Privacy Policy

1. Introduction

This is the Privacy Policy of Korpi AI, a product of Korpi AI Inc., with its registered address at 130 King Street West, Suite 1900, Toronto, Ontario, M5X1E3, Canada. Korpi AI provides an AI-powered video creation platform (the "Services").

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Services. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. Where the law requires your consent, for example for non-essential cookies in the European Economic Area, we ask for it separately and you can withdraw it at any time.

Your use of the Services is also subject to our Terms of Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect and store the following:

• Email address
• Username and display name
• Profile image
• Authentication credentials
• Account creation and last login dates

2.2 Subscription and Payment Data

When you purchase a subscription, your payment information (card type, last 4 digits, expiry date, billing name, and address) is collected and processed by our third-party payment processors (Stripe and/or PayPal). We do not directly store your full payment card information. Payment data is handled in accordance with the respective processor's privacy policies.

2.3 Usage Data

We automatically collect information about how you use the Services, including:

• Subscription tier and status
• AI video generation history and usage counts
• Credit balances and consumption
• Feature interactions and service timestamps
• Session recordings of how you navigate and click, with typed input masked, only if you explicitly allow analytics in your privacy choices

2.4 Technical Data

For service functionality, security, and troubleshooting, we may collect:

• IP address and approximate geolocation
• Browser type and version
• Device type and operating system
• Referring URLs and page interactions

2.5 User-Generated Content

When you use the Services to create videos, we process the content you provide or generate, including scripts, images, audio, and rendered video files. This content is stored on our servers to deliver the Services to you.

2.6 YouTube API Services Data

If you choose to connect a YouTube account, Korpi AI uses YouTube API Services to connect your channel and publish videos that you authorize. We may access, collect, store, or otherwise use the following YouTube-related information:

• YouTube channel ID, channel title, and basic channel details
• OAuth access tokens and refresh tokens for authorized uploads
• Video title, description, privacy status, audience setting, and other upload metadata you provide
• Upload status, upload errors, quota status, YouTube video ID, and the final video URL

Korpi AI does not use YouTube API Services to collect YouTube analytics, subscriber lists, comments, playlists, or private videos.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services
• Process transactions and manage your subscription
• Track usage and allocate resources appropriately
• Improve, personalize, and develop new features for the Services
• Ensure the security and integrity of your account
• Connect user-authorized YouTube channels and upload videos only when you request or schedule publishing
• Communicate with you about service updates, support, and promotional offers
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service

We do not sell YouTube API Data, use YouTube API Data for advertising, or use YouTube API Data to build profiles unrelated to the YouTube publishing features you choose to use.

4. How We Share Your Information

We do not sell your personal information to third parties. We may share your information in the following circumstances:

4.1 Service Providers

We work with third-party companies that help us operate and improve the Services, including hosting and infrastructure providers, payment processors, analytics services, AI service providers (for voiceover, image generation, and language models), and customer support tools. These providers only access your data as necessary to perform their functions and are contractually obligated to protect it.

4.2 Legal Requirements

We may disclose your information if required to do so by law, or in good faith belief that such action is necessary to comply with a legal obligation, protect and defend our rights or property, prevent fraud, or protect the personal safety of users or the public.

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

4.5 YouTube and Google

When you connect YouTube, information is shared with Google and YouTube as necessary to authenticate your account, verify your channel, and upload videos through YouTube API Services. Your use of YouTube features is also subject to the Google Privacy Policy.

5. Cookies and Tracking Technologies

We use cookies and similar technologies (such as web beacons and local storage) to operate the Services, remember your preferences, understand how you interact with the platform, and improve your experience.

Types of cookies we use:

• Essential cookies: Required for core functionality such as authentication and security
• Analytics cookies: Help us understand how users interact with the Services so we can improve them
• Preference cookies: Remember your settings and choices across sessions

In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies stay off until you accept them. In other regions they are on by default and you can turn them off. We honor the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising. The full list is in our Cookie Policy, and you can change your choice at any time: Your privacy choices.

You can also control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Services.

Some third parties, including Google, YouTube, analytics providers, payment processors, authentication providers, and advertising or measurement partners, may serve content or store, access, or collect information on or from your device through cookies, local storage, pixels, SDKs, or similar technologies when those integrations are used.

6. YouTube API Services, Retention, and Revocation

YouTube features are optional. When you connect a YouTube account, Korpi AI uses YouTube API Services only to authenticate the channel you selected, prepare authorized uploads, upload videos you choose to publish, and support scheduled publishing if you enable it.

For one-time manual publishing, YouTube OAuth data kept in your browser is short lived and expires in less than one day, or sooner if you disconnect. For scheduled publishing and automation, OAuth tokens and channel identifiers are stored for as long as the scheduled task or campaign remains enabled, or until you disconnect YouTube, delete the task or campaign, revoke access, delete your account, or ask us to delete the data. Access tokens may be refreshed when needed to perform an upload that you configured.

You can disconnect YouTube inside Korpi AI where a YouTube account is shown as connected. You can also revoke Korpi AI's access from Google at Google's security settings page. To request deletion of stored YouTube API Data or any related account data, contact us at contact@korpi.ai.

