Sybora App – Privacy Policy

Last updated: February 12, 2026

1. Introduction

This Privacy Policy explains how Sybora App (referred to as “Sybora,” “we,” “us,” or “our”) collects, uses, stores, discloses, and otherwise processes Personal Data when you access or use:

• the website at https://sybora.app;
• the Sybora account and subscription services;
• Sybora’s AI-powered video creation, editing, voiceover, image-generation, text-generation, clipping, ranking, Split Screen, Text Story, Zoom Clip, and export tools; and
• any other service that links to this Privacy Policy,

together referred to as the “Services.”

The data controller responsible for Personal Data processed under this Privacy Policy is:

Name: Sybora App
Email: support@sybora.app
Website: https://sybora.app

Your use of the Services may also be governed by our Terms of Service. This Privacy Policy does not apply to websites, platforms, or services operated by third parties that we do not own or control.

2. Scope and Key Definitions

This Privacy Policy applies to Personal Data we process about visitors, registered users, subscribers, and people who contact us.

“Personal Data” means information relating to an identified or identifiable person. Depending on the applicable law, similar terms may include “personal information” or “personally identifiable information.”

“User Content” means videos, images, audio, scripts, prompts, captions, links, project settings, and other material submitted to, imported into, generated through, or stored in the Services.

3. Personal Data We Collect

The information we collect depends on how you interact with the Services and which features you use.

3.1 Account and Profile Data

This may include:

• first name and last name;
• email address;
• user and account identifiers;
• authentication-request and verification metadata used for passwordless email sign-in;
• account status, subscription tier, credits, preferences, and language settings; and
• registration and last-login timestamps.

Purpose: creating and maintaining your account, authentication, account security, support, and providing the Services.
Legal basis under the GDPR/UK GDPR: performance of a contract; legitimate interests in maintaining a secure and reliable service.

Sybora uses passwordless email authentication. When you register, we request your first name, last name, and email address. When you sign in, you provide your email address and we send a short-lived, single-use eight-digit sign-in code to that address. The code expires automatically and cannot be used as a permanent password.

3.2 Free Access and Download-Allowance Data

You may create an account without entering payment-card details. The free version provides access to Video Ranking, Clip Compiler, Split Screen, Text Story, and Zoom Clip, with a total allowance of three free video downloads. Other AI-powered features require a paid subscription.

To administer the free version, we process:

• free-access eligibility and account status;
• the number of completed free downloads and the remaining allowance;
• the date and time of each qualifying download;
• the tool used to create the downloaded output; and
• technical and security signals used to detect misuse or attempts to circumvent the allowance.

Purpose: providing the free version, displaying the remaining download allowance, applying the three-download limit, preventing duplicate or abusive free use, and offering an upgrade when the allowance is exhausted.
Legal basis under the GDPR/UK GDPR: performance of a contract; legitimate interests in preventing abuse and protecting the sustainability of the Services.

3.3 Payment and Billing Data

This may include:

• selected plan and subscription status;
• purchase, renewal, refund, and transaction history;
• billing name, address, tax information, and invoice data;
• payment-method type, card brand, and the last four digits of a payment card; and
• Stripe customer, subscription, payment, and invoice identifiers; and
• purchase-consent records, including the user identifier, acceptance timestamp, exact consent-text version, purchase type or key, and related Stripe Checkout Session identifier.

Purpose: processing payments, administering subscriptions, issuing Stripe receipts or invoices, recording the user’s immediate-performance request and withdrawal acknowledgement, preventing fraud, handling refunds, and complying with accounting or tax obligations.
Legal basis under the GDPR/UK GDPR: performance of a contract; compliance with legal obligations; legitimate interests in fraud prevention.

Payment card details are collected and processed directly by Stripe. Sybora does not store complete payment-card numbers or card security codes on its own servers. Stripe’s handling of payment data is governed by the Stripe Privacy Policy.

