privacy

RYVESA LTD

Terpsichoris 15, Eleftheriou Hill Residence, Flat/Office 202, 2102 Aglantzia, Nicosia, Cyprus

Data-protection contact: privacy@pirumi.cy

General contact: contact@pirumi.cy

We are not legally required to appoint a Data Protection Officer, but you can reach our data-protection contact above for any privacy question.

• Account details: your email, username, display name and profile picture, managed through our sign-in provider (Clerk), so you can log in and be identified on the platform. We also record which version of our terms you last accepted, and when. You accept them by ticking a box as you create your account, at checkout (where you also confirm that you are 18 or over) and in a creator application; each order and each application also records the time of its own tick. We keep this with your account and, for an order, with that order, so we can show which terms you agreed to; this is our legitimate interest (Article 6(1)(f)).
• Signing in with Apple, Google or Twitch: if you sign in with one of these services, it sends Clerk your account id there, your email address, your name or username and, from Google and Twitch, your profile picture. Clerk also keeps the sign-in token the service issues; we never use it. Google's picture can become your Pirumi profile picture, which others on Pirumi can see; you can change, remove or hide it under settings. Twitch's picture is never used for that. We use these details only to run your account (Article 6(1)(b)). The service learns that you use Pirumi each time you sign in with it.
• Sign-in security: if you turn on two-step verification, passkeys or, in our iOS and Android apps, sign-in with Face ID, Touch ID or your device's fingerprint or face unlock, Clerk also keeps what it needs to check them: the secret your authenticator app shares with it and your backup codes; for each passkey a public key, its name (which you can change) and when it was created and last used; and for sign-in in the app a public key tied to that installation of the app, the type of device (such as "iPhone" or "Pixel 8"), which app it belongs to, and when it was added and last used. Your face or fingerprint never leaves your device: your device checks it itself and then signs a one-time challenge, so neither we nor Clerk ever receive biometric data. Two-step verification is required before you apply to become a creator and for creator accounts, because they hold orders, messages and payouts. We use all of this only to keep accounts secure; this is our legitimate interest (Article 6(1)(f)) and part of the security we owe your data (Article 32).
• Creator application data: your bio, motivation and snapshots of the public social accounts you connect for verification, so we can review and approve creators.
• Order and payment data: the request brief, an optional first name to be used in the video, prices, and the payment records and billing country needed to charge you, issue a VAT invoice and pay the creator. Card details are handled entirely by Stripe and never reach our servers. We keep a link to your invoice; it shows your name and billing address because tax law requires it, and only you can open it. For your right of withdrawal, we also record the consent you gave at checkout (its wording and time), when and how we gave you your contract confirmation (by email, or as a file you saved from the order page), and when you first started streaming or downloading the finished video, because consumer law ties the end of that right to these moments. If you withdraw, we also record your statement, the date and time you submitted it, and the name and email address you confirmed in the withdrawal dialog, so we can send you the receipt. To show the tax authority where you live, which decides whether VAT applies, we also keep the country your card or payment account is registered in, as our payment processor Stripe reports it, the country of your billing address, and the country you told us you live in when you ordered (pre-filled from our estimate). We keep only these country codes, never your card number or IP address, for as long as the order's tax records. To show prices with the right VAT, we estimate your country from your IP address or your device's time zone; we do not store the IP address.
• Videos and thumbnails: the video a creator makes for you and its metadata (via Mux), and listing thumbnails (via Cloudflare), so we can deliver and display them. If your order includes a download, Mux also creates and delivers a downloadable copy of the video.
• Captions: every delivered video is transcribed automatically, so it works for people who are deaf or hard of hearing. A written copy of what is spoken in the video therefore sits with our video provider next to the video itself. It is shown only in the player, to the people who can already watch that video.
• Watch progress: the playback position of each video you bought (a single number per video, overwritten as you watch), so you can continue where you stopped on the web and in the apps. Only you can see it; creators never can. It is not used for analytics, and you can delete it at any time under settings, then your data.
• Messages: the chat between a buyer and a creator, so you can discuss an order. If you dictate a message in our mobile apps instead of typing it, your device’s own speech service does the transcribing, and on devices without an offline language pack that means the audio is sent to your phone’s vendor (Apple or Google) rather than to us. We never receive the audio, nothing is recorded or stored, and the text only appears in the message box for you to edit or discard.
• Safety records: the reports you submit, and, if we act on a report, what was reported, what we decided and why, and a note on your account if we restricted, closed, locked or suspended it (see “account restrictions and closures”).
• Payment-security records: if your bank, or for a payment through PayPal, Klarna, Amazon Pay or Revolut Pay that payment provider, disputes one of your payments, the dispute details, the 3D Secure result of that payment if it was a card payment, and our review of it (see “fraud prevention and payment security”).
• Push tokens: if you use our mobile apps and opt in, a device token so we can send you notifications.
• Notifications in your browser: they are off until you turn them on for a device under settings, then notifications; your browser then asks for its own permission. On an iPhone or iPad this works only once you have added pirumi to your Home Screen as a web app. Your browser then sets up a subscription with its push service: an address the push service issues for that browser, and two keys your browser creates so that our notifications are encrypted for it. We keep the address and the keys with your account, together with when you turned notifications on and when you last opened pirumi in that browser. The same notification choices apply as in our apps. A notification carries the same short title and text as there, a link to the page it is about, a short label naming the kind of notification and the request, order or download it is about (so that a newer notification about the same thing replaces the older one), and its language; the title and text never name a buyer, a price or a video length, because they can appear on a locked screen. As for our apps, we keep the title, text and link of each notification in our delivery log for 90 days, together with the order details our apps show with it (such as the price, the requested length and the creator’s username), which are never sent to your browser. The push service cannot read a notification. It sees the subscription address, our server’s internet address, when a notification is sent and how large it is, how urgent we marked it and how long it may keep it, and that it comes from us; if your browser cannot be reached, it keeps the encrypted notification for up to 24 hours (see “who we share data with”). We delete the subscription when you turn notifications off on that device or sign out there (if our server cannot be reached at that moment, it goes once the push service reports it gone, or after 90 days); when you block notifications for pirumi in your browser’s settings, the next time you open pirumi there or, if your browser has already ended the subscription itself, once the push service reports it gone, and at the latest after 90 days; when another account signs in to pirumi in that browser; when the push service reports that it no longer works, its keys cannot be used, or the push service is no longer one we deliver to; after 90 days in which you have not opened pirumi in that browser; when we restrict, close or lock your account; for the browser you opened pirumi in least recently, once you have turned notifications on in more than 10; and when you delete your account. If your session in that browser ends other than by signing out there (for example from another device, or because it expired), notifications keep reaching it until you next open pirumi there or the 90 days run out.
• Small settings and signals: your language, your device's time zone (so the times in our emails show in your local time), your notification choices, whether you have hidden your online status or your profile picture, who you have blocked, whether you are typing or have a chat open right now (the other person sees that as “active now” unless you have hidden your online status), when you last closed each chat (never shown to anyone, kept with that chat and deleted with it), and which app version and device model sent us a push token.

