> For the complete documentation index, see [llms.txt](https://legal.srgplus.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://legal.srgplus.com/privacy-policy.md). # Privacy Policy Last updated: October 19, 2026 This privacy notice for SRG PLUS INC ("Company," "we," "us," or "our") describes how and why we collect, store, use, and share ("process") your information when you use our services ("Services"), such as when you: * Use the SRG+ apps for iPhone, iPad, Mac, Apple TV, and Android, or the website srgplus.com. * Use SRG+ Teams, our project management app for teams and their AI agents. * Use SRG+ Create, our app for making pictures and clips with AI models (section 23). * Create or join a workspace, hub, or profile, upload or view content, send messages, make calls, talk to AI agents, or use the SRG+ assistant. * Contact us or engage with us in other related ways, including sales, marketing, or events. Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at . ## SUMMARY OF KEY POINTS This summary provides key points from our privacy notice. You can find more details about each topic in the sections below. **What personal information do we process?** When you visit, use, or navigate our Services, we may process personal information depending on how you interact with the Services, the choices you make, and the features you use. **Do we process any sensitive personal information?** We do not process sensitive personal information. In SRG+ Create you may add photos of people; see section 23 for how they are used and deleted. **Do we receive any information from third parties?** If you sign in with Apple, Google, or Microsoft, we receive basic profile information from that provider. **How do we process your information?** We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. **In what situations and with which parties do we share personal information?** We share information with service providers that run parts of the Services for us, and in the specific situations described in section 3. We do not sell your personal information. **What are your rights?** Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information. **How do you exercise your rights?** Contact us at , or delete your account in the app. We will consider and act upon any request in accordance with applicable data protection laws. ## 1. WHAT INFORMATION DO WE COLLECT? ### Personal information you disclose to us **In Short:** We collect personal information that you provide to us. We collect personal information that you voluntarily provide to us when you register on the Services, create a workspace, hub, or profile, upload content, send messages, use the SRG+ assistant, express an interest in our products and Services, or contact us. This includes: * **Account information:** your name, email address, phone number, and profile picture. * **Content:** the files, videos, pages, and other content you upload or create, and the information you add to your workspaces, hubs, and profiles. * **Messages:** the messages, photos, videos, files, and voice messages you send and receive, the people in each chat, and the reports and blocks you create. We store them so we can deliver messages and keep the Services safe. The app uses your microphone for a voice message only while you record it. * **Calls:** when you make or join a voice or video call, your audio, video, and any screen you share go live to the other people in the call through our calling provider. We do not record or store call audio, video, or shared screens. We keep a record of each call (who took part, when, and for how long) to show it in the chat. * **Online status:** whether you are online and when you were last active in Chat, shown to the people you chat with. * **Device tokens:** the notification tokens of your devices, so we can deliver messages and incoming calls to them. * **AI requests:** when you use a cloud AI model in the SRG+ assistant, or send a message to an AI agent in Chat, we send the AI provider what you write, the content you choose to share, and the recent messages of that chat that the agent needs to answer (in a group, the group's latest messages). The app asks for your permission once for each AI provider before it sends anything to that provider. The on-device model processes your request on your device. * **AI provider keys:** if a workspace connects its own AI provider account, we store its key encrypted and use it only to run that workspace's agents. * **Payment information:** if you buy a paid plan, our payment provider (Stripe) processes your payment details. We do not store full card numbers. **Sensitive information.** We do not process sensitive information. All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information. ### Information automatically collected **In Short:** Some information, such as your Internet Protocol (IP) address and device characteristics, is collected automatically when you use our Services. We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, information about how and when you use our Services, crash reports, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes. We do not track you across apps or websites owned by other companies. Like many businesses, we also collect information through cookies and similar technologies on our website. ## 2. HOW DO WE PROCESS YOUR INFORMATION? **In Short:** We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your personal information for a variety of reasons, depending on how you interact with our Services, including: * To create and manage your account and let you sign in. * To provide the Services: store and deliver your content, files, and messages, and run the features you use, including the SRG+ assistant. * To keep the Services safe: prevent fraud and abuse, and review reported content and users. * To respond to your questions and send you service messages. * To understand how the Services are used and to improve them. * To comply with our legal obligations. ## 3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION? **In Short:** We share information with service providers that help us run the Services, and in the specific situations described in this section. We do not sell your personal information. We may need to share your personal information in the following situations: * **Service providers.