3.4 Device, Technical, and Security Data

This may include:

• IP address and approximate location derived from it;
• browser type and version, operating system, device type, screen settings, and language;
• device, session, event, and request identifiers;
• login timestamps, referring page, error messages, and diagnostic data; and
• security events, suspected abuse, and fraud indicators.

Purpose: operating and securing the Services, troubleshooting, preventing abuse or fraud, measuring performance, and maintaining audit logs.
Legal basis under the GDPR/UK GDPR: legitimate interests in security, service reliability, fraud prevention, and product improvement; legal obligations where applicable.

3.5 Usage Data

This may include:

• pages, tools, and features visited or used;
• interactions, clicks, session duration, and feature settings;
• project, generation, render, export, download, free-allowance, and credit-usage history;
• timestamps and technical metadata relating to content processing; and
• feedback, survey responses, and product-support activity.

Purpose: providing requested features, maintaining account history, improving the Services, customer support, capacity planning, and detecting misuse.
Legal basis under the GDPR/UK GDPR: performance of a contract; legitimate interests in improving and protecting the Services; consent where required for non-essential analytics.

3.6 User Content and AI Inputs

This may include:

• uploaded or imported video, image, and audio files;
• scripts, prompts, captions, titles, transcripts, and voiceover text;
• project settings, clip order, crop and zoom selections, brand settings, and output preferences;
• generated images, audio, text, video, and exported results; and
• metadata associated with the content or project.

Purpose: performing the creative task requested by you, saving and restoring projects, generating outputs, rendering files, providing support, and preventing misuse.
Legal basis under the GDPR/UK GDPR: performance of a contract; legitimate interests in security and service improvement where compatible with your rights.

Do not upload sensitive information or content you are not authorised to use. You are responsible for ensuring that your User Content and instructions comply with applicable law and our Terms of Service.

3.7 Imported Links and Third-Party Platform Data

If the feature is available, you may submit a YouTube, Instagram, TikTok, or other supported media URL. We may process:

• the URL you submit;
• media and metadata accessible from that URL;
• technical information needed to retrieve or process the content; and
• the resulting imported files within your project.

Submitting a link does not by itself give Sybora access to or control over your social-media account. Unless expressly stated in the relevant feature, Sybora does not publish content to, manage, or analyse your social-media account on your behalf.

Purpose: importing the content selected by you and providing the requested editing or creation feature.
Legal basis under the GDPR/UK GDPR: performance of a contract.

Media-link processing is performed on Sybora’s Hetzner server using the locally operated open-source yt-dlp tool. Video rendering is performed on the same server using FFmpeg. These local tools do not receive Personal Data as separate hosted service providers.

3.8 Communications and Support Data

This may include your name, email address, message, attachments, account identifiers, transaction references, and correspondence history.

Purpose: responding to requests, investigating problems, processing complaints, and establishing or defending legal claims.
Legal basis under the GDPR/UK GDPR: performance of a contract; legitimate interests in customer support and legal-claim management; legal obligations where applicable.

3.9 Marketing Data

This may include your email address, consent status, unsubscribe status, campaign interactions, and communication preferences.

Purpose: sending product news, offers, and marketing communications where permitted.
Legal basis under the GDPR/UK GDPR: consent where required; otherwise our legitimate interests, subject to your right to object.

You can unsubscribe from marketing emails at any time by using the link in the message or contacting support@sybora.app. Service, security, billing, and legal notices are not marketing messages and may still be sent when necessary.

4. Sources of Personal Data

We may obtain Personal Data:

• directly from you, when you register, subscribe, upload content, submit a link, create a project, contact support, or otherwise use the Services;
• automatically, through server logs, cookies, local storage, and similar technologies;
• from service providers, such as Stripe, authentication providers, hosting providers, analytics services, and fraud-prevention tools; and
• from third-party platforms or publicly accessible sources, when you instruct us to import content from a supported URL.

