Privacy Policy

1. Who We Are

The controller responsible for your personal data is:

SEQUEL AI LTD
Registered number: 16897137
Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
Privacy contact: [email protected]

We answer support emails with AI assistance; your message is processed by our AI provider only to reply to you.

2. About the Service

AutoGenShorts is a software service that helps users create and publish short-form video content. Depending on how you use the Service, you may create or upload scripts, generate images, voiceovers, captions, thumbnails and videos, configure topics and publishing schedules, and connect social media accounts for publishing.

3. The Personal Data We Collect

We may collect and process the following categories of personal data:

a. Account information

• Name
• Email address
• Login and account details
• Email verification status
• Profile and account preferences

Passwords are handled through our authentication provider and are not stored in our application database in readable form.

b. Subscription and billing information

• Subscription plan and status
• Payment-related reference information such as customer and subscription identifiers
• Refund status where relevant
• Affiliate payout information where applicable, including PayPal payout email addresses for affiliate administration

We do not store full payment card details. Payments are processed by Stripe.

c. Content and usage data

• Scripts you upload
• Scripts, images, voiceovers, captions, thumbnails and videos generated through the Service
• Topics, niches, series settings, brand or persona preferences and publishing schedules
• Publishing history, connection status, operational records and troubleshooting logs

d. Connected account data

If you choose to connect a social media account, we may receive and store information needed to maintain that connection and publish content on your behalf, including:

• Account or channel identifiers
• Account display information
• Access tokens
• Refresh tokens
• Token expiry information
• Granted scopes and related connection metadata

e. Technical data

• IP address
• Browser type
• Device information
• General application and security logs
• Cookie preferences

f. Support and communications data

• Emails and messages you send to us
• Records of support and privacy requests

4. How We Use Your Personal Data

We use personal data to:

• Create and manage user accounts
• Provide, operate and maintain the Service
• Generate content requested by you
• Store your settings, preferences and schedules
• Process subscriptions, payments and refunds
• Administer affiliate relationships and payouts where applicable
• Connect and maintain authorised social media integrations
• Publish content to connected accounts where you have enabled this functionality
• Send service-related, administrative and security communications
• Provide customer support
• Monitor, troubleshoot and improve service reliability and performance
• Prevent fraud, abuse, misuse and unauthorised access
• Comply with legal, regulatory, tax and accounting obligations
• Send marketing communications where permitted by law or where you have consented

We do not use customer content to train our own AI models.

5. Legal Bases for Processing

Depending on the circumstances, we rely on the following legal bases under UK data protection law:

• Contract: where processing is necessary to provide the Service you requested, including account creation, subscription management, content generation, scheduling, connected account publishing and service communications
• Legitimate interests: where processing is necessary for security, fraud prevention, service administration, operational monitoring, support, debugging and maintaining the reliability of the Service
• Consent: where required for marketing communications and non-essential cookies
• Legal obligation: where we need to comply with legal, tax, accounting, regulatory or law enforcement obligations

6. AI Providers and Automated Content Generation

To provide the Service, we use third-party AI providers for tasks such as script generation and image generation.

When using these providers, we send the content inputs needed to generate the output you requested. We do not intentionally send your email address or other direct user identifiers as part of routine content generation requests.

In limited cases, authorised personnel may review content or account-related information where reasonably necessary for support, debugging, abuse prevention, quality control or service reliability.

We do not use your content to train our own models.

7. Connected Social Media Accounts

You may choose to connect supported social media accounts, including YouTube, TikTok and Instagram, using official OAuth authorisation flows.

Instagram is connected through Facebook Login, operated by Meta Platforms, Inc. Instagram publishing requires an Instagram professional (Business or Creator) account linked to a Facebook Page. Instagram publishing is available: when you connect an Instagram account, the Reels you choose to publish are posted to that account through the connection you authorise. We request only the following Meta permissions:

• instagram_content_publish: to publish the videos you create with the Service as Instagram Reels on the account you connect, on the schedule you set
• instagram_basic: to read your Instagram account's ID and username, so we can publish to it and show you which account is connected
• pages_show_list: to find the Facebook Page linked to your Instagram account
• pages_read_engagement: to read that Page's linked Instagram account and obtain the Page access token Instagram publishing requires

From Meta we store your Instagram account ID and username, the name of the linked Facebook Page, a Page access token, your Facebook user ID (used only to revoke our access when you disconnect) and the permissions you granted. We do not read, store or analyse your Instagram posts, followers, messages, comments or insights, and we do not post to or change your Facebook Page.

When you do this, we may receive and store the information needed to maintain the connection and publish content on your behalf, including account identifiers, display information, access tokens, refresh tokens, token expiry details and granted scopes.

We use this information only for the purposes of maintaining the connection, enabling publishing functionality, operating the Service, troubleshooting issues, preventing abuse and maintaining appropriate records.

