Privacy Policy

Flayr Labs ("Company," "we," "us," or "our") operates ars0n (the "Service") at ars0n.ai, an AI-powered platform for generating video advertisements. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have.

If you have any questions about this policy or our data practices, contact us at support@ars0n.ai.

2.1 Account and Organization Information

When you create an account we collect your email address (which must be verified) and your name if you provide it. We also collect organization/workspace data: your organization name, team membership, invitations, and roles.

2.2 Uploaded Media and Generated Content

We store the product images, links, scripts, and other materials you upload or import, and the videos, audio, and intermediate assets generated from them.

2.3 Usage and Analytics Data

We collect information about how you use the Service: generation history, credit usage, API activity, pages visited, timestamps, browser and device information, and IP address.

2.4 Payment Information

Payments are processed by Stripe. Your card number and billing details go directly to Stripe — we never receive or store your full card number. We keep transaction identifiers, plan details, and billing history.

2.5 Cookie Consent Choices

We record the choices you make in our cookie consent banner so we can honor them (see Section 6).

• Providing the Service: operating your account and organization, processing generation requests, delivering generated content, and managing credits and billing.
• AI processing: sending your uploaded content and instructions to the AI providers listed in Section 5 as part of the generation pipeline.
• Content moderation: automatically screening inputs and outputs for prohibited content, and keeping moderation logs.
• Communications: sending transactional emails such as verification, team invitations, billing notices, and security alerts.
• Improvement and security: analyzing usage, diagnosing issues, preventing abuse and fraud, and keeping the Service reliable.
• Legal compliance: meeting legal obligations and responding to lawful requests.

Where the GDPR or similar laws apply, we process your personal data on these legal bases:

• Contract: processing needed to provide the Service you signed up for — accounts, generation, billing, support.
• Legitimate interests: securing the Service, preventing abuse, moderating content, and improving our product, balanced against your rights.
• Consent: optional analytics and marketing cookies, which are set only if you agree via the consent banner. You can withdraw consent at any time.
• Legal obligation: retaining records where the law requires it.

We share personal data only with service providers that help us run the Service, under contracts that limit their use of the data. We currently use:

• Stripe — payment processing and billing.
• SendGrid (Twilio) — transactional email (verification, invitations, notifications).
• Amazon Web Services — video rendering and asset storage.
• Google Cloud — AI models used in the generation pipeline and automated content moderation.
• ElevenLabs — voice synthesis.
• Hedra — video generation.
• Cloudflare — website import and rendering when you paste a product link.
• Supabase-based infrastructure (self-hosted) — database, authentication, and file storage, operated on our own infrastructure.
• Discord — internal operational alerts to our team, using masked identifiers rather than raw personal data.

We do not sell, rent, or trade your personal information. We may disclose information if required by law, court order, or governmental authority, or to protect our rights, property, or the safety of our users.

• Essential cookies: required for the Service to function — authentication sessions, organization context, and security tokens. These cannot be disabled.
• Analytics cookies (optional): help us understand how the Service is used. Set only with your consent.
• Marketing cookies (optional): measure advertising effectiveness. Set only with your consent.

You can accept or decline optional cookies through the consent banner and change your choice at any time. Disabling essential cookies via your browser may prevent the Service from working.

• Account data: retained while your account exists. If you request deletion, we delete your personal data except where retention is required by law (for example, billing records).
• Uploaded media and generated content: retained until you delete it or delete your account.
• Moderation and audit logs: retained for safety, security, and compliance purposes, including after related content is deleted.
• Cookie consent records: retained as required by applicable law.

Depending on where you live, you may have the right to:

• Access — get a copy of the personal data we hold about you.
• Correction — fix inaccurate or incomplete data.
• Deletion — have your personal data erased.
• Portability — receive your data in a structured, machine-readable format.
• Objection and restriction — object to or limit certain processing, including processing based on legitimate interests.

To exercise any of these rights, email support@ars0n.ai. We will verify your request and respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your data protection authority.

If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to not be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioral advertising. To exercise your CCPA rights, email support@ars0n.ai.

We use technical and organizational measures to protect your data, including encryption in transit (TLS), access controls limiting who can reach personal data, hashed storage of credentials and API keys, and monitoring of our infrastructure. No system is perfectly secure, and we cannot guarantee absolute security.

Breach notification: if a data breach affects your personal information, we will notify you and the relevant authorities without undue delay, as required by applicable law.

We are based in the United States, and your information is processed there and in other countries where our service providers operate. Where we transfer personal data from the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child under 16 has provided us with personal information, contact us at support@ars0n.ai and we will delete it promptly.

We may update this Privacy Policy from time to time. We will give notice of material changes by email or through a notice on the Service before they take effect. The "Effective Date" above indicates when this policy was last updated.

Questions or requests about this policy or your data: