Privacy policy

Fyp AI is operated by Kairen AI Consulting (KvK 98386212) (“we”, “us”); our full contact details are in section 15. We are the controller of the personal data described in this policy. It explains what we collect, why, who else handles it, how long we keep it and how to delete it.

1. Data we collect

We collect only what the service needs to work. There is no advertising in Fyp AI and no cross-site tracking.

Cookies and browser storage

We set only strictly necessary cookies: without them you can’t sign in. We use no advertising, analytics or tracking cookies, and our website analytics work without cookies. Because every cookie we set is strictly necessary, the law doesn’t require your consent for them, which is why there is no cookie banner.

Checkout and the billing portal run on our payment processor’s own pages, and “Continue with Google” on Google’s; those sites set their own cookies under their own policies.

We don’t collect passwords (you sign in with an email link or Google), card numbers, your contacts, your precise location, advertising identifiers, or anything from your TikTok or Instagram accounts. We don’t post for you and never connect to your social accounts.

2. Where the data comes from

• From you: your email address, the links, brief and files you add, and the edits you make.
• From Google, if you choose Google sign-in (section 3).
• From Apple’s public App Store listing and public customer-reviews feed, when you paste an App Store link. Our server only sends Apple the app link.
• From our payment processor: whether your payment went through and the state of your subscription.

3. Google user data

If you choose “Continue with Google”, Google shares only your name, email address, profile picture and Google account ID with us. We request only the basic sign-in scopes openid, email and profile. We don’t ask for access to Gmail, Google Drive, Contacts, Calendar, YouTube or any other Google data.

• How we use it: only to create your Fyp AI account, sign you in and show which email address you’re signed in with.
• Where it’s stored: on your login record with our hosting and database provider, in the EU. We don’t display or use your profile picture elsewhere.
• What we never do with it: we don’t sell it, we don’t use it for advertising, we don’t use it to train or improve AI models, and we don’t share it with anyone except the service providers we need to run Fyp AI (section 6) or where the law requires it. No one at Fyp AI reads it except when needed for security, to comply with the law, or with your permission.

Fyp AI’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You can remove Fyp AI’s access at any time in your Google Account under Third-party apps & services. That stops Google sign-in for Fyp AI but doesn’t delete your Fyp AI account.

Deleting it. Deleting your account in Settings (section 9) permanently removes your login record, including the data received from Google. You can also ask us to delete it by emailing info@chriga.com.

4. How we use AI

Fyp AI uses AI models from our AI model providers to draft your brief, write and check slideshow text, captions and hashtags, and, when you ask for them on a paid plan, to create AI images and app shots.

• What the AI models receive: your app’s listing details (name, category and description), your brief, slide text, and the image prompts you write. When you use the app-shot builder, they also receive the screenshot and photo you choose for that app shot.
• What they never receive: your email address, name, Google data, payment details or IP address. There are no passwords to send.
• Not used for training: we only use our AI model providers’ paid business services. Under their terms, they don’t use our prompts or the results to train or improve their models. They may keep them for a limited time to detect abuse and meet legal obligations.
• AI images are labelled: they’re marked “AI” in the editor, slideshows that contain them are flagged, and we remind you to use the platform’s AI label when you post. See the AI content notice.

Stock photos. Most slides use photos from a third-party stock photo provider. Our server sends it only search words, never your personal data. In the app, your browser loads photo previews directly from that provider’s image servers, which (like any website serving images) receive your IP address. We don’t analyse stock photos with AI: photos are matched by their descriptions and by which photos people keep.

We don’t make automated decisions about you that have legal or similarly significant effects.

5. We don’t sell or share your data

We have never sold personal data and we don’t share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and similar US state laws. We may disclose data if the law requires it, to enforce our Terms, to protect someone’s rights or safety, or as part of a merger or sale of the business, in which case we’ll tell you first.

6. Service providers

These providers help us run Fyp AI. Each receives only what it needs, under data-processing terms.