Your email address is needed to open an account. Without it you cannot have one. You also pick a username, which is how other people see you on Pirumi.

To apply to become a creator you have to turn on two-step verification with an authenticator app first, and a creator account has to keep it on. Without it you cannot apply, and a creator account can only be used to set it up.

Your brief is needed to make the video. Without it we cannot take the order. The first name to be spoken in the video is optional; leave it out if you prefer.

Your billing country, and the name and address on your invoice, are required by EU VAT and Cyprus tax law. We cannot invoice you without them.

If you are a creator, our payment processor needs proof of who you are before it can pay you. That is a legal requirement on them. Without it we cannot pay out.

Before you pay, we send your brief and the name you asked to be spoken to an external AI provider (OpenRouter), which passes it to the fastest available hosting provider that offers Zero Data Retention. That host can be in any country, inside or outside the EU: the routing picks the fastest eligible one, so we cannot fix the country in advance. The contents of the request and response are not retained after processing or used for training; technical request metadata may be retained. The provider checks the text against our content rules and against what the creator you chose said they will do, and sends back a yes or no.

We do this to keep the platform lawful and safe, which is our legitimate interest under Article 6(1)(f). The check is automatic. If it says no, we stop that one checkout: nothing is charged, your account is not affected, it is not a sanction, and you can reword the brief and try again. If you think it got it wrong, write to support@pirumi.cy. The check is not always on: if the system that normally runs it cannot be reached, a second one checks the request instead, also through OpenRouter and also on a host with Zero Data Retention. If that one cannot be reached either, the request goes through unchecked. And the check is never the final word on an order: paying at checkout only places a hold on your card, and your money is only taken after the creator has personally read your brief and accepted it.

If a request is stopped, we keep the text, the name and the reason for 90 days so we can spot repeat problems, and then we delete it. We do not use this record to score or rank your account.

We use the same AI provider once more after your video has been delivered: the brief (this time without the spoken name) is sent again so the AI can turn it into a short title for your own library, which makes long requests easier to find later. The title is shown only to you, rests on the same legitimate interest (Article 6(1)(f)), and is deleted together with your brief when you delete your account.

And once after you have paid, if you wrote your brief in a language the creator has not listed: the brief (again without the spoken name) goes to the same AI provider to be translated into the creator’s language, so they can understand what you asked for. Which language your brief is in is noted by the check before checkout and kept with your order for this purpose only. The creator sees the translation marked as automatic, with your original one tap away; you keep seeing your own words. It rests on the same legitimate interest (Article 6(1)(f)) and is deleted together with your brief when you delete your account.

If you pay by entering your card details, Stripe may ask your bank to confirm the payment with 3D Secure. Your bank runs that check. We never see your banking login, the code you enter or the device information your bank uses for it. Stripe tells us only the result (authenticated, attempted, or not used), and we store it only if the payment is later disputed. If you pay with Apple Pay or Google Pay, you normally confirm the payment on your device, and your device and wallet provider handle that step; we learn nothing about it. For some cards saved in a Google account your bank may still ask for 3D Secure, and then the same applies as for a card you entered directly. If you pay with PayPal, you sign in to PayPal and approve the payment there; we do not request 3D Secure for it, and PayPal processes your data as its own controller under its own privacy statement. If you pay with Link, Klarna, Amazon Pay, Revolut Pay or MobilePay, you sign in to that service or approve the payment in its app; we do not request 3D Secure for these either, though your bank may still ask for it for a card you pay with through them, and we do not receive that result. Each of these services processes your data as its own controller under its own privacy notice (see “who we share data with”). Stripe also uses payment data for its own fraud prevention, as its own controller under its own privacy policy.

If your bank, or for a payment through PayPal, Klarna, Amazon Pay or Revolut Pay that payment provider, opens a formal dispute about one of your payments, Stripe tells us, and we pause new purchases on your account until the dispute is closed and a person has reviewed it. For that review we keep a record of: the reason for the dispute and, for a card payment, the card network’s reason code and the 3D Secure result, its status and outcome, when you first started streaming or downloading the video and whether that was before the dispute, whether you had withdrawn from the order or reported a problem with it, and the reviewer’s decision, its reason and who made it. If we consider ending the business relationship, we also keep the notice we sent you, the deadline for your reply and a note of your reply. The dispute details come from Stripe and your card issuer or payment provider; everything else is data we already hold about the order.

We do this to prevent payment fraud and to establish, exercise or defend our legal claims, which is our legitimate interest under Article 6(1)(f); the GDPR itself names fraud prevention as a legitimate interest (recital 47). We use only what that needs. We do not show the record to creators, we do not share it with other companies, and we do not put you on any shared blocklist. Evidence for the dispute itself goes to Stripe and, depending on how you paid, the card networks and your bank, or your payment provider, as described under “how long we keep data”. Your bank decides a dispute you open with your bank; PayPal, Klarna, Amazon Pay and Revolut decide a dispute you open with them.

The pause is an automated decision: our system applies it on its own as soon as your bank or payment provider opens a formal dispute, before a person has looked at it. We do not think it has a legal effect on you or affects you in a similarly significant way, which is what Article 22 is about. It starts on one objective event and does not evaluate you as a person, it only stops new purchases while the payment is in question, it ends once a person has reviewed the closed case, and your account, your conversations and the videos you already have stay as they are. Even so, you can ask at any time for a person to look at the pause, give your side and have it lifted if it is wrong: write to support@pirumi.cy.

Our system also puts the facts together and may suggest an assessment, based on the reason your bank or payment provider gave and on whether the video had been started before the dispute. That suggestion is only advice and never decides the outcome. Whether a dispute was a misuse of payment dispute rights and a breach of our terms, and whether we end the business relationship, is decided by a person who looks at all the facts, can decide either way, and first gives you the chance to respond. That decision is not made by automated means.

The records of a pause and its review, and the 3D Secure result of the disputed payment, are deleted together with the dispute records for that order, normally 18 months after the order, and kept longer only while a dispute on the order is open or closed less than 30 days ago. If we end the business relationship, we keep the record for as long as the restriction applies, and at most for three years after the decision; then the restriction ends and we delete the record. If we lift it earlier, we delete the record once the normal dispute period for that order has ended. If you delete your account, we delete all of these records at once, unless a dispute on one of your orders is open or closed less than 30 days ago; then we delete them once that is no longer so. The one exception: if we had ended the business relationship, we keep a coded form of your email address (a keyed cryptographic code from which the address cannot be read back), the kind of measure and its end date, until the measure would have ended and at most three years after our decision. We use it only to recognise a new account opened with the same address before then. The measure then applies to the new account until that same end, we tell you at once, and a person checks the match within 7 days. If we lift the measure after your account is gone, tell us the address and we delete its coded form at once. We never share it. You can object to this processing (see “your right to object”); because it protects against fraud and may be needed for legal claims, we may continue where our grounds override yours, and we will tell you why.

If we restrict or close your account under our terms (“suspension and termination”), or lock it because we believe someone else has taken it over, we record on your account that it is restricted, closed or locked, since when, why, and for a restriction the date by which we will review it or our notice that we intend to close the account. Our moderation log records what we decided, when, who decided and the reason. If we first told you what we intended, we also keep that notice, the deadline for your reply and a note of your reply. A person makes every one of these decisions; none of them is made solely by automated means.

When we restrict or close an account, a buyer account or a creator account, we end all of its active sign-in sessions once, through our sign-in provider Clerk, so that every device that was still signed in, including a shared one, is signed out; you can then sign in again. A closed creator account signs in with the access of a buyer only (see “after your creator account ends” in our terms). When we lock an account, sign-in at Clerk stays blocked until the account is secured. We also switch off push notifications to your devices and browsers and clear the cached messages and conversations from your device, because you can no longer use them. Emails about your orders still reach you.

While your account is restricted or closed, we keep processing what you need to use the videos you bought: your orders, playback and downloads, your watch progress, withdrawal, reports about your own orders and your data download. That rests on our contract with you (Article 6(1)(b)). The restriction itself and its record rest on our legitimate interest in keeping the platform and the people on it safe and in establishing, exercising or defending legal claims (Article 6(1)(f)); where the restriction is a decision about illegal content or content that breaks our terms, the Digital Services Act also requires us to send you a statement of reasons and keep a record of it (Article 6(1)(c)). We do not tell creators why an account is restricted, and we do not share the record with other companies.

The note on your account is removed when we lift the restriction, closure or lock. The record of the decision in our moderation log is kept like our other moderation records (see “how long we keep data”). You can object to this processing (see “your right to object”).

If we closed your account and you delete it, the same applies as for an ended business relationship: we keep only a coded form of your email address, for at most three years after our decision, to recognise a new account opened with it. The closure then applies to the new account until the same end, we tell you at once, and a person checks the match within 7 days; if nobody has, the closure of the new account ends. We lift it at once if the match was a mistake.

We rely on the following legal bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)): running your account, processing orders and payments, delivering videos with their captions, and enabling buyer↔creator messaging.
• Legal obligation (Art. 6(1)(c)): verifying creator identity for payouts (KYC/AML via Stripe), keeping tax and accounting records, handling illegal-content reports as EU law requires, the yearly tax report about creators described below, and keeping the records that show how your right of withdrawal applied to an order (your consent, the contract confirmation, your first stream or download, and any withdrawal and its receipt), because Cyprus consumer law puts the burden of proving that information and those steps on us.
• Legitimate interests (Art. 6(1)(f)): keeping the platform secure, preventing fraud and misuse of payment disputes (including pausing purchases while a payment dispute is open and reviewing it), recognising a new account opened to get around a closure or an ended business relationship, checking order briefs before checkout, moderating content and restricting accounts that break our terms, fixing errors and crashes, delivering the website through our hosting provider and protecting it against attacks, making sure video playback works, and keeping a record of which version of our terms you accepted. You can object to any of these; see “your right to object”.
• Consent (Art. 6(1)(a)): analytics (PostHog and Cloudflare Web Analytics) and push notifications, in our apps and in your browser. You can withdraw consent at any time.

Some of what we do rests on our legitimate interests rather than on your consent: error monitoring, website hosting and protection, video playback quality, checking order briefs, moderation, fraud prevention, and keeping a record of which version of our terms you accepted.

You can object to any of it at any time, for reasons connected to your situation (Article 21). Write to privacy@pirumi.cy. We stop unless we can show compelling grounds that override your interests, or we need the data for legal claims.

Hosting. Our website is served by Cloudflare. Like any web host, it receives your IP address, the address of the page you ask for and your browser type with every request, and keeps technical logs of this for a limited period to run the service and to protect it against attacks. We do not use these logs to follow what individual visitors do.