5. How We Use Personal Data

We may use Personal Data to:

• provide, personalise, maintain, and improve the Services;
• create and manage accounts and subscriptions;
• authenticate users through short-lived, single-use email tokens or sign-in links;
• provide the free version, record completed downloads, and apply the three-download allowance;
• process payments, invoices, credits, renewals, cancellations, and refunds;
• process User Content and generate requested outputs;
• authenticate users and protect accounts;
• monitor performance, troubleshoot errors, and develop new features;
• detect, investigate, and prevent fraud, abuse, security threats, and unlawful activity;
• respond to support requests and communicate about the Services;
• send marketing communications where permitted;
• enforce our Terms of Service and protect our rights, users, and third parties;
• comply with legal, tax, accounting, regulatory, and law-enforcement requirements; and
• establish, exercise, or defend legal claims.

We will not use Personal Data for a materially incompatible purpose without providing appropriate notice and, where required, obtaining consent.

6. AI Processing and User Content

Sybora may transmit the information necessary to perform an AI-powered request—including prompts, scripts, images, audio, video, or related technical metadata—to selected AI and infrastructure providers acting on our behalf.

At launch, these providers may include OpenAI and other providers identified in Section 16. Data is sent only to the extent reasonably necessary to provide the feature, secure the Services, or comply with law.

Unless we clearly state otherwise and have an appropriate legal basis, Sybora will not use your private User Content to train a publicly available AI model. The independent processing practices of a provider, where it acts as its own controller, are described in that provider’s privacy notice.

AI-generated content may be inaccurate, incomplete, or unsuitable for a particular purpose. You should review generated outputs before publishing or relying on them.

7. How We Disclose Personal Data

We do not sell or rent Personal Data for money.

We may disclose Personal Data to:

• Service providers and processors: companies that provide hosting, database, authentication, storage, payments, email delivery, AI processing, rendering, security, or customer-support services;
• Professional advisers: accountants, auditors, insurers, legal advisers, and consultants where reasonably necessary;
• Authorities and legal recipients: courts, regulators, law-enforcement bodies, tax authorities, or other recipients where required by law or necessary to protect legal rights and safety;
• Business transaction participants: prospective buyers, investors, advisers, or successor organisations in connection with a financing, merger, acquisition, restructuring, insolvency, or sale of assets, subject to appropriate safeguards; and
• Recipients chosen by you: third parties where you direct us to share data or provide valid consent.

Service providers may process Personal Data only for the agreed services and in accordance with applicable contracts and data-protection requirements.

8. Cookies and Similar Technologies

Sybora may use cookies, browser storage, pixels, software development kits, and similar technologies.

8.1 Essential Technologies

These technologies are necessary for account login, authentication, security, fraud prevention, session management, language settings, and core platform operation. Where allowed by law, they are used without consent because the requested Services cannot function properly without them.

8.2 Functional Technologies

These remember settings and preferences, such as language, interface choices, or previously selected options.

8.3 No Analytics or Advertising Tracking

Sybora does not currently use Google Analytics, Vercel Analytics, Meta Pixel, TikTok Pixel, advertising cookies, retargeting technologies, or other third-party tracking scripts. We use only technologies required for authentication, security, preferences, and core platform operation.

You can control cookies and browser storage through your browser settings. Blocking essential technologies may prevent account login or other parts of the Services from working. If we introduce non-essential analytics or advertising technologies in the future, we will update this Policy and obtain consent or provide an opt-out where required before activating them.

9. Passwordless Email Authentication

Sybora does not require users to create a permanent password. Registration requires a first name, last name, and email address. For later sign-ins, the user enters an email address and receives a short-lived, single-use eight-digit sign-in code by email. The main sign-in flow does not use a clickable magic link.

We use the email address and related authentication metadata only to create or locate the account, deliver the authentication message, verify the sign-in attempt, maintain account security, and prevent unauthorised access. Sign-in codes expire automatically and are invalidated after successful use or expiry.