** We share information with vendors that run parts of the Services for us, under contract and only for that purpose. They include cloud hosting and databases (Google Cloud, MongoDB Atlas), sign-in (Auth0), email and text messages (Resend, Twilio), video and file delivery (Bunny.net, Cloudflare), analytics and crash reports (Segment, Google Firebase), payments (Stripe), voice and video calls (LiveKit), and AI processing (OpenAI and Anthropic, only when you allow a cloud AI model in the SRG+ assistant or agree to message an AI agent in Chat; a workspace that connects its own AI provider account sends its agents' requests to that provider). When you connect an Instagram or Facebook account to plan and publish posts, we also share with Meta what is needed to publish those posts (see section 19). When you connect an X account, a YouTube channel or a Google Business Profile, we also share with X or Google what is needed to publish those posts (see sections 20 and 21). When you connect a TikTok account, we also share with TikTok what is needed to publish those posts (see section 22). In SRG+ Create, we share your prompts and reference files with AI image and video models (fal.ai, Replicate, OpenRouter and the model makers named in section 23), only for the results you ask for and after you agree. * **Other users.** Content you publish in a hub or channel is visible to the people who can access it. Messages are visible to the people in the chat, including any AI agent added to it, and, when a chat is reported, to our moderation team. * **Business transfers.** We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. * **Affiliates.** We may share your information with our affiliates, in which case we will require those affiliates to honor this privacy notice. Affiliates include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us. * **Legal requirements.** We may disclose information where we are legally required to do so, or to protect the rights, safety, and security of our users and the Services. ## 4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES? **In Short:** We may use cookies and similar technologies to collect and store your information on our website. We may use cookies and similar technologies (like web beacons and pixels) on our website to keep you signed in, remember your preferences, and understand how the website is used. You can refuse or delete cookies in your browser settings. Our apps do not use cookies to track you across other companies' apps or websites. ## 5. HOW DO WE HANDLE YOUR SOCIAL LOGINS? **In Short:** If you choose to register or log in to our Services using Apple, Google, or Microsoft, we may have access to certain information about you. Our Services allow you to register and log in using your Apple, Google, or Microsoft account. Where you choose to do this, we receive certain profile information about you from that provider, usually your name, email address, and profile picture. If you use Sign in with Apple and choose to hide your email address, we receive a relay address instead. We will use the information we receive only for the purposes described in this privacy notice or otherwise made clear to you on the Services. We do not control and are not responsible for other uses of your personal information by your sign-in provider. We recommend reviewing their privacy notice to understand how they collect, use, and share your personal information. ## 6. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY? **In Short:** We may transfer, store, and process your information in countries other than yours. Our servers are located in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed by us and by the service providers with whom we share your personal information (see section 3) in the United States and other countries. If you are a resident in the European Economic Area (EEA) or United Kingdom (UK), these countries may not have data protection laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this privacy notice and applicable law. ## 7. HOW LONG DO WE KEEP YOUR INFORMATION? **In Short:** We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law. We keep your personal information for as long as your account is active and as long as it is needed for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). **Deleting your account.** You can delete your account in the app (Settings, then Profile, Sign-in & Security, Delete Account). Deletion takes effect after a 30-day grace period, during which you can sign in again to restore your account. After that, we delete your account information, your messages and chats, and the content that belongs only to you. Content in a workspace that belongs to another owner stays with that workspace. SRG+ Create data is erased at once when you delete your account inside SRG+ Create (section 23). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible. ## 8. DO WE COLLECT INFORMATION FROM MINORS? **In Short:** We do not knowingly collect data from or market to children under 18. We do not knowingly solicit data from or market to children under 18. By using the Services, you represent that you are at least 18 or the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at . ## 9. WHAT ARE YOUR PRIVACY RIGHTS? **In Short:** You may review, change, or delete your account at any time. Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. To use these rights, contact us at . You can also update your profile in the app and delete your account in Settings. If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner. **Withdrawing your consent:** If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time by contacting us using the details in section 18 below. You can also turn off cloud AI in the SRG+ assistant, or stop messaging an AI agent, at any time. However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent. ## 10. CONTROLS FOR DO-NOT-TRACK FEATURES Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized at this stage. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice. ## 11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS? **In Short:** Yes. If you are a resident of California, you are granted specific rights regarding access to your personal information. California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. We do not share personal information with third parties for their direct marketing purposes. If you are a California resident and would like to make a request, please write to us using the contact information in section 18. If you are under 18, reside in California, and have a registered account with the Services, you have the right to request the removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information in section 18 and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups). ## 12. DO WE MAKE UPDATES TO THIS NOTICE? **In Short:** Yes. We will update this notice as necessary to stay compliant with relevant laws. We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this notice and will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information. ## 13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU? Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it. You can update your profile and delete your account in the app, or email your request to . ## 14. MARKETING COMMUNICATION We use your contact information to send you transactional updates (such as account activity, event notifications, and security alerts) and marketing communications (such as product updates, feature announcements, and promotional offers). You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in the message or updating your communication preferences in your account settings. We only send marketing communications where permitted by law or where you have provided consent. SRG PLUS INC does not sell or disclose your data to third parties for advertising or marketing. All marketing communications come directly from SRG PLUS INC and are intended to keep you informed about features and services relevant to your use of our platform. SRG PLUS INC complies with applicable privacy regulations (including CCPA and GDPR). Transactional communications are necessary for account security and service delivery and cannot be unsubscribed, while marketing emails can be opted out at any time through your account settings. ## 15. WORKSPACE AND HUB DATA PROTECTION SRG PLUS INC allows customers to create workspaces and hubs for managing content, groups, and user communities. We prioritize security and transparency. ### Ownership and Control All data in a workspace, including user lists and hub content, belongs to the workspace owner. The owner manages user access and permissions. ### Access and Security * Only authorized users can access workspace data. * SRG PLUS INC staff access data only for support or legal compliance and under strict controls. * Data is protected with encryption in transit and at rest, secure cloud storage, and role-based access. ### Our Role We act as a service provider/data processor, using data only to deliver services. We never sell or share workspace data with third parties for advertising. ### Marketing and Communication * We may send service notifications, feature updates, and product-related offers to registered users. * All marketing communications include an unsubscribe option, allowing users to manage their preferences at any time. ## 16. APPLE TV SRG PLUS INC ("we", "us") operates the SRG+ app for Apple TV. The Apple TV app is view-only: you browse and watch content. You cannot upload files, photos, or videos from this device. Information we collect: * Account information, such as the email address and phone number associated with your existing SRG+ account, used to sign in. * Device and technical data, including device identifiers, IP address, and app performance and crash diagnostics. * Product interaction data about how you use the app, used to operate and improve the service. How sign-in works: You sign in by pairing this Apple TV with your existing SRG+ account. We store your account identifier and an authentication token on the device so you stay signed in. How we use your information: To provide, improve, and administer the service, to communicate with you, for security and fraud prevention, and to comply with the law. Sharing: We do not sell your data and do not disclose it to third parties for advertising or marketing. We share information only with service providers and affiliates that help us operate the service, or as required by law or in connection with a business transfer. Data retention and your rights: We keep your information only as long as necessary for the purposes above. You may request access to, correction of, or deletion of your data, and you may withdraw consent at any time. Contact: SRG PLUS INC. Send privacy requests to , or see section 18 of this notice. ## 17. SRG+ TEAMS SRG PLUS INC ("we", "us") operates SRG+ Teams, an app for planning and tracking the work of a team and its AI agents. You sign in with your existing SRG+ account; SRG+ Teams does not create accounts. A workspace admin invites you. Information we collect: * Account information from your SRG+ account: your SRG+ ID, name, profile picture, and the email address or phone number you sign in