Playback quality (no cookies). When you play a video, Mux (our video provider) measures technical playback quality, for example start-up time, buffering and playback errors, so we can keep streaming working. We have configured this measurement to set no cookies and store nothing on your device, and it does not build a profile of you.

Product analytics (only with your consent). If you opt in, we use PostHog (hosted in the EU) to understand how the site and our mobile apps are used, so we can improve them. It is off by default and loads nothing until you agree; the apps ask you for the same choice once you sign in. If you are signed in when you opt in, we tag your analytics events with your account id, so we can see a journey rather than isolated clicks. We never send PostHog your email address or your name, we do not record your screen or sessions, we do not capture keystrokes, and we strip identifiers from the pages you visit. You can withdraw at any time, via the “cookies” link in the footer or the analytics switch in the app under settings, then privacy, and capture stops immediately. When you delete your account, we ask PostHog to delete your analytics profile and its events as well.

Page statistics (only with your consent). The same choice turns on Cloudflare Web Analytics on the website, which counts page views and measures how fast pages load. It is off by default and loads nothing until you agree. It sets no cookies and stores nothing on your device. Its measurements go to our own server first, where we strip identifiers from the page address (usernames, order and conversation references, and all query parameters) and pass the rest on to Cloudflare without your cookies and without your IP address. What is passed on: the kind of page, the website you came from (only its domain), loading times, and the version of your browser and operating system. It is not linked to your account. If you withdraw, the page reloads without it.

Error monitoring. We use Sentry (with EU data residency) to record technical errors and crashes on our website and in our mobile apps, so we can keep them working. It sets no cookies, does not store your IP address, and we remove personal detail (cookies, headers and identifiers) before a report is sent. Reports from the app also include the device model, the operating system version and a randomly generated identifier for the app installation, which is not linked to your account and is reset when you delete the app. There is no session recording.

We share data only with the service providers that help us run Pirumi. Most act on our instructions under a data-processing agreement; the social platforms you can connect for creator verification, the services you can sign in with (Apple, Google and Twitch), and the payment services you can choose at checkout (Link, PayPal, Klarna, Amazon Pay, Revolut Pay and MobilePay), are independent providers that receive data from you or disclose it to us, and so is the push service your browser uses, which delivers our notifications to it if you turn them on there:

