Legal
Privacy Policy
Effective 2026-08-01
What we collect, why we collect it, who else touches it, and how to get it deleted.
1. Who we are
COLOPiO Innovative Technologies L.L.C (Dubai, United Arab Emirates, licence 1180723) operates Lucy Repurpose and is the data controller for the personal data described here. Contact our privacy team at info@colopio.com.
2. What we collect
Account data: email address, and authentication metadata from Supabase (our identity provider) when you sign up or sign in.
Your content: the video/audio files you upload, the transcripts, clips, captions and other Output generated from them, and metadata about your jobs (status, timing, duration).
Billing data: your subscription plan and usage (minutes processed). Card numbers are entered directly into Stripe and never reach our servers.
Technical data: IP address, request timestamps, and basic device/browser information, logged for security, fraud prevention, and — where you dispute a charge — as evidence that the account holder accessed and downloaded what they paid for.
Connected-channel tokens: if you connect a social account (TikTok, Instagram, LinkedIn, X) to schedule posts, we store the access token that platform issues, scoped to what's needed to publish on your behalf.
3. Why we use it
To provide the Service (transcribe, analyse, cut, caption and deliver your content); to operate your account and billing; to secure the Service against abuse and fraud; to communicate with you about your account, jobs, and — if you opt in — product updates; and to comply with legal obligations, including responding to lawful requests and maintaining the access records described above for dispute and fraud evidence.
We do not use your uploaded content or its Output to train AI models, ours or any third party's. Where our transcription provider's default behaviour would permit that, we disable it — see sub-processors below.
4. Legal basis (EEA/UK users)
We process your data to perform our contract with you (providing the Service you signed up for), for our legitimate interests (security, fraud prevention, service improvement), and to comply with legal obligations (tax, accounting, lawful requests). Where we rely on consent — for example, marketing email — you can withdraw it at any time.
5. Sub-processors — who else touches your data
We use the following service providers to operate Lucy Repurpose. Each processes only what its function requires, under a data processing agreement or equivalent contractual terms.
| Provider | Purpose | Data handled | Region |
|---|---|---|---|
| Anthropic | AI analysis of transcripts — clip selection and caption generation. | Transcript text derived from your uploads. | United States |
| Deepgram | Speech-to-text transcription with speaker diarization. | Audio extracted from your uploads. | United States |
| Cloudflare (R2) | Object storage for source media, rendered clips and exports. | Your uploaded and generated media files. | Global edge network |
| Supabase | Account identity and authentication. | Email address and authentication metadata. | European Union |
| Stripe | Payment processing and subscription billing. | Billing details. Card numbers go directly to Stripe and never reach our servers. | Global |
| Hetzner Online GmbH | Application hosting and database infrastructure. | All service data at rest. | European Union (Germany) |
Provider names link to that vendor's data processing agreement. We review this list when we add or remove infrastructure and update it here in the same change.
6. Data retention and deletion
We keep your uploaded media and generated Output for as long as your account is active, so you can return to past jobs. You can delete a video, its transcript and its Output at any time from your library; deletion removes the underlying files from object storage within 30 days. If you close your account, we delete your content and personal data within 90 days, except where we must retain billing records longer to meet tax and accounting obligations, or access logs longer to resolve an open payment dispute.
7. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data; to object to or restrict certain processing; and to lodge a complaint with your local data protection authority. EU/EEA and UK residents have these rights under the GDPR and UK GDPR respectively; California residents have analogous rights under the CCPA/CPRA. To exercise any of these, email info@colopio.com. We respond within 30 days.
8. International transfers
COLOPiO Innovative Technologies L.L.C is established in Dubai, United Arab Emirates, and our sub-processors operate in the United States and the European Union. Where we transfer personal data of EEA/UK residents outside those regions, we rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism with the receiving provider.
10. Children
The Service is not directed to, and we do not knowingly collect personal data from, anyone under 16.
11. Changes to this policy
We'll notify you by email or in-product notice before a material change takes effect. The "Effective" date above always reflects the current version.
12. Contact
COLOPiO Innovative Technologies L.L.C
Latifa Tower, Office 606-05, Trade Centre First, Sheikh Zayed Road, Dubai 452440, United Arab Emirates
Email: info@colopio.com · Phone: +971 58 533 7957