7. Data Retention

We retain your personal information for as long as you maintain an active account with us, or as needed to provide you with the Services, subject to the automatic retention periods below. When you delete your account, we will delete or anonymize your personal information within a reasonable timeframe, unless retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing our agreements).

Project records are automatically deleted 90 days after their most recent update. Failed or cancelled media-generation jobs are automatically deleted after 90 days, and generation-attempt logs used for service reliability and troubleshooting are automatically deleted after 60 days.

Deletion of these records is permanent, and related project content may no longer be accessible through the Services. You should download any project content you want to keep before its retention period ends.

We may retain anonymized or aggregated data that cannot be used to identify you for analytical and product improvement purposes.

8. Data Security

We implement industry-standard technical, organizational, and administrative security measures to protect your personal information from unauthorized access, use, alteration, and disclosure. These measures include encryption in transit, secure server infrastructure, and access controls.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security. You are responsible for maintaining the security of your account credentials.

9. Children's Privacy

The Services are not directed at children under the age of 16. We do not knowingly collect or solicit personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete such information promptly. If you believe that a child under 16 may have provided us with personal information, please contact us at contact@korpi.ai.

10. Your Rights

Depending on your location, you may have certain rights regarding your personal information. These may include:

To exercise any of these rights, please contact us at contact@korpi.ai. We will respond within the timeframe required by applicable law.

11. Regional Privacy Notices

These notices add to the rest of this policy for people in the regions named. To exercise any right below, email contact@korpi.ai from your account email, or use Your privacy choices for cookies and advertising. We may need to verify your identity before acting, and we will not treat you differently for exercising your rights.

11.1 European Economic Area, United Kingdom and Switzerland

Korpi AI Inc. is the controller of your personal data under the EU and UK General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection. We rely on these legal bases:

• Contract: creating your account, generating and storing your videos, billing and support.
• Legitimate interests: security, fraud and abuse prevention, service reliability, and emails about your account. You can object at any time.
• Consent: analytics and advertising cookies, marketing emails, and optional features such as voice cloning and YouTube publishing.
• Legal obligation: tax, accounting and responding to lawful requests.

You have the rights listed in section 10, including the rights to object, to restrict processing and to data portability. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. You may lodge a complaint with the data protection authority where you live or work, such as your EU supervisory authority, the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner.

11.2 United States

This notice applies to residents of California and of other states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia.

In the last 12 months we collected these categories of personal information, from you, your device and our payment and sign-in providers: identifiers (name, email, IP address, account and device IDs); commercial information (plans, purchases, credits); internet activity (pages viewed, features used, errors); approximate geolocation from your IP address; audio and visual information you upload or generate, including voice samples you choose to clone; and inferences about product preferences. We use them for the purposes in section 3 and disclose them to the service providers in section 4.

We do not sell personal information for money. Our use of advertising and affiliate cookies, such as the TikTok Pixel and Google Analytics, may count as "selling" or "sharing" for cross-context behavioral advertising or "targeted advertising" under these laws. You can opt out with Your privacy choices or by enabling the Global Privacy Control in your browser. We do not knowingly sell or share the personal information of consumers under 16, and we do not use sensitive personal information to infer characteristics about you. We do not use voice samples to identify you.

You may ask to know, access, correct, delete or port your personal information, and to opt out of sale, sharing, targeted advertising and profiling. An authorized agent may make a request for you with your signed permission. If we decline a request, you may appeal by replying to our decision with the subject "Privacy appeal"; we answer appeals within the time your state law requires, and if you disagree you may contact your state Attorney General. We keep each category of personal information for the periods described in section 7.

11.3 Canada

We handle personal information under the Personal Information Protection and Electronic Documents Act and, for Quebec residents, the Act respecting the protection of personal information in the private sector. Our Privacy Officer is responsible for compliance and can be reached at contact@korpi.ai. You may access and correct your information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

11.4 Brazil

Under the Lei Geral de Proteção de Dados (LGPD) you may confirm and access processing, correct, anonymize, block or delete data, port it, learn who we share it with, and withdraw consent. Our data protection contact (encarregado) is reachable at contact@korpi.ai. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

11.5 Other regions

If you live in Australia, India, Japan, Singapore, South Africa, South Korea, Turkey or another country with a data protection law, you have the access, correction, deletion and complaint rights that law provides. Our contact for grievances and data protection requests is contact@korpi.ai, and you may also complain to your local data protection authority.

12. International Data Transfers

Your personal information may be processed and stored on servers located outside your country of residence, in countries that may have different data protection laws than your jurisdiction.

Korpi AI Inc. is based in Canada, which the European Commission and the United Kingdom recognize as providing adequate protection for commercial data. Our service providers process data in the United States and other countries. For transfers out of the EEA, the UK and Switzerland we rely on adequacy decisions, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, or standard contractual clauses. You may request a copy of the relevant safeguards by contacting us.

13. Third-Party Websites and Services

The Services may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you access through or in connection with our Services.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by posting the revised policy on our website, updating the "Effective date" at the top of this page, or by other reasonable means such as email.

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: