01Who we are
SupaSwirl is an AI video creation service operated by Orine Labs (“we”, “us”). We are responsible for your personal data under this policy. Questions or requests: [email protected].
02What we collect
- Account data: your email address, password (stored only as a secure hash by our authentication provider), sign-in history and account settings.
- Consent records: each time you accept our Terms and this policy: the version, when you accepted it, the IP address and browser used, and your marketing choice. We keep this history as proof of what you agreed to, including to answer payment disputes.
- Your content: prompts, reference images you upload and the videos you generate.
- Billing data: your plan, credit balance and history, and payment status. Card details are collected and stored by Stripe, never by us.
- Affiliate data: applications, partner links, referral clicks, attributed sign-ups, commission and payout records, and the payout email a partner provides. The referral cookie is saved only with marketing cookie consent.
- Technical data: IP address, browser and device information, and security and error logs.
- Cookies and similar storage: see our Cookie Policy.
03How we use your data
- To create your account, keep you signed in and provide the service, including generating videos from your prompts and images.
- To process payments, grant and track credits, and prevent fraud, refunds abuse and chargebacks.
- To review affiliate applications, attribute new customers to approved partners when you allow marketing cookies, calculate commissions and record manual payouts.
- To keep SupaSwirl secure and reliable, enforce our Terms of Use, and respond to support requests.
- To understand how the product is used, using aggregated data, and with Google Analytics, Ahrefs Web Analytics and Microsoft Clarity (page-use recordings with everything you type hidden; in the studio a recording is labelled with your internal account number, never your name or email, so we can fix a problem you report) only if you allow “Analytics” (never for advertising).
- To send product news and tips only if you opted in. Service emails (sign-in links, receipts, important changes) are sent regardless.
- To comply with legal, tax and accounting obligations.
04Legal bases
Where laws such as the GDPR apply, we rely on: performing our contract with you (providing the service and billing); legitimate interests (security, fraud prevention, improving the product); consent (marketing emails and optional cookies, which you can withdraw at any time); and legal obligations (tax and accounting records). In Malaysia we process personal data in line with the Personal Data Protection Act 2010.
06International transfers
Our providers may process data in countries other than yours, including the United States, Japan, the European Union and other countries where our AI model providers operate (see Subprocessors). Where required, we rely on appropriate safeguards such as standard contractual clauses.
07How long we keep it
- Account data, projects, prompts and your generated images/videos: while your account is open. You can ask to delete your account in Settings → Delete account. Your account is kept for 30 days: you can still sign in, download your work and cancel the request; new paid work and purchases are paused and renewal stops. After 30 days sign-in access ends and cleanup begins. You can also contact [email protected]. Our cleanup stops new work and subscription renewals and removes files from our active storage and account data, normally soon afterward and within 30 days, except necessary retained records. Temporary service failures are retried. Recreating an account does not restore deleted work.
- Reference images: kept with the job they were used for, and deleted with your account.
- Payment and tax records: as long as the law requires (typically 7 years).
- Affiliate payout and commission records: as long as needed for accounting and legal obligations. The referral cookie expires after 60 days; partner clicks that have not become referrals are used only for aggregate click totals.
- Security logs: up to 90 days.
- Deletion processing records: minimal account and billing references for retries and to prevent restoration, up to 90 days after completion. Minimized accounting records, payment references, credit transactions and aggregate usage costs are kept for 7 years. We do not keep prompts or output files in that accounting archive.
- Free-credit abuse prevention: a salted hash of your verified email may remain after deletion to prevent repeated free-credit awards; we remove its former account link. It is not used for marketing.
- Encrypted database backups: cloud snapshots expire after 30 days; offline copies retain the last 8 weekly snapshots (normally about 8 weeks). Backups are restricted to recovery and are not used to reopen deleted accounts. Deletion records must be reapplied before a restored system serves customers. Our active media storage is cleaned separately. Providers may retain necessary security, billing or legal records under their own policies; see Subprocessors.
08Security
Your files are stored privately and shared through short-lived signed links. Access to your data is restricted by database-level rules, all traffic is encrypted, and payment data stays with Stripe. No system is perfectly secure, so please use a strong, unique password.
09Your rights and choices
Depending on where you live, you can ask to access, correct, download or delete your personal data, restrict or object to certain processing, and withdraw consent at any time. You can unsubscribe from marketing using the link in any email, and change cookie choices under “Cookie settings” in the footer.
Email [email protected] to make a request. We will respond within the time the law requires. You may also complain to your local data protection authority, in Malaysia the Personal Data Protection Department (JPDP).
10Malaysia (PDPA 2010)
Orine Labs is based in Malaysia and handles personal data in line with the Personal Data Protection Act 2010 (PDPA). Under the PDPA you may request access to and correction of your personal data, withdraw consent, and limit processing for direct marketing. Providing your email address is required to create an account; other information is optional. If you do not provide required data, we cannot provide the service.
To make a request, email [email protected] from your account address. We respond within 21 days as the PDPA requires. A Bahasa Malaysia version of this notice is available on request.
11International privacy rights
We offer the same core rights to everyone, wherever you live: to know what we hold, get a copy, correct it, delete it, object to or restrict processing, withdraw consent and opt out of marketing. In addition:
- European Union, EEA and United Kingdom (GDPR / UK GDPR): you also have the right to data portability and to complain to your local supervisory authority. Our legal bases are listed above.
- United States (for example California CCPA/CPRA and other state laws): we do not sell or share your personal information for cross-context behavioural advertising, and we do not use sensitive personal information for purposes that require an opt-out. You can ask to know, delete or correct your information, and we will not treat you differently for using these rights. An authorised agent may make a request for you.
- Singapore (PDPA), Australia (Privacy Act), Canada (PIPEDA), Brazil (LGPD), India (DPDP Act) and other countries: you have the access, correction and withdrawal rights those laws give, and you may complain to your local privacy regulator.
To use any right, email [email protected] from your account address. We may need to confirm your identity. We answer within the time your law requires, and within 30 days at most unless the law allows longer.
12AI and your content
Your prompts and images are used to generate your videos. We do not use your content to train our own models. Please do not upload sensitive personal data, or images of other people without their permission.
13Children
SupaSwirl is not for children under 13. If you are under 18, you may use it only with a parent or guardian’s permission. If you believe a child has given us personal data, contact us and we will delete it.
14Changes to this policy
We will post updates here and change the “Last updated” date. If changes are significant, we will notify you and ask you to accept them in the app.
15Contact
Orine Labs, operator of SupaSwirl, Malaysia. Email: [email protected].