• Clerk: Account sign-in, identity and session management. Holds your email address, your password, what Apple, Google or Twitch sends when you sign in with it, and the public keys and codes behind two-step verification, passkeys and biometric sign-in in our apps, so we never store them ourselves.
  Location: United States · Safeguard: Standard Contractual Clauses
• Stripe: Payments by card and, where offered, Apple Pay, Google Pay, Link, PayPal, Klarna, Amazon Pay, Revolut Pay and MobilePay; 3D Secure authentication of card payments; payment disputes; creator payouts; VAT calculation; invoicing and creator identity verification. Card details are handled entirely by Stripe and never reach our servers. Our contract and data-processing agreement are with Stripe Payments Europe, Limited in Ireland. For identity checks, anti-money-laundering checks and fraud prevention, Stripe decides for itself how it uses the data and is responsible for that as its own controller under its own privacy policy, not as our processor.
  Location: Ireland (Stripe Payments Europe, Limited); other Stripe group companies, including in the United States · Safeguard: Standard Contractual Clauses; PCI-DSS
• Mux: Encodes, stores and streams delivered videos; creates and delivers a downloadable video file when the order includes a download; automatically writes out a text version of everything spoken in a video (the captions the player shows); and measures playback quality without cookies. It receives the video file, the caption text, the order reference and an internal creator reference.
  Location: United States (global content-delivery network) · Safeguard: Standard Contractual Clauses
• OpenRouter: Runs the automatic check on order briefs before checkout, translates a brief for the creator when it is written in a language the creator has not listed, and generates a short library title from the brief after the video is delivered. Listing descriptions are normally translated by Anthropic (see the next entry); only when Anthropic cannot be reached does OpenRouter do that as well. OpenRouter receives the brief text and the name to be spoken (the translation and the title generation receive the brief only), plus the creator’s listing description and its languages and the video length you booked, and passes each request to the fastest available hosting provider that offers Zero Data Retention. The contents of requests and responses are not retained after processing or used for training; technical request metadata may be retained.
  Location: No country is fixed in advance: the routing picks the fastest available host among those that retain nothing, wherever it is, inside or outside the EU · Safeguard: Standard Contractual Clauses in the provider’s data-processing terms; there is no adequacy decision for this transfer
• Anthropic: Translates a listing description when its creator asks for an AI translation. It receives the listing description and the two languages, and nothing about buyers. Anthropic keeps the request and the translation for up to 30 days (up to 2 years if its automated safety systems flag a request) and does not use them to train its models.
  Location: United States · Safeguard: Standard Contractual Clauses
• Convex: Our application database and backend.
  Location: United States · Safeguard: Standard Contractual Clauses
• Cloudflare (storage and images): Stores and delivers listing thumbnails (public storefront images).
  Location: European Union · Safeguard: Stored under Cloudflare’s EU jurisdiction
• Cloudflare (email): Sends our transactional emails (order confirmations, notices, sign-in codes).
  Location: United States · Safeguard: EU-U.S. Data Privacy Framework (adequacy decision)
• Resend (backup email): Sends one of our transactional emails only when Cloudflare cannot send it, or when the recipient’s mail server refuses email from Cloudflare (for example during an outage at Cloudflare, or when a mail provider blocks Cloudflare’s servers). It then receives that email: your email address and the content of the message. Resend keeps the email and its delivery log for 30 days.
  Location: United States; the emails are sent from Ireland · Safeguard: Standard Contractual Clauses
• Cloudflare (website): Hosts and delivers our website. It receives every request to pirumi.cy, with your IP address and the address of the page, to serve the page and keep the service secure. If you opt in to analytics, it also provides our page statistics (Cloudflare Web Analytics).
  Location: The Cloudflare location nearest to you; technical logs also in the United States and the European Union · Safeguard: EU-U.S. Data Privacy Framework (adequacy decision)
• PostHog: Product analytics, only if you opt in.
  Location: European Union (Frankfurt) · Safeguard: Processed in the EU; Standard Contractual Clauses cover any access from the US parent company
• Sentry: Application error and crash monitoring on our website and mobile apps.
  Location: European Union (Frankfurt) · Safeguard: Processed in the EU; Standard Contractual Clauses cover any access from the US parent company
• Google (Firebase Cloud Messaging): Push notifications to our mobile apps (on iOS delivered through Apple’s push service, on Android directly by Google).
  Location: United States · Safeguard: Standard Contractual Clauses
• Your browser’s push service (only if you turn on notifications in your browser): Delivers our notifications to your browser or to pirumi installed as a web app. Your browser decides which service that is, not us: Apple for Safari, Google (Firebase Cloud Messaging) for Chrome and most other browsers built on Chromium, Mozilla for Firefox (on Android, Mozilla passes our notifications on to Google’s Firebase Cloud Messaging, still encrypted), and Microsoft for Edge on Windows. It receives the address it issued for your browser and our notifications, encrypted for your browser so that the service cannot read them. It does see our server’s internet address, when a notification is sent, how large it is, how urgent we marked it and how long it may keep it (we allow 24 hours if your browser cannot be reached), and that it comes from us. These providers run the service for their own browsers and are not our processors.
  Location: Depends on your browser. For users in the EEA, Google Ireland Limited, Apple Distribution International Limited (Ireland), and Microsoft Ireland Operations Limited together with Microsoft Corporation are responsible under their privacy policies; Mozilla Corporation is based in the United States. Each may process data outside the EEA, including in the United States · Safeguard: They act under their own privacy policies, with no contract with us; see “sending data outside the EEA”
• PayPal (only if you pay with PayPal): You sign in to PayPal and approve the payment there; PayPal receives the payment details for your order from Stripe and handles any dispute you open with PayPal. PayPal is an independent provider acting as its own controller, not our processor.
  Location: Luxembourg (PayPal (Europe) S.à r.l. et Cie, S.C.A.); PayPal may process data outside the EEA · Safeguard: PayPal acts under its own privacy statement and its own transfer safeguards
• Link (only if you pay with Link): Link is Stripe’s service for saving payment details: if you sign in to Link, or choose to save your details with Link when you pay us, you pay with details saved there, which you can also use at other shops that offer Link. For Link, Stripe decides for itself how it uses that data and is its own controller, not our processor.
  Location: Ireland (Stripe Technology Company, Limited); Stripe may process Link data outside the EEA, including in the United States and India · Safeguard: Stripe acts under its Link privacy policy and its own transfer safeguards
• Klarna (only if you pay with Klarna): You choose Klarna at checkout and confirm the payment with Klarna. Klarna checks your identity and may assess your creditworthiness to decide which ways to pay it offers you, collects the payment from you and handles any dispute you open with Klarna; it receives the payment details for your order from Stripe. Klarna explains these checks in its own privacy notice. Klarna is an independent provider acting as its own controller, not our processor.
  Location: Sweden (Klarna Bank AB (publ)); in the United Kingdom also Klarna Financial Services UK Limited; Klarna may process data outside the EEA · Safeguard: Klarna acts under its own privacy notice and its own transfer safeguards
• Amazon Pay (only if you pay with Amazon Pay): You sign in to your Amazon account and pay with the payment details stored there; Amazon Pay receives the payment details for your order from Stripe and handles any dispute or A-to-z Guarantee claim you open with Amazon. Amazon Pay is an independent provider acting as its own controller, not our processor.
  Location: Luxembourg (Amazon Payments Europe S.C.A.), which may pass data to Amazon Payments UK Limited as a further controller; Amazon may share data with Amazon.com, Inc. and its subsidiaries and process it outside the EEA · Safeguard: Amazon acts under its own privacy notice and its own transfer safeguards
• Revolut (only if you pay with Revolut Pay): You approve the payment in the Revolut app and pay from your Revolut balance or a linked card; Revolut receives the payment details for your order from Stripe and handles any dispute you open with Revolut. Revolut is an independent provider; for the payment it acts as its own controller under its own privacy notice.
  Location: Lithuania (Revolut Bank UAB); for Revolut customers in the United Kingdom, Revolut Bank UK Ltd or Revolut Ltd; Revolut may process data outside the EEA · Safeguard: Revolut acts under its own privacy notice and its own transfer safeguards
• MobilePay (only if you pay with MobilePay): You approve the payment in the MobilePay app, which passes the details of the card stored there to Stripe for a card payment; a dispute goes through your card issuer. MobilePay is an independent provider acting as its own controller, not our processor.
  Location: Norway (Vipps MobilePay AS); MobilePay may use processors outside the EEA · Safeguard: MobilePay acts under its own privacy notice and its own transfer safeguards
• YouTube / Twitch / TikTok: Optional one-time verification of a creator’s public social account. These are independent providers, not our processors.
  Location: Ireland (Google Ireland Limited, TikTok Technology Limited), possibly China (TikTok); United States (Twitch Interactive, Inc.) · Safeguard: They act under their own privacy policies; for TikTok see “sending data outside the EEA”
• Apple / Google / Twitch (only if you sign in with them): Sign-in with your account there instead of a password or an email code; see “signing in with Apple, Google or Twitch” under “what we collect and why”. These are independent providers, not our processors.
  Location: Ireland (Apple Distribution International Limited, Google Ireland Limited); United States (Twitch Interactive, Inc.) · Safeguard: They act under their own privacy policies

Several of our providers process data in the United States, and the automatic brief check is routed to whichever host is fastest at that moment, so its country is not fixed in advance. For transfers outside the EEA to the providers that act on our instructions, we rely on the European Commission’s Standard Contractual Clauses, which are part of our contract with each of them. The exception is Cloudflare: it is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to give adequate protection, and its contract with us falls back to the Standard Contractual Clauses if that certification ever ends. You can ask us for a copy of the clauses at any time, at privacy@pirumi.cy.