7. Legal bases

• Performance of a contract: your account and sign-in (including Google sign-in), making and storing your slideshows, share links, and billing.
• Legitimate interests: security logs, rate limits and bot protection, preventing abuse and runaway costs, anonymous photo scores, and aggregate website analytics. You can object to these at any time.
• Legal obligation: keeping invoices and payment records for tax purposes and answering lawful requests from authorities.

8. International transfers

We’re established in the EU. Our database and files are stored in the EU and our servers run in Frankfurt. Some of our providers, including our AI model providers, payment processor and security and analytics provider, are based in the United States or may process data outside the European Economic Area. Where data leaves the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum) or on the EU–US Data Privacy Framework where the provider is certified.

9. Retention and deleting your account

We keep your data for the periods in section 1. You can delete everything yourself at any time:

Open Settings → Delete account and confirm with “Delete my account”. This immediately cancels any active subscription (without a refund for the current period, except under the EU right of withdrawal in our Terms), deletes all your files (screenshots, uploads, slide images, AI images and app shots), deletes your login record, including any Google sign-in data, and deletes your apps, briefs, slideshows, share links, photo sets, templates, crowd votes, usage records and subscription record. It can’t be undone.

What remains: invoices and payment records at our payment processor for the 7 years Dutch tax law requires; anonymous per-photo totals (a score and a use count) that no longer link to you; copies in our providers’ encrypted backups until those backups expire; and security logs until they expire. None of this is used to run your account or shown to anyone. You can also ask us to delete your data by emailing info@chriga.com.

10. Share links and waitlist pages

When you use “Send to phone”, anyone with that link can view and download the slideshow for 7 days. Links are long random codes that can’t be guessed, and search engines are told not to index them. After 7 days the link stops working; it’s deleted with the slideshow or your account.

If you joined a waitlist

Our users can publish a waitlist page for an app they haven’t launched yet. The email address you enter there is collected by that user, who is named on the page, only to tell you when their app launches. For that list we act on their behalf: we store your address and when you joined, and give it only to them. We don’t email you, sell your address or use it for anything else.

To stop repeated signups from one place, we keep a one-way code made from your internet address and the date. It changes every day, can’t be turned back into your address and isn’t linked to you otherwise. We don’t keep the address itself.

You can take your email off the list at any time with the link shown after you join; the page’s owner must include that link in every email they send you. Your address is also deleted when the owner deletes the app or their account. For anything else about that list, contact the person named on the page, or write to us at info@chriga.com.

11. Security

All traffic is encrypted. Every account’s data is separated at the database level, so one account can’t read another’s. Files are kept in private storage, API keys stay on our servers, and sign-ins and generation are protected by rate limits and bot checks. Access to production systems is limited to the people who need it. No system is perfectly secure, so we can’t guarantee absolute security, but we’ll tell you and the authorities about a breach where the law requires it.

12. Children

Fyp AI is a tool for businesses and app developers. It isn’t meant for anyone under 16, and paid plans are for adults (18+) only. We don’t knowingly collect data from children; if you believe a child has given us personal data, email info@chriga.com and we’ll delete it.

13. Your rights

Everyone

Wherever you live, you can ask to access, correct, delete or receive a copy of your personal data, and you can delete your account yourself in Settings. Email info@chriga.com. We answer within one month.

EEA and UK

Because we’re established in the EU, the GDPR applies to all our processing. You also have the right to object to processing based on our legitimate interests, to ask us to restrict processing, and to complain to a supervisory authority. Ours is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl, but you can also contact the authority where you live.

California

Under the CCPA, as amended by the CPRA, you have the right to know what personal information we collect and why, to delete and correct it, to opt out of its sale or sharing (we do neither) and to limit the use of sensitive personal information (we don’t use any in a way that requires this). Section 1 is our notice at collection. An authorised agent may make a request for you with proof of authorisation. You’ll never be treated differently for using these rights.

Other US states

Residents of states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana have similar rights to access, correct, delete and obtain a copy of their data, and to appeal if we refuse a request. We honour these rights for all US residents. To appeal, reply to our answer or email info@chriga.com with “Appeal” in the subject.

14. Changes to this policy

If we change this policy, we’ll update the date at the top. For important changes we’ll let you know by email or in the app before they take effect.

15. Contact