, video, speech and language models), transactional email, and — when enabled — the payment provider. A current list is available on request at [email protected].

4. Retention

Account and content data are kept while your account exists. Deleting your account (from /account) removes your workspace, ledger, generations and mirrored files; audit records keep an anonymous tombstone. Locked previews you never keep are released after 72 h. Logs are retained for a limited period for security.

5. Cookies

We use strictly necessary cookies for sign-in and security. No advertising cookies. If we add analytics we will say so here.

6. Your rights

Depending on where you live you can access, correct, export or delete your data, object to or restrict processing, and complain to a supervisory authority. Most of this you can do yourself on /account (profile, sessions, keys, delete account); for anything else email [email protected].

7. Real people in your content

If you upload photos or voices of real people (yourself, staff, creators), you are responsible for having their consent. Do not upload other people's likenesses without it. House creators are synthetic.

8. Children

Elyum is for adults (18+). We do not knowingly collect data from children.

9. Changes

We will post changes here and update the effective date; material changes will be flagged in the app.