TikTok verification. If, as a creator, you choose to verify your identity using TikTok, we receive a snapshot of your public TikTok profile (handle, display name, avatar, follower count and account id) from TikTok Technology Limited in Ireland, an EEA company. TikTok, as the source of that data, may process it outside the EEA, including in China, under its own privacy policy and safeguards; China has no EU adequacy decision, and local law there can give authorities access to data in ways that differ from the EU. TikTok verification is optional: you can verify with YouTube or Twitch instead. The verification is a one-time read, and we delete the profile snapshot as soon as your application is decided.

Notifications in your browser. If you turn on notifications in your browser, our server sends each notification to the push service your browser uses. We have no contract with these services: your browser chooses the service, and its maker runs it for its own users under its own privacy policy. What reaches the service from us is the subscription address and the notification, encrypted so that only your browser can read it, along with what every delivery reveals: our server’s internet address, the time, the size, how urgent it is and how long it may be kept. Under their privacy policies, Google Ireland Limited is responsible for Google’s services for users in the EEA, Apple Distribution International Limited in Ireland for Apple’s, and Microsoft Ireland Operations Limited together with Microsoft Corporation for Microsoft’s; Mozilla Corporation is based in the United States. Each of them may process data in the United States. Google LLC and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework; Apple says its transfers out of the EEA rely on the Standard Contractual Clauses, and Mozilla says that, where needed, it uses safeguards such as these clauses. Notifications in your browser are optional, and you can turn them off at any time under settings.

The list below says how long we keep each kind of data. One kind needs a few words first: the short record we keep for each order in case a payment is disputed. It says which version of our terms you ordered under, what you bought (length and resolution), and when the video was delivered, approved and requested for playback or download. A playback request shows that the video was requested, not that anyone watched it.

We normally delete this record 18 months after the order, which covers the time the card networks and payment providers normally allow for a dispute. While a dispute on the order is open, or closed less than 30 days ago, we keep it, and we check every 30 days whether it is still needed. If a dispute needs it, we send the necessary part to Stripe and, depending on how you paid, the card networks and your bank, or your payment provider, so we can make or defend our claim. Our legal basis is our legitimate interest (Article 6(1)(f)). We never copy your brief, your messages or your video into dispute evidence automatically, and anything that could reveal sensitive information about you is only sent after a separate check that the law allows it (Article 9).

If you ask us to erase your data, we delete this record for every order that has no dispute open or closed less than 30 days ago. You can still ask for a copy of it and object to its use.