Authentication is provided through Supabase. Authentication emails are delivered through Resend from noreply@sybora.app.

10. Data Retention

We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, comply with law, resolve disputes, prevent fraud, and enforce agreements.

Our expected retention framework is:

• Account data: while the account remains active. When you use the account-deletion function, account data is deleted immediately from Sybora’s active systems, subject to the limited exceptions described below;
• Free-download allowance and usage records: while the account remains active and deleted from Sybora’s active systems when the account is deleted;
• Projects and User Content without an active trial or paid subscription: automatically deleted after 14 days;
• Basic plan projects and User Content: automatically deleted after 30 days;
• Pro plan projects and User Content: automatically deleted after 90 days;
• Business plan projects and User Content: automatically deleted after 180 days;
• Failed or temporary imports: retained only as long as reasonably necessary to complete or troubleshoot the requested operation, then deleted;
• Payment, invoice, tax, and accounting records: for the period required by applicable law, which may be up to 8 years in some jurisdictions;
• Security and technical logs: only as long as reasonably necessary for security, troubleshooting, abuse prevention, an incident, a dispute, or a legal obligation;
• Support records: until the request is resolved and thereafter only as long as reasonably necessary for follow-up, dispute resolution, or legal claims; and
• Marketing preferences: until consent is withdrawn, you unsubscribe, or the information is no longer needed, with a minimal suppression record retained to honour your choice.

An automated cleanup process runs daily to apply the project and User Content retention periods above. When retention is no longer necessary, we delete, anonymise, or securely isolate the information. Data removed from active systems may remain temporarily in provider-managed backups or security logs until the provider’s normal retention cycle completes, unless the law requires longer retention.

11. Data Security

We use reasonable technical and organisational safeguards designed to protect Personal Data against unauthorised access, loss, alteration, disclosure, or destruction. Depending on the relevant system, these measures may include:

• encrypted HTTPS/TLS connections;
• managed authentication and access controls;
• restricted administrative access;
• logging, monitoring, and abuse-prevention measures;
• separated production credentials and secret management;
• backup and recovery procedures; and
• payment processing through Stripe rather than storing complete card data ourselves.

No internet transmission or storage system is completely secure. We therefore cannot guarantee absolute security. You are responsible for protecting access to your email account and should contact support@sybora.app promptly if you suspect unauthorised use of your Sybora account or a sign-in message that you did not request.

If a Personal Data breach occurs, we will assess it and notify affected individuals and authorities where required by applicable law.

12. International Data Transfers

Sybora and its service providers may process Personal Data in countries other than the country where you live. Those countries may apply different data-protection laws.

Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country not recognised as providing an adequate level of protection, we will use a legally recognised transfer mechanism where required, such as:

• the European Commission’s Standard Contractual Clauses;
• the UK International Data Transfer Addendum or International Data Transfer Agreement;
• an applicable adequacy decision; or
• another valid safeguard recognised by data-protection law.

We also seek appropriate contractual and security commitments from processors that handle Personal Data on our behalf.

13. Your Privacy Rights

Rights differ depending on where you live. We may need to verify your identity before completing a request. Authorised agents may submit requests where local law permits, subject to proof of authority and identity verification.

To exercise a privacy right, contact support@sybora.app. We will respond within the timeframe required by applicable law.

13.1 EEA, UK, and Swiss Users

Subject to applicable conditions and exceptions, you may have the right to:

• access Personal Data we hold about you;
• correct inaccurate or incomplete data;
• request deletion of your data;
• restrict certain processing;
• receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent without affecting earlier lawful processing;
• obtain information about international transfer safeguards; and
• lodge a complaint with your local data-protection authority.

Where legally required, we will normally respond to a GDPR or UK GDPR request within one month. That period may be extended by up to two additional months for a complex request, and we will inform you if an extension is needed.