OAuth access tokens and refresh tokens are encrypted at rest in our systems.

When you disconnect a supported social media account, or when your account is deleted, we delete the relevant connection records and tokens from our systems. Where supported, we also attempt to revoke the relevant tokens with the platform. If upstream revocation is unsuccessful, we still remove the connection data from our systems.

You may also be able to revoke the Service's access directly from the relevant social media platform. For Instagram, you can remove AutoGenShorts in Facebook under Settings & privacy → Settings → Business integrations.

We do not use data from connected YouTube, TikTok or Instagram accounts for general analytics, advertising profiling or training AI systems, and we do not sell it.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service and remember your preferences.

These may include:

• Necessary cookies required for authentication, security and core site functionality
• Optional analytics cookies
• Optional marketing cookies

Where required by law, we ask for your consent before using non-essential cookies. You can manage your cookie preferences through our cookie banner or related settings tools.

9. How We Share Personal Data

We may share personal data with trusted third parties where necessary to operate the Service, including:

• Authentication providers
• Payment processors such as Stripe
• AI service providers used for content generation
• Cloud hosting, database and storage providers
• Email and communications providers
• Social media platforms you choose to connect for publishing
• Professional advisers, auditors, insurers or legal representatives where reasonably necessary
• Regulators, authorities or law enforcement where required by law

We do not sell your personal information.

Requests from public authorities

If a court, regulator, law enforcement agency or other public authority asks us for personal data, including data we receive from connected platforms such as Meta (Instagram and Facebook), we:

• Review every request to confirm it is legally valid and that we are legally required to comply
• Challenge requests that we consider unlawful, overly broad or inappropriate, using the legal remedies available to us
• Disclose only the minimum personal data necessary to meet the request
• Keep a record of each request, our response, the legal basis relied on and who was involved

10. International Transfers

Because we use service providers and integrations that may operate in different countries, your personal data may be transferred to and processed outside the UK or your home country.

Where required, we take appropriate steps to ensure such transfers are subject to suitable safeguards in accordance with applicable data protection law.

11. Data Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

These measures include, where appropriate:

• Encryption in transit using HTTPS/TLS
• Access controls and restricted internal access
• Encrypted storage of OAuth tokens
• Security logging and audit records for certain administrative and connection events

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

12. Data Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain your account, respond to support issues, keep appropriate business records, prevent fraud and comply with legal obligations.

In general:

• Account information is retained while your account remains active and for a reasonable period afterwards where necessary
• Billing, payment and financial records may be retained for longer where required by law
• Connected account records and tokens are retained only while needed to maintain the relevant connection, unless earlier deleted following disconnection or account deletion
• Generated content, uploaded scripts and related operational records are retained only for as long as reasonably necessary for service operation, user access, support, internal housekeeping and legitimate business purposes
• Rendered video files are deleted 90 days after they are generated or last published (whichever is later), and voice-over working files 7 days after the video is rendered. Videos you have published stay on the platforms you published them to.
• Deleted data may remain in backups for a limited period before those backups expire

13. Account Deletion and Data Deletion Requests

You may request deletion of your account and personal data by contacting [email protected].

We will review and action valid requests within a reasonable period and in accordance with applicable law. In some cases, we may need to retain certain information where required for legal, tax, accounting, fraud prevention, dispute resolution or regulatory reasons.

If you disconnect a connected social media account, we will remove the associated connection data and tokens from our active systems, even if some limited records may remain temporarily in backups or logs for operational or legal reasons.

Step-by-step instructions for deleting data we hold from a connected Instagram or Facebook account are on our data deletion instructions page.

14. Marketing Communications

We may send you service-related communications that are necessary to operate your account or provide the Service.

We may also send product updates, news and marketing communications where permitted by law. You can opt out of marketing emails at any time by using the unsubscribe link in the message or by contacting us. Opting out of marketing does not stop essential service communications.

15. Your Rights

Depending on where you are located and subject to applicable law, you may have rights including:

• The right to access your personal data
• The right to correct inaccurate personal data
• The right to request deletion of personal data
• The right to restrict certain processing
• The right to object to certain processing
• The right to data portability

These rights are not absolute and may be subject to legal exemptions and limitations.

To exercise your rights, contact [email protected].

If you are in the UK and are unhappy with how we handle your personal data, you also have the right to complain to the Information Commissioner's Office (ICO).

16. Children

The Service is not intended for children or minors, and we do not target minors through the Service.

17. Third-Party Services and Platforms

The Service may contain links to or integrations with third-party services and platforms. Their privacy practices are governed by their own policies and terms. We encourage you to review those policies when connecting accounts or using third-party services.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, legal requirements or our data practices.

If we make material changes, we will take reasonable steps to notify users where appropriate, such as through the Service or by email.

19. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact:

[email protected]

SEQUEL AI LTD
128 City Road
London
United Kingdom
EC1V 2NX