• Chat messages: Deleted after 12 months of conversation inactivity.
• Deleted messages: Basic details (no content) are kept for 90 days, then deleted.
• Requests stopped by the automatic check: Text, name and reason are deleted after 90 days.
• Mobile push device tokens (iOS and Android): Deleted after 90 days without use.
• Browser push subscriptions (the address your browser’s push service issued, the two encryption keys your browser created, and when it was turned on and last seen): Deleted when you turn notifications off on that device or sign out there, when you block them in your browser (the next time you open pirumi there or, if your browser has already ended the subscription itself, once the push service reports it gone, at the latest after 90 days), when another account signs in to pirumi in that browser, when the push service tells us the subscription no longer works, its keys cannot be used or the service is no longer one we deliver to, after 90 days in which you have not opened pirumi in that browser, when we restrict, close or lock your account, for the least recently used one when you have more than 10, and with your account.
• Push notifications we sent you (title, text, link, and the order details our apps show with them, such as the price, the requested length and the creator’s username): Deleted after 90 days.
• Downloadable video files: Removed 30 days after generation (regenerated on demand).
• Videos delivered to a buyer: Kept while the buyer’s account exists and the order is not refunded or charged back; then deleted with their captions and downloadable files, later only while the order is still being completed (an order in progress or awaiting approval when the buyer deletes their account is still delivered and paid out), a payment dispute on the order is open or closed less than 30 days ago, or a report about the video still needs it.
• Video captions: Kept as long as the video they were made from.
• Watch progress (where you stopped in your videos): Kept while you have access to the video; deleted with your account, and deletable at any time under settings, then your data.
• Messages, your orders, listing and earnings figures, and your creator application draft cached on your own device: At most 7 days; cleared when you sign out, and clearable at any time under settings, then your data.
• Home-screen widget summary on your own device, including, for the continue-watching widget, the title, the artist name and a still frame of the videos you played most recently: Kept until a newer one replaces it; cleared when you sign out or clear the app cache.
• Two-step verification secret, backup codes, passkeys and biometric sign-in keys (at Clerk): Passkeys and app keys stop working as soon as you remove them or turn the option off; a key from an app you deleted without turning the option off stays inactive at Clerk. Everything is deleted with your account.
• What Apple, Google or Twitch sent when you signed in with it (at Clerk): Until you remove that connected account under settings, then account, or delete your account; an email address it added, and Google's picture if it became your profile picture, stay until you remove them. Clerk's copy of your Twitch picture is deleted at once. If you disconnect Pirumi in your Twitch settings, we remove the Twitch connection and the email address and name it added; the address stays if it is the only verified one on your account.
• Biometric sign-in key on your own device, with your account id and username, and the note that the app already offered it: The key and username until you turn the option off or delete your account; the note until you delete the app.
• Creator application data: Social-account snapshots are deleted the moment your application is decided; drafts after 7 days of inactivity; the text of a rejected application 30 days after the decision, keeping only the outcome and its date.
• Reports and moderation records: The copy of the reported content is deleted 6 months after we dismiss a report, and 12 months after we act on one, which is how long you have to challenge the decision. Reports about content that may be criminal are held longer, because the evidence may be needed by the authorities. What stays after that is the decision itself: the category, the outcome, its date, and in our moderation log who decided and the reason we recorded. The moderation log entry is deleted 6 years after the decision, the period in which a legal claim about it can normally still be brought, with two exceptions: the entry behind a restriction, closure, lock or removal that is still in force stays for as long as that measure applies, and entries tied to a possibly criminal case (a report in a criminal category, or a decision whose explanation we had to withhold) are deleted only once a person has checked that the authorities no longer need them.
• An account restriction, closure or lock: The note on your account is removed when we lift it; the decision stays in our moderation log like other moderation records.
• Error reports (Sentry): Configured to delete after 90 days.
• AI translations of listing descriptions (at Anthropic): The description sent and the translation returned are deleted by Anthropic within 30 days; up to 2 years if its automated safety systems flag the request.
• Analytics events (PostHog): Deleted, with your analytics profile, when you delete your account or ask us to (PostHog finishes deleting events within days); otherwise kept for the retention period of our PostHog plan, currently 1 year. Capture stops immediately if you withdraw consent.
• Page statistics (Cloudflare Web Analytics, only if you opt in): Cloudflare keeps the complete measurements for 7 days and after that a sample of about a tenth of them; the statistics go back 6 months. They carry no account id and no name.
• Website request logs at our hosting provider: Kept by Cloudflare for a limited period, for operating and protecting the service; we keep no copy of our own.
• Email delivery logs: Kept for a few weeks at our email providers (30 days at Resend, for the emails it sent).
• Copy of an email we send: Kept encrypted until the email is delivered, and at most 24 hours, so it can go out again through our backup provider if the recipient’s mail server refuses Cloudflare. An email delivered at once is not kept.
• Coded email address after a refused delivery: If a recipient’s mail server refused email from Cloudflare, a coded form of the address (not the address itself) is kept for 7 days, so further emails to it go through our backup provider directly.
• Payment, invoice and tax records: As long as Cyprus tax law requires, which is up to 7 years, and up to 10 years for records covered by the EU One Stop Shop VAT scheme once we register for it.
• Purchase pauses, dispute reviews and the 3D Secure result of a disputed payment: Deleted together with the dispute records for the order, normally 18 months after the order, and kept longer only while a dispute on the order is open or closed less than 30 days ago.
• An ended business relationship (purchase restriction): Kept while the restriction applies, and at most 3 years after the decision; then the restriction ends and the record is deleted. If you delete your account, it is deleted then, unless a dispute on one of your orders is open or closed less than 30 days ago; only a coded form of your email address stays (next row).
• Coded email address after an ended business relationship or an account closure, once the account is deleted: Until the measure would have ended, at most 3 years after our decision; deleted at once if we lift the measure.
• Coded sign-in id of a deleted account: 30 days, so that a delayed message from our sign-in provider cannot re-create the account.
• Your withdrawal records (checkout consent, contract confirmation, first stream or download, and any withdrawal you submitted with its receipt): Kept as long as the order record, because we may have to prove them; see “payment, invoice and tax records”.
• Which version of our terms you accepted, and when: Kept with your account and deleted when you delete it; the time of the tick on an order is kept as long as that order’s records, and on an approved creator application it stays with that application’s outcome.
• Account and order data: Scrubbed when you delete your account; “your rights” below explains exactly what stays.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy (Art. 15);
• correct data that is wrong or incomplete (Art. 16);
• have your data erased (Art. 17, “right to be forgotten”);
• restrict or object to certain processing (Art. 18, Art. 21);
• receive your data in a portable, machine-readable format (Art. 20);
• withdraw any consent you have given at any time (Art. 7(3)), without affecting past processing.

On the website you can download a copy of everything we hold about you as one machine-readable file, under settings, then your data: your account and sign-in details, your settings, your requests and orders with amounts, invoices and credit notes, your creator listing, application and payout records, your conversations and messages, the blocks you have set, reports you filed and the category and outcome of closed reports about you, moderation decisions about you, your push devices with their push tokens and, for each browser where you turned notifications on, which push service it uses, the subscription address, its two keys and when notifications were turned on and last seen there, and your watch progress. If you only use the app, sign in on the website with the same account to download it. The file describes each delivered video (status, length, dates) but does not attach the video files themselves: they stay streamable in your library, and a creator can ask us for a file copy of a video they uploaded. For anything the file does not answer, write to privacy@pirumi.cy. You can delete your account from your account settings or by writing to the same address. If your creator account is waiting for two-step verification, the download and the account settings open once it is on; until then, write to the same address for your copy or for deletion. We respond within one month.

Some records are not in the file, for anyone, until a person has checked them: reports about you that are still under review, reports in a criminal-law category (such as child sexual abuse or other illegal content) or whose outcome we may not yet tell you, and our internal moderation notes. Write to privacy@pirumi.cy and we answer within one month. We never tell you who reported you. We hold back part of an answer only where giving it would harm someone else, such as the person who reported, or where the law or an authority requires us to keep a criminal investigation confidential, and we give it once that reason has ended, unless the law forbids it.

When you delete your account, we remove your profile and your username, and we take the content of your briefs and messages out of our systems. Some things stay:

• your account record itself, kept in a form that no longer identifies you on the platform;
• if you are a creator, videos you delivered on completed, paid orders, so the buyer keeps what they bought (if you are a buyer, the videos made for you are deleted; see “how long we keep data”);
• anything a report needs as evidence, including a copy of the reported message or text, kept for as long as the moderation record must be kept;
• basic details of deleted messages, for 90 days;
• if your account was restricted, closed or locked, the record of that decision in our moderation log;
• if a request of yours was ever stopped by our automatic check, the record that it happened, without the text, until it ages out after 90 days;
• if purchases on your account were paused or restricted, that record, but only while a payment dispute on one of your orders is open or closed less than 30 days ago (see “fraud prevention and payment security”);
• if we had closed your account or ended the business relationship, a coded form of your email address, until the measure would have ended (at most 3 years after our decision);
• for 30 days, a coded form of your sign-in id, so that a delayed message from our sign-in provider cannot re-create the account;
• the records of how your right of withdrawal applied to your orders, as long as the order record is kept;
• if your creator application was approved, its outcome, its date and when you ticked the box accepting our terms on it;
• payment and invoice records at our payment processor, which tax law requires us to keep.