with. * Invitations: the email address or phone number a workspace admin enters to invite you, kept in the workspace's invitation record. * The work your workspace adds: clients, scopes, spaces, tasks, final products, their parts, notes, and teams. It is visible only to the members of that workspace and to the AI agents the workspace connects. * Work records the workspace keeps about its members, such as roles, credits on work, and payout rates. We do not use this information for advertising and do not track you across other companies' apps or websites. The app has no ads and no third-party analytics. Service providers: cloud hosting and databases (Vercel, Supabase) and sign-in (Auth0), under contract and only to run the service. Data retention and deletion: workspace data stays with the workspace while it exists. Deleting your SRG+ account (in the SRG+ app: Settings, then Profile, Sign-in & Security, Delete Account; see section 7) ends your sign-in to SRG+ Teams once the deletion takes effect. To have your membership removed and your profile details deleted or anonymized in SRG+ Teams as well, email and we will do it within 30 days. Work you added to a workspace stays with that workspace, as in section 15. Contact: send privacy requests to , or see section 18 of this notice. ## 18. HOW CAN YOU CONTACT US ABOUT THIS NOTICE? If you have questions or comments about this notice, email us at or write to: SRG PLUS INC\ 1309 Coffeen Avenue Ste 1200\ Sheridan, WY 82801\ United States ## 19. INSTAGRAM AND FACEBOOK ACCOUNTS YOU CONNECT **In Short:** If you connect an Instagram professional account to SRG+, we use it only to publish the posts you schedule. You can remove it at any time, and we then delete what we stored about it. **What we receive.** You can connect an Instagram professional account to an SRG+ profile, either with Instagram's own login or through the Facebook Page the account is linked to. Meta then gives us the account's ID, username, account type and profile picture, the ID Meta uses for you in our app, and an access token. If you connect with Facebook, Meta also gives us the list of your Pages that have an Instagram account linked, with an access token for each Page you choose. **How we use it.** We store the access token encrypted and use it only to publish the posts, Reels, Stories and carousels you create and schedule in SRG+, to add the first comment you write, to turn comments off when you ask, and to show you the status and link of each post and how much of Instagram's daily publishing limit is used. If you connect with Facebook, we also search Instagram's music library when you add music to a Reel, check that an account you tag or invite as a collaborator exists, and search Facebook Pages when you add a location. We do not read your followers, messages or insights, we do not sell this information, and we do not use it for advertising. **Removing access.** You can disconnect an account at any time in SRG+ (Calendar, then Connected Accounts, then Disconnect). You can also remove SRG+ in Instagram (Settings, then Apps and websites) or in Facebook (Settings, then Business integrations). Meta then tells us, and we delete the account's connection and its access token right away. **Data deletion.** To have us delete the data we received from Meta, do any of the following: disconnect the account in SRG+; remove SRG+ in Instagram or Facebook and choose to delete your data, which sends us a deletion request and gives you a confirmation code and a status page; or email from the email address of your SRG+ account. We delete the connection, the access token and the stored account details within 30 days at the latest. Posts that were already published on Instagram or Facebook stay there; you can delete them in Instagram or Facebook. ## 20. X ACCOUNTS YOU CONNECT **In Short:** If you connect an X account to SRG+, we use it only to publish the posts you create and schedule. You can disconnect it at any time, and we then delete what we stored about it. **What we receive.** You can connect an X account to an SRG+ profile with X's own sign-in. X then gives us the account's ID, username, name, profile picture and verification type (it tells us whether the account may post longer posts and videos), and an access token with a refresh token. **How we use it.** We store the tokens encrypted and use them only to publish the posts you create and schedule in SRG+ (text, photos with their alt text, GIFs, videos, polls and threads) and to show you the status and link of each post. A person on your team approves every post. SRG+ never sends automated replies, mentions, likes, follows or direct messages. We do not read your followers, messages or other people's posts, we do not sell X data or share it with anyone else, and we do not use it for advertising or to train AI models. **Removing access.** You can disconnect the account at any time in SRG+ (Calendar, then Connected Accounts, then Disconnect): we revoke the access at X and delete the connection and its tokens right away. You can also remove SRG+ in X (Settings and privacy, then Security and account access, then Apps and sessions, then Connected apps). **Data deletion.** To have us delete the data we received from X, disconnect the account in SRG+, or email from the email address of your SRG+ account. We delete the connection, the tokens and the stored account details within 30 days at the latest. Posts that were already published on X stay there; you can delete them in X. ## 21. YOUTUBE CHANNELS AND GOOGLE BUSINESS PROFILES YOU CONNECT **In Short:** If you connect a YouTube channel or a Google Business Profile to SRG+, we use that access only to publish the videos and posts you create and schedule. SRG+ uses YouTube API Services. You can remove the access at any time, and we then delete what we stored about it. **YouTube API Services.** SRG+ uses YouTube API Services to upload the videos you choose to your YouTube channel. By using SRG+ to post to YouTube, you agree to be bound by the YouTube Terms of Service (). Google's Privacy Policy () describes how Google handles your information. **What we receive.** You connect with Google's own sign-in and choose what to allow. Google then gives us your Google account ID and, for a YouTube channel, the channel's ID, name, handle and picture (for a Business Profile, the IDs and names of the account and its locations), and a refresh token that lets SRG+ act only within the access you approved. **How we use it.** We store the refresh token encrypted and use it only to upload the videos you pick with the title, description, visibility and other settings you set, to add the thumbnail, playlist or first comment you ask for, to check that a published video still exists, to publish your Business Profile posts, and to show you the status and link of each post. We never change or add to the title, description or visibility you set. We do not read your other videos, comments, subscribers, analytics or messages, we do not sell data received from Google or share it with anyone else, and we do not use it for advertising or to train AI models. **Google API Services User Data Policy.** SRG+'s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (), including the Limited Use requirements. **Keeping it current.** We refresh the stored channel and location details at least every 30 days, and delete them if they can no longer be refreshed. **Removing access.** You can disconnect a channel or profile at any time in SRG+ (Calendar, then Connected Accounts, then Disconnect): we delete the connection and its token right away. You can also remove SRG+'s access to your Google account on Google's security settings page (); after access is removed there, we delete the data we stored within 7 days at the latest. **Data deletion.** To have us delete the data we received from Google, disconnect in SRG+, remove the access on Google's security settings page, or email from the email address of your SRG+ account. Videos and posts that were already published stay on YouTube or Google; you can delete them there. ## 22. TIKTOK ACCOUNTS YOU CONNECT **In Short:** If you connect a TikTok account to SRG+, we use it only to publish the videos and photo posts you create and approve. You can disconnect it at any time, and we then delete what we stored about it. **What we receive.** You can connect a TikTok account to an SRG+ profile with TikTok's own login. With your permission, TikTok then gives us the account's open ID, display name and profile picture, and an access token with a refresh token. Before each post we also read your account's posting options from TikTok: who can watch your posts, whether comments, Duet and Stitch are allowed, and the longest video you can post. **How we use it.** We store the tokens encrypted and use them only to show which TikTok account is connected and to publish the videos and photo posts you create in SRG+, with the caption, privacy and interaction settings you choose, or to send a post to your TikTok inbox as a draft when you choose that. Nothing is sent to TikTok until you press Post Now or the time you scheduled arrives. To publish photos, TikTok fetches them from a link on our server. We do not read your followers, messages, other videos or analytics, we do not sell TikTok data or share it with anyone else, and we do not use it for advertising or to train AI models. **Removing access.** You can disconnect the account at any time in SRG+ (Calendar, then Connected Accounts, then Disconnect): we revoke the access at TikTok and delete the connection and its tokens right away. You can also remove SRG+'s access in the TikTok app settings. **Data deletion.** To have us delete the data we received from TikTok, disconnect the account in SRG+, or email from the email address of your SRG+ account. We delete the connection, the tokens and the stored account details within 30 days at the latest. Posts that were already published on TikTok stay there; you can delete them in TikTok. ## 23. SRG+ CREATE **In Short:** SRG+ Create makes pictures and clips with AI models from other companies. We send them your prompt and the files you add only to make the result you ask for, and only after you agree. Photos of people need your confirmation and are deleted after 30 days. Delete Account in the app erases your SRG+ Create data at once. SRG PLUS INC ("we", "us") operates SRG+ Create, an app for iPhone, iPad and Mac that makes pictures and short video clips with AI models. You sign in with your SRG+ account. Your work sits in a workspace: your own, or a studio's workspace you were added to. **Information we collect.** * Account information from your SRG+ account: your SRG+ ID, name, and the email address or phone number you sign in with. * What you give the app to make a result: your prompts (the words you write) and the photos, clips and sounds you add as references, including photos of people. * What the app makes for you: the pictures and clips, with the model, the settings and the prompt that made them. * Runs and credits: which model ran, when, what it cost in credits, and your workspace's credits history. * Purchases: credit packs bought through Apple's In-App Purchase (we receive Apple's signed transaction, never your card or Apple ID details) or by card through Stripe on our website or in the Mac app (Stripe processes the card; we keep the amount, the date, and the card's brand and last four digits or your Stripe Link email). * Consents: that you agreed to send data to AI companies and, for each photo of a person, that you confirmed you may use it, with the text you agreed to, the time, your IP address and device type. * Reports you send about a result (a reason and your note) and the blocks our moderators place. The app does not use advertising or analytics tools, does not track you across other companies' apps or websites, and does not read a device identifier. **Who processes it, and why.** To make each result we send your prompt and the reference files of that run to the company whose model you picked, through the service that runs it for us: * The services that run the models: **fal.ai**, **Replicate** and **OpenRouter** (United States). * The model makers behind them: **Google, OpenAI, ByteDance, Kling (Kuaishou), MiniMax, Black Forest Labs, Ideogram, Recraft, Runway, Lightricks, Alibaba and Topaz Labs**. Some of them run their models outside the United States (for example, ByteDance's video model runs in Singapore). * Safety checks before each run: **OpenAI**'s moderation service checks your prompt and reference pictures, and an OpenAI model reached through OpenRouter on zero-retention servers checks photos of people only to refuse children and public figures. * Our own infrastructure: **Cloudflare** (the app's server and file storage), **Supabase** (database), **Google Cloud** (adds the invisible watermark), **Auth0** (sign-in), **Resend** (sends reports to our moderators), **Apple** and **Stripe** (payments). They get the data only to make your result or to run that part of the service, under their contracts and terms for business customers. What they keep, as their terms say today: Replicate deletes inputs and results within one hour and does not train on them; OpenRouter does not log or train on prompts by default; OpenAI's moderation keeps nothing; fal.ai keeps request data for up to 90 days under its terms; Resend keeps report emails (no photos, no prompts) for 30 days; each model maker processes the data under its own terms for API customers. Nobody gets your data to advertise to you, and we do not sell it. We do not use your prompts, photos or results to train AI models. **Your OK first.** Nothing you write or add leaves your device for an AI company before you agree on the "Before you create" screen, which names these companies. You can take this back at any time in Settings › Privacy: from then on nothing new is sent, the photos of people you added are deleted, and your other files stay until you delete them. **Photos of people (notice for Illinois, Texas, Washington and similar laws).** When you add a photo of a person as a reference or for a person swap, the AI model that makes your result may analyse the face in it so the result looks like that person. SRG+ Create itself does not make face templates, face prints or any other biometric identifier, and does not use faces to find out who someone is. Before such a photo is used, you confirm in the app, for each photo, that it shows you or a person who gave you permission, and you agree to the text shown; we keep a record of that confirmation. We never sell, lease, trade or otherwise profit from these photos, and never use them for advertising, marketing or training AI. **We delete each photo of a person 30 days after it is added**, or sooner when you delete it, take back its permission, or take back your OK in Settings › Privacy. To ask for an earlier deletion, write to . **Who sees your work.** The people and AI agents in your workspace see its pictures, clips and prompts; in your own workspace that is only you, unless you add someone. Agents a workspace connects through SRG+ Connect can make and read results in that workspace. Our team opens a file only when it is reported, to answer your support request, or when the law requires it. **AI labels and the watermark.** Every result carries a signed AI label (C2PA Content Credentials) and an invisible watermark. The label holds no prompt, name, email or workspace: only the model, its maker, the service that ran it, a job id and the time. The watermark holds only a short code that leads to the same public facts (made in SRG+ Create, the model, its maker, the day). Anyone can read them with our free check at , which never keeps the file it checks. Files you upload are not labelled by us. **How long we keep it.** * Prompts, uploads and results: for as long as they stay in the workspace. When you or the workspace's owner delete a file, it leaves our storage within minutes. * Photos of people: 30 days after they are added, or sooner as described above. * Consent records: for as long as your account exists, as proof of your choices. * Reports and blocks: for as long as needed to keep the service safe. * Purchases and the credits history: as long as tax and accounting law requires, without your name once your account is deleted. **Deleting your account.** Settings › Account › Delete Account… in SRG+ Create erases your SRG+ Create data **at once**: your own workspace with all its files, prompts, uploads, photos of people, runs and the credits left in it; in other workspaces, your uploads and the photos of your face (what you made for a studio's workspace stays with that workspace). The files leave our storage within minutes; copies in database backups are overwritten on their regular schedule. Your name, SRG+ ID, IP address and device type are removed from consent records, reports and blocks; the credits history keeps amounts without your identity. The same step closes your SRG+ account in every SRG+ app at once and deletes it for good after 30 days (see section 7). If you delete your SRG+ account in another SRG+ app instead, we erase your SRG+ Create data within 30 days; write to to have it done sooner. **Age.** SRG+ Create is for adults 18 and over. Where the law asks for an age check, the app asks your device's age range at launch; only the answer's category (18 or older, under 18, not shared) stays on your device and we never receive it. **Contact.** Privacy requests: . Reports and takedown requests: , answered within 48 hours. See also section 18.