If you are in the EEA, you can find your supervisory authority through the European Data Protection Board. UK users may contact the Information Commissioner’s Office. Hungarian users may contact the Hungarian National Authority for Data Protection and Freedom of Information.

13.2 United States Residents

Depending on your state and whether the relevant law applies to Sybora, you may have rights to:

• know whether we process your Personal Data;
• access categories or specific pieces of Personal Data;
• correct inaccurate Personal Data;
• request deletion;
• obtain a portable copy of certain data;
• opt out of the sale of Personal Data, targeted advertising, or qualifying profiling; and
• appeal a refusal to act on a request.

Sybora does not sell Personal Data for money. If we later engage in activity considered “selling,” “sharing,” or targeted advertising under applicable US state law, we will provide the notices and opt-out mechanisms required by that law.

We will not unlawfully discriminate against you for exercising an applicable privacy right. California residents may also have rights under the CCPA/CPRA, subject to statutory thresholds and exemptions.

13.3 Australian Users

Where the Australian Privacy Act 1988 and Australian Privacy Principles apply, you may request access to or correction of Personal Data we hold about you and may submit a privacy complaint to us. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

13.4 Other Locations

You may have additional rights under the privacy laws of your country or region. Contact us and we will assess your request under the applicable law.

14. Automated Decision-Making

Sybora does not currently make decisions based solely on automated processing that produce legal or similarly significant effects for users.

Stripe and security providers may use automated risk signals to identify suspected fraud or abuse. Their own privacy notices describe any processing for which they act independently. If Sybora introduces qualifying automated decision-making, we will provide the notices and safeguards required by law.

15. Children’s Privacy

The Services are not directed to children under 16, and we do not knowingly collect Personal Data from children under 16. If you are under 16, do not create an account or submit Personal Data to the Services.

If we learn that we have collected Personal Data from a child in violation of applicable law, we will take reasonable steps to delete it. A parent or guardian who believes a child has provided Personal Data may contact support@sybora.app.

16. Service Providers and Sub-Processors

We rely on third parties to operate and improve the Services. The providers actually used in production may include:

Providers and features can change as the Services develop. We will update this Privacy Policy or a separate sub-processor list when a material change requires notice.

17. Third-Party Services and Links

The Services may contain links to, import content from, or interact with third-party websites and platforms. Their privacy practices are governed by their own notices, not this Privacy Policy. We are not responsible for third-party services that we do not own or control.

When importing or using third-party content, you must comply with the relevant platform terms, copyright rules, privacy rights, and other applicable laws.

18. Account and Data Deletion

You may delete individual projects and files through the available product controls. You may permanently delete your account using the “Delete account” button at the bottom of the Subscription page. You may also contact support@sybora.app from the email address associated with your account if you need assistance with a deletion request.

Account deletion is immediate and irreversible in Sybora’s active systems. It cancels any active subscription and deletes the user account, projects, files, and related application database records. Deleted content cannot be restored through Sybora.

Any remaining extra-credit balance is also deleted when the account is permanently deleted. Cancelling a subscription without deleting the account does not delete separately purchased extra credits.

This does not require independent controllers such as Stripe to erase transaction or billing records that they must retain under applicable law. Limited information may also remain temporarily in processor-managed backups, security logs, or records that Sybora must retain for tax, accounting, fraud prevention, dispute resolution, or legal claims. Such information is not kept for ordinary product use and is deleted or anonymised when the applicable obligation or retention cycle ends.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, technology, providers, or legal requirements. We will post the updated version on this page and revise the “Last updated” date.

If a change materially affects your rights or the way we use Personal Data, we will provide additional notice where required, such as through the Services or by email.

20. Contact Us

For privacy questions, complaints, or rights requests, contact:

Sybora App
Email: support@sybora.app
Website: https://sybora.app

Please use the subject line “Privacy Request” and include enough information for us to identify your account and understand the request. Do not send authentication tokens, complete payment-card details, or other unnecessary sensitive information by email.