We also instruct PostHog to delete your analytics profile and events, and if you are a creator, we remove your sign-in id from your payout account at our payment processor, which keeps the account itself for the tax records.

Sometimes we hold information about someone who is not a Pirumi user, because a user gave it to us.

A buyer can ask for a first name to be spoken in a video. We store that name with the order. It is spoken in the video, and because every video is automatically captioned, it also appears in the written caption text our video provider makes. We hold nothing else about that person.

If someone reports content or a message, we keep a copy of what they reported and what they said about it, so we have a record of why we acted.

We have no way to contact the people this covers, and telling them would mean collecting more data about them than we hold, so we do not write to them. If you think we hold something about you this way, write to privacy@pirumi.cy and we will tell you what we have.

If you earn money as a creator, EU law requires us to report you to the Cyprus Tax Department once a year, and they pass it to the tax authority of the country you live in.

What is reported: your name, your address, your date of birth, your tax identification number and the country that issued it, your VAT number if you have one, the account we pay you into, and how much you were paid and how many videos you delivered in each quarter.

The legal basis is our legal obligation under Article 6(1)(c). We keep these records as long as tax law requires. We send you a copy of what we reported about you by 31 January each year, and we tell you before we report for the first time.

We store a small number of things in your browser and on your device. Always on: sign-in and session cookies (set by Clerk) that keep you logged in, checkout state used by Stripe during payment, your language and theme choices, a short note in the open tab while you switch authenticator apps (so we can tell you if you leave with two-step verification off), and your cookie decision itself. Each of these is needed for something you asked for, so none of them needs your permission.

Your device also keeps a copy of your most recent messages, conversation details and your creator application draft, so those pages open instantly instead of loading. It stays on your device, we never read it, it is kept for at most 7 days, it is deleted when you sign out, and you can clear it at any time under settings, then your data. If your account is restricted or closed, the cached messages and conversations are cleared as well.

Our iOS and Android apps keep a small summary on your device for their home-screen widgets, so a widget can show something without opening the app. It is written whether or not you have added one. For the order widgets that summary is counts, statuses and deadlines, and for creators your own earnings figures. The continue-watching widget needs more to be useful, so it also keeps the title, the artist name, your position and a small still frame of each of the videos you played most recently. All of it stays on your device, we never read it, it is deleted when you sign out, clearing the app cache in settings removes it, and deleting your watch progress removes the continue-watching part on its own.

If you turn on sign-in with Face ID, Touch ID or your fingerprint in our iOS or Android app, the app keeps a private key for it in your device's secure storage, together with your account id and your username, so the sign-in button can show whose account it opens. The key never leaves your device, and all of it is deleted when you turn the option off or delete your account. The apps also note on your device which accounts they have already offered this option to, so they ask only once.

If you install pirumi as a web app, or turn on notifications in your browser, your browser also keeps a service worker for pirumi: a small script of ours that your browser uses for our notifications. In the installed web app it also shows pirumi’s own “you’re offline” screen instead of a browser error, and for that screen only the installed app stores in your browser’s cache two short texts in your language, the current theme colours and a few font files, and refreshes them each time you open it. A browser where only notifications are on keeps just the service worker and the subscription described under “what we collect and why”, and nothing in that cache. The service worker and its cache hold nothing about your account and no messages, never store the pages you visit, and nothing in them is sent to us. While notifications are on, each time you open pirumi our page reads the subscription from your browser and sends it to our server, so that we always hold the current one and know which account it belongs to. In a browser where pirumi is not installed, turning notifications off or signing out removes the service worker. In the installed app, the service worker and the cache stay, also after you sign out. On a computer or an Android device, the installed app shares its storage with the browser profile you installed it from, so while the cache exists the offline screen can also appear in a normal tab of that browser. If you have not opened the installed app for 30 days, the next time you open pirumi in a normal tab of that browser deletes the cache and, unless notifications are on there, removes the service worker. Clearing the site’s data removes both at any time, and some browsers do that when you uninstall the web app. All of this serves only what you asked for, installing the app or turning on notifications, so we do not ask for separate permission. Installed as a web app, pirumi also shows the number of your unread messages on its icon. Our server counts them and sends the number only to the installed app, which asks for it and keeps it up to date; a normal browser tab never sets the badge. The badge is cleared when you sign out; on an iPhone or iPad it appears only if you allow notifications.

Only if you opt in: analytics storage in your browser (PostHog's own, and a note of which one-off events, such as a completed checkout, were already counted), removed if you withdraw consent; the notes of one-off events are also removed when you sign out. You can change your choice at any time via the “cookies” link in the footer. Cloudflare Web Analytics (only if you opt in) and our playback-quality measurement (Mux Data) set no cookies and store nothing on your device.

Chat messages and briefs could contain sensitive personal data (for example about health or beliefs). Please share sensitive information only where it is needed for your order.

Pirumi is only for people aged 18 or over. We do not knowingly process the data of anyone younger.

Data is encrypted in transit (TLS) and at rest. Videos are served through short-lived signed links, so only the buyer, the creator and our moderators can view them. If a data breach is likely to put your rights at risk, we will notify the Cyprus supervisory authority and inform you where required.

If you think we have mishandled your data, please contact us first at privacy@pirumi.cy. You can also complain to a data protection authority, in particular in the EU country where you live, where you work, or where you think the problem happened. In Cyprus that is:

Office of the Commissioner for Personal Data Protection
15 Kypranoros Street, 1061 Nicosia, Cyprus
+357 22 818 456 · commissioner@dataprotection.gov.cy
dataprotection.gov.cy

The date at the top shows when the version you are reading took effect.