Privacy Policy

This explains what we do with personal data when you use Spoolt. For the GDPR and Türkiye's KVKK, the operator named above is the data controller.

Spoolt is operated by Orhan Ege Bilge, a sole proprietor (şahıs şirketi) based in Antalya, Türkiye. In these pages “Spoolt”, “we” and “us” mean that operator, and “you” means the person or business using the service.

What we collect

Account details you give us — your name, email and password (stored hashed), or the details Google shares if you sign in that way. Brand material — the websites, product pages and descriptions you add, and what we extract from them. Content — the scripts, videos and captions you generate, keep or discard. Connections — which social accounts you've linked and what those platforms report back about your posts. Billing — your plan and subscription status; card details go to our payment provider, never to us. Technical data — IP address, browser and device information, and error reports when something breaks.

Why we use it, and on what basis

To provide the service you signed up for — learning your brand, generating and rendering video, publishing on your behalf and showing your analytics (performance of a contract). To run the business — billing, support, fraud and abuse prevention, security and keeping the service reliable (our legitimate interest, and legal obligation for tax records). To send you service email such as password resets and important notices (performance of a contract). We don't sell your personal data, and we don't use it to train our own AI models.

Who we share it with

We pass on only what a provider needs to do its job. Our processors are:

• OpenAI — brand analysis, script generation, voiceover and transcription
• HeyGen — AI avatar video rendering, when you choose an avatar format
• Upload-Post — the connection to TikTok, Instagram and YouTube, and post metrics
• Lemon Squeezy — payments, invoicing and subscription management, as merchant of record
• Cloudflare — DNS, content delivery and storage of rendered video (R2)
• Hetzner Online — the servers that run Spoolt, in Helsinki, Finland
• Sentry — error reports, so we can find and fix faults
• Proton — sending service email
• Google — sign-in, if you choose it

We'll also disclose data where the law requires it, or to establish or defend a legal claim. If the business is ever sold or transferred, data moves with it and we'll tell you first.

Where your data is

Spoolt runs on servers in Finland, inside the EU. Some processors listed above operate outside the EU or Türkiye, including in the United States; where that's the case, transfers rely on the European Commission's standard contractual clauses or an equivalent safeguard offered by that provider.

How long we keep it

Account, brand and content data is kept while your account is open. Delete your account and we remove it, along with your brands, content and social connections; backups age out within 30 days. Raw analytics events and finished generation jobs are pruned after 90 days. Billing records are kept as long as tax law requires, which in Türkiye is ten years.

Your rights

Under the GDPR and the KVKK you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything inaccurate
• delete your data — you can do this yourself from Settings
• restrict or object to a use of it, including any based on legitimate interest
• send your data to another provider in a portable form
• withdraw consent where processing rests on it

Write to [email protected] and we'll answer within 30 days. If you're unhappy with the outcome, you can complain to your local data protection authority — in Türkiye that's the KVKK Authority (KVKK Kurumu), and in the EU the supervisory authority where you live.

Security

Traffic runs over HTTPS, passwords are stored hashed and never in plain text, API credentials for the services we use are held server-side, and access to production is limited. No system is perfectly secure; if a breach affects your personal data we'll notify you and the relevant authority as the law requires.

Cookies

We use cookies only to make the service work: to keep you signed in, to remember your language, and — where enabled — for the bot check on the signup form. We don't run advertising or cross-site tracking cookies, so there's no consent banner to click through.

Children

Spoolt isn't for anyone under 18 and we don't knowingly collect their data. If you believe a child has an account, tell us and we'll remove it.

Contact

Questions about your data, or a request about your rights: [email protected]. For anything else legal: [email protected].

Changes to this policy

We'll update this page when what we do with data changes, and the date at the top always shows the current version. For material changes we'll tell you by email or in the app before they take effect.