1. Who we are and what this covers
Youkla ("Youkla", "we", "us") is operated by Youkla. This Privacy Policy explains what personal data we collect when you use youkla.com and the Youkla apps and services (together, the "Service"), why we collect it, who we share it with, how long we keep it, and the rights you have over it.
Youkla is an online service that turns what you give it into new media with the help of AI models.
We are the data controller for the personal data described here. If you have any question about this policy, write to [email protected].
2. The data we collect
We collect only what the Service needs to work. Here is the full list.
| Category | What it includes | Why we need it |
|---|---|---|
| Account | Name, email address, profile picture from your sign-in provider, sign-in method | To create and secure your account and to contact you about it |
| Content you upload | Photos, text, and files you add to the service | To make what you asked for. Nothing else |
| Content we make | Images, videos, audio, and documents generated for your account | To show them to you, let you download them, and keep them in your library |
| Billing | Plan, payment status, invoices, Stripe customer id | To bill you and to answer billing questions. We never see full card numbers |
| Usage and device | Pages visited, actions taken, browser type, approximate location from IP address, error reports | To keep the service working, find bugs, and prevent abuse |
| Messages | Anything you write to support, including screenshots you attach | To answer you |
We do not collect government identifiers, precise location, biometric templates, or health data, and we do not build profiles of you from third-party sources.
3. Photos and other files you upload
Files you upload are stored in a private folder tied to your account, under a random file name that cannot be guessed.
We use an upload only to produce the result you asked for. It is sent to an AI model for that one job and to no one else.
Our AI providers process your content under paid business terms that forbid them from using it to train their models. We do not train models on your content either.
Delete an item and its file is removed from our storage. Ask us to close your account and every file, record, and generated result tied to it is deleted.
4. Children
You may upload photos of your own children. By doing so you confirm you are their parent or legal guardian, or have that person's permission.
Anyone under 18 may not create an account. If you believe a child has given us personal data directly, or that a photo of a child was uploaded without a parent's or guardian's permission, write to [email protected] and we will delete it.
5. Why we process your data, and the legal basis
Where the GDPR, UK GDPR, or a similar law applies, we rely on the following legal bases:
- Performing our contract with you. Creating your account, generating what you asked for, storing it in your library, billing you, and answering your support requests.
- Consent. Handling photos of other people, including your children, which you confirm you have permission to upload. Marketing emails, where you opted in. Analytics and advertising cookies on marketing pages, where the law requires consent. You can withdraw consent at any time; withdrawing it does not affect processing that already happened.
- Legitimate interests. Keeping the Service secure, preventing abuse and fraud, measuring which features fail, and improving the Service. We balance these interests against your rights and do not rely on them for anything you would not reasonably expect.
- Legal obligations. Keeping billing records for tax and accounting law, and answering lawful requests from authorities.
We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
6. Who we share data with
We never sell personal data. We never share it with data brokers or advertisers for their own use. We share it only with the service providers below, who process it on our instructions, under contracts that limit what they may do with it.
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare R2 | Encrypted storage and delivery of the files you upload and the files we make for you | Global edge network |
| Stripe | Payments and subscription billing. Card numbers go to Stripe, never to our servers | United States / EU |
| Mailgun | Transactional email: sign-in codes, receipts, ready notifications | United States / EU |
| Google (Gemini API) | AI text and image generation under paid API terms that exclude training on your data | United States |
| ElevenLabs | Voice narration generation | United States |
| PostHog | Product analytics so we can see which screens fail or confuse | United States / EU |
| Google Analytics, Meta Pixel, TikTok Pixel | Aggregate traffic and ad measurement on marketing pages | United States |
We may also disclose data if the law requires it, to protect the rights and safety of you, us, or others, or as part of a merger or sale of Youkla, in which case this policy continues to apply to your data.
7. Cookies, analytics and advertising
The Service uses a small number of cookies and similar technologies:
- Strictly necessary. Signing you in, remembering your session and your preferences. These cannot be switched off without breaking the Service.
- Analytics. PostHog and Google Analytics tell us which screens are used, which fail, and where people get stuck. Data is aggregated; we do not use it to identify you.
- Advertising measurement. On marketing pages only, Meta Pixel and TikTok Pixel let us see whether an ad led to a sign-up. They do not run inside the app after you sign in.
You can block cookies in your browser settings, opt out of ad measurement through Meta and TikTok's own ad settings, and use browser extensions that block trackers. Blocking necessary cookies will prevent sign-in.
8. International transfers
Our providers operate in the United States and the European Union. When personal data leaves the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework, and we take additional measures where a transfer risk assessment calls for them.
9. How long we keep data
- Account data stays for as long as your account exists.
- Uploaded files and generated content stay until you delete them, or until we delete your account at your request.
- Billing records are kept for as long as tax and accounting law requires, typically seven years.
- Server logs and analytics events are kept for up to 12 months.
- Support conversations are kept for up to 24 months so we can follow up on earlier issues.
When data is no longer needed we delete it or anonymise it so it can no longer be linked to you.
10. How we protect data
- Every connection to the Service is encrypted with TLS.
- Files are stored encrypted at rest, in per-account folders, under random file names that cannot be guessed or enumerated.
- Our database is encrypted in transit and access to it is limited to the systems that need it.
- Payment card details are entered directly into Stripe and never pass through our servers.
- Access to production systems is restricted to the people who operate the Service, protected by multi-factor authentication, and logged.
No system is perfectly secure. If we discover a breach that affects your personal data we will tell you and the relevant authority without undue delay, as the law requires.
11. Your rights
Depending on where you live you have some or all of the following rights, and we honour them for everyone, wherever you are:
- Access. Ask for a copy of the personal data we hold about you.
- Correction. Ask us to fix data that is wrong.
- Deletion. Ask us to delete your data. Most content you can delete yourself inside the Service; for the whole account, write to us.
- Portability. Receive the data you gave us in a machine-readable format.
- Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause it while we check a request.
- Withdraw consent. For anything we do on the basis of consent.
- Complain. Lodge a complaint with your data protection authority. In the EU that is the authority of the country where you live; in the UK it is the Information Commissioner's Office.
California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use and share it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. We have not sold personal information in the preceding 12 months.
Other US states. Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising and profiling. We do not engage in profiling that produces legal or similarly significant effects.
To exercise any right, write to [email protected] from the email address on your account, or use the contact page. We verify requests by confirming control of that email. We answer within 30 days, or within the shorter period your local law requires, and we never charge for a request unless it is clearly unfounded or repetitive. You may authorise someone else to make a request on your behalf; we will ask for proof of that authorisation.
12. Marketing emails
We send transactional emails you cannot opt out of while you have an account: sign-in codes, receipts, and notices that something you made is ready. We send marketing emails only if you asked for them, and every one has an unsubscribe link.
13. Links to other sites
The Service may link to sites we do not control, such as Stripe's checkout or a payment receipt. Their privacy policies apply there, not this one.
14. Changes to this policy
When we change this policy we update the date at the top. If a change reduces your rights or changes how we use existing data in a way you would not expect, we email account holders before it takes effect.
15. Contact
- Youkla, operator of Youkla
- Privacy requests: [email protected]
- Everything else: [email protected]
These Terms and any dispute arising from the Service are governed by the laws of the country in which Youkla is established, without regard to conflict-of-law rules, and subject to the mandatory consumer protection rules of the country where you live.
Questions about this page?
Write to [email protected] and a person will answer.
