This document still has placeholders. Set LEGAL_ENTITY, LEGAL_ADDRESS, LEGAL_EMAIL and LEGAL_JURISDICTION, and have a lawyer read it, before relying on it.

Effective 2026-10-08

Privacy policy

MediaOps is run by Pykero (LEGAL_ENTITY not set), LEGAL_ADDRESS not set. This page says what we collect, why, who else sees it, and how to get it back or have it erased. For anything not answered here, write to LEGAL_EMAIL not set.

What we collect

Your account. Your email address, your name if you give one, and a hash of your password. If you sign in with Google, Facebook or Instagram we store that provider’s account id instead, plus whatever that provider tells us (usually an email and a name).
What you make. Your prompts, brand kits, skills, scripts, compositions, rendered video and images, and anything you upload such as logos, product photos and screenshots.
Connected accounts. When you connect Instagram to publish, we store the access token that lets us post on your behalf, until you disconnect.
Billing. Your Stripe customer and subscription ids, your plan, and a ledger of every credit added or spent. We never see or store your card number: Stripe takes it directly.
Operational records. Job history with timing, token counts, cost and any error, plus ordinary server logs. We use these to run the service, find failures and understand what the work costs.

What we do not do

There is no advertising, no tracking pixel, no analytics product and no third-party cookie on this site. The only cookie we set is the one that keeps you signed in, plus a short-lived one during a provider sign-in. We do not sell or rent your data, and we do not use your content to train any model.

Who else sees it

To run the service we pass parts of your data to the processors below, and to nobody else.

Anthropic (Claude). Writes the brief, script, scenes and captions, and reviews rendered frames. Your prompt, brand kit, attached images and the text of the piece.
Stripe. Takes payment for credits and plans. Your email and the payment details you give Stripe directly. Card numbers never reach our servers.
Resend. Sends account mail, such as a password reset link. Your email address and the contents of that message.
Meta (Facebook, Instagram). Signs you in, and posts a finished piece when you connect an account. Your provider account id, and the piece you chose to publish.
Google. Signs you in, when you choose that. Your Google account id, email and name.
Our hosting provider. Runs the servers, database and file storage. Everything above, at rest.

Each of these acts on our instructions under its own terms. Because Anthropic, Stripe, Resend, Google and Meta operate internationally, your data may be processed outside your own country.

Why we are allowed to

To give you the service you asked for: performance of our contract with you.
To keep the service working, secure and affordable to run: our legitimate interest.
To meet accounting and tax obligations on payments: a legal obligation.

How long we keep it

Your account and everything in it: until you delete it.
Rendered files and uploads: until you delete the piece they belong to, or your account.
A connected account’s token: until you disconnect it, or it expires.
Payment records: kept by Stripe for as long as tax law requires, which is normally several years, even after you leave.
Server logs: a short rolling window, normally under 30 days.

You can delete your account yourself, at the bottom of Settings. Everything above goes with it at once — your workspace, pieces, files, brand kits and connected accounts — and any subscription is cancelled. Only the payment records Stripe must keep remain, with Stripe. Deletion is not reversible.

Your rights

You can ask for a copy of your data, have it corrected, have it erased, object to our processing of it, or ask us to stop entirely. Write to LEGAL_EMAIL not set and we will answer within 30 days. If you are in the EU or the UK and you think we have it wrong, you can also complain to your national data protection authority.

Security

Passwords are stored as scrypt hashes, never as text. Sessions and reset links are random tokens kept only as hashes, and a reset link works once and expires in an hour. Traffic is served over HTTPS. Your files are stored privately and reached only through our own server, except a signed, expiring link we create when you ask us to publish a piece to a connected account. No system is perfect, so if something does go wrong and it puts you at risk, we will tell you.

Children

MediaOps is for businesses and is not intended for anyone under 16. We do not knowingly collect their data; if we learn that we have, we delete it.

Changes

If this policy changes in substance we will update the date at the top and tell account holders by email before it takes effect.