Privacy policy

Our commitments

We do not sell, rent or trade your personal data or your content, and we do not share them with advertisers or data brokers. We do not use your prompts, references or outputs to train models, for advertising or for marketing.

Your creations are private to you, and to your workspace if you share one, until you publish them. We keep logs of non-private prompts and creations to operate and protect the service, and use them for nothing else: operating alerts, abuse and fraud investigations, the review of what you submit for publishing, the support requests you send us, and our legal obligations. Private mode keeps a render out of our storage entirely, as described below.

What we store

• Account and workspace data — email, hashed credentials (via our auth provider), workspace names and members, credit balances, notification and email preferences.
• API keys — a SHA-256 hash and a display prefix. Never the key itself.
• The usage ledger — one row per charged generation: timestamp, model id, credit amount, request size, and the prompt you typed (the image or video prompt, the text read aloud, or the last message of a chat turn — capped at 2,000 characters). A Private-mode render keeps its ledger row with the prompt replaced by stars. We keep it to resolve billing disputes, investigate abuse reports and understand how the product is used. Storage uploads and refunds carry no prompt.
• Your library — every image, clip and voice line you generate, from the Studio or through the API, is saved to your private library with its prompt and settings so you can find it again, remix it or publish it. Delete a creation and its file and record go with it.
• Your references — photos you attach to a character or element sit in your private Store until you remove them; removing one deletes the file.
• What you publish — publishing is opt-in, and every submission is reviewed by our team before it goes public. A published creation, with its title, cover and your public handle, stays public until you unpublish it. Likes, views and comments on it are kept with it.
• Top-up and subscription records — pack or plan, amount, the card processor's payment and subscription ids (Stripe or Mollie), or for a crypto payment the NOWPayments invoice and payment ids and the coin used.
• Support messages — what you send us through the support form.
• Emails we sent you — which email and when, so that none is sent twice and none arrives too often.
• Where your account was created — the IP address and country of your first request after signing up, kept on the account and never updated afterwards. We use it to spot several accounts opened from one connection to farm the free credits. We do not log the IP of your other requests.

Connected accounts: TikTok, YouTube and Instagram

In Plugins & connectors you can link a TikTok account, a YouTube channel or an Instagram professional account to your workspace, then post clips from your library to it. Linking is optional, happens on the platform's own consent screen, and can be undone at any time. We never post anything without your click on Post, and an account is only ever used for what you see in the post sheet.

What we read from the platform, and why

• TikTok (Login Kit and Content Posting API — permissions user.info.basic, video.upload, video.publish): your account's id, username, display name and avatar, and, each time you open the post sheet, the options TikTok gives your account (who can view, whether comments, duets and stitches are allowed, the longest clip you can post), so the sheet shows who you post as and offers only what your account allows. video.upload sends a clip to your TikTok drafts, video.publish posts it to your profile, and we then read the post's status to tell you when it is live.
• YouTube (YouTube API Services — scopes youtube.upload and youtube.readonly): your channel's id, title, handle and thumbnail, to show which channel a Short goes to, and the processing status of the videos you upload through eroq. youtube.upload uploads the clip you chose, with the title, description, visibility and « made for kids » answer you set.
• Instagram (Instagram API with Instagram Login — permissions instagram_business_basic and instagram_business_content_publish): your account's id, username, name, profile picture and account type, to show which account a Reel goes to, then the Reel's status and link once it is published.

We never read your other videos, your followers, your messages, your comments or your analytics, and we never change what you typed: the platform receives your caption, title and settings as you left them (a caption longer than a platform allows is cut to its limit, as the post sheet shows). Each post carries the platform's AI-generated label.

What we store

• For each linked account — the platform's id for it, its handle, display name and avatar link, the permissions you granted, and its access and refresh tokens, encrypted at rest and never shown to anyone, your workspace's admins included. Members of the workspace see which accounts are linked and by whom.
• For each post — the clip from your library, your caption and title, the settings you chose, the two boxes you ticked and when, the outcome of the check below, and, for 30 days, the platform's id and link for the post and the account's handle.

Before a post leaves, three frames of the clip (and its cover, if it has one) are read by an automated check run by our AI model providers, to make sure it suits a general audience. The frames are not stored, only the verdict.

What we send and share

The platform you post to receives the video file you chose and the caption, title and settings you set — nothing else. Information received from these platforms is used only to link your account and post what you ask; it is never sold, never used for advertising, profiling or model training, and never transferred to anyone else. Each platform then handles your post under its own terms and privacy policy: TikTok, Google, Instagram.

YouTube API Services

eroq uses YouTube API Services to upload your clips to your YouTube channel. By linking a channel you agree to be bound by the YouTube Terms of Service. How Google handles your data is described in the Google Privacy Policy. You can revoke eroq's access to your Google account at any time from the Google security settings page. eroq's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it, and how to delete it

• Unlink an account in Plugins & connectors, or delete your eroq account: we ask the platform to revoke eroq's access and delete the account's tokens and profile at once, along with the platform's ids, links and handle in your post history.
• Remove eroq's access on the platform instead — from TikTok's security settings, Google's security settings page or Instagram's apps and websites. We check every linked account about once a day; once a link stops working, everything we hold for it is deleted within 7 days of the first failed check, and in any case within 30 days of your revocation.
• While a link works, what we hold from the platform is read again about once a day, so it is never older than that; a post's platform id, link and handle are deleted 30 days after the post. The post stays in your history with its caption, platform and date.
• Posts you published stay on the platform until you delete them there; unlinking does not remove them.
• Data deletion request: write to hello@eroq.ai from your account's email, and we delete your linked-account data within 7 days.

Private mode

With Private mode on in the Studio (or private: true on the API), the render is handed straight back to you and nothing of it is written to our storage: no file, no library entry, no prompt on the job. Reference pictures travel inline with the request and never join the Store. The ledger row that bills the render carries stars instead of your prompt. Models marked « Private mode ✓ » retain nothing upstream either; the others may retain the prompt under their own terms, as the model picker says.

Videos are the one exception. A clip is far too large to hand back inline, so it transits object storage under a temporary, signed link while you download it and is deleted 30 minutes after upload — it never joins your library, and after that window the link is dead. Images, voice lines and text never touch storage at all.

What we do not store

The model's replies in chat are streamed to you and not written to our database, and we keep no chat history: a charged chat turn leaves only its last user message in the ledger. Audio you send for transcription is processed in memory and not retained. We never see your card number.

Processors

Generations are fulfilled by vetted infrastructure and AI model providers acting as processors on our behalf, and our database and sign-in run on Supabase. Providers receive only what a request needs — the prompt and any reference media (for a video: your cast's look sheets and, when sound is on, a cast member's voice sample) — and our own engines keep nothing once the job returns. Models without the « Private mode ✓ » badge — Flash Image, Flux Image, the image models from other labs (GPT Image 2.5, Nano Banana, Seedream 5.0 Pro, Flux 3 Image and Grok Imagine 2.0) and the video engines from other labs (Seedance, Veo, Kling, Hailuo, Wan, Runway, Grok Imagine) — may retain prompts and reference media under their upstream provider's terms. Payments, email delivery, file storage and product analytics are handled by dedicated processors, and our team receives operational alerts, which include non-private prompts, on internal tools.

Emails

Account emails — sign-in links, password resets, receipts — go out whenever they are needed. Balance alerts and onboarding tips each have a switch in Settings → Notifications. We also send account holders occasional offers about eroq: a discount while it is live, bonus credits when a balance runs out, a reminder of a checkout left open. They rest on our legitimate interest in promoting our own service to our customers (article L34-5 of the French Postal and Electronic Communications Code); every one carries a one-click unsubscribe link, and the same switch lives in Settings → Notifications. Stopping them changes nothing else about your account.

Cookies and analytics

Signed-in pages use first-party session cookies for authentication, plus a cookie for your theme and pinned tools. Linking a TikTok, YouTube or Instagram account sets a first-party cookie for ten minutes, which ties the platform's answer to your session; it is deleted when you come back. We run first-party product analytics (PostHog) to count page views, sign-ups and generations by medium — no click recording, no advertising networks, no cross-site tracking.

A visit through an affiliate link (?ref=…) sets a first-party cookie that remembers the affiliate's code for 30 days, so an account created or signed in during that time can be attributed to them. Once the account is attributed (or cannot be), the cookie is deleted. The affiliate sees that a referral joined, with a masked email (« mi•••@gmail.com »), the plans it paid for and the commission earned, never who you are. Affiliates' own application and payout details are used only to run the affiliate program and to pay them.

Your rights

You can delete any creation from your library at any time, and the account itself from Settings → Danger zone: the account row, its keys, its library, its stored files, its ledger and its linked social accounts (their access revoked on each platform first) are erased on the spot. Payment records stay with our payment provider for as long as accounting law requires, and a one-way hash of the email is kept so a new account on the same address does not receive the welcome credits twice. Database backups held by our hosting provider roll over within 7 days, after which deleted data is gone from them too. One exception: a media removed for illegal content (child sexual abuse material above all) is preserved in a restricted quarantine, with its prompt, for the authorities, as the law requires — deleting the account does not remove it. Data export, and any question or complaint about your privacy: hello@eroq.ai.