Privacy Policy

1. Who we are (data controller)

Paper Tiger App is operated by Irina Ibragimova, a sole trader based in the United Kingdom, who is the data controller for your personal data.

Contact for privacy matters: hello@papertiger.app. Postal address: Paper Tiger App, Suite 655, 80A Ruskin Ave, Welling, DA16 3QQ, United Kingdom.

2. What data we collect

Account data: your email address, authentication details (your password is hashed by our authentication provider; we never see it), your sign-in method (e.g. Google), and an optional avatar.

Content you provide: photos you upload, character descriptions, video ideas and scripts, and the characters and videos you generate.

Payment data: handled by Stripe. We receive limited billing information (such as your plan, subscription status, and customer/subscription identifiers). We do not store your full card details.

Usage and technical data: your IP address, browser/device information, the pages and actions you take, and logs. A device fingerprint (via FingerprintJS) used solely to prevent abuse of free trials (fraud prevention).

Cookies and similar technologies: see our Cookie Policy.

3. How and why we use your data

To provide the Service — create characters, scripts and videos, and manage your account (lawful basis: performance of our contract with you).

To process payments and manage subscriptions and credits (lawful basis: contract, and legal obligation for financial records).

To prevent fraud and abuse and enforce the one-per-person free-trial limit, using your IP address, an anonymous cookie and a device fingerprint (lawful basis: our legitimate interests in protecting the Service from fraud and abuse; the device fingerprint is used strictly for this fraud-prevention purpose and not for analytics).

To secure, maintain, troubleshoot and improve the Service (lawful basis: our legitimate interests).

To understand website traffic and how the Service is used, via Google Analytics — only if you accept non-essential cookies (lawful basis: consent). You can withdraw consent at any time via the cookie settings.

To send you service messages about your account or generations (lawful basis: contract). We only send marketing if you have opted in (lawful basis: consent), and you can opt out at any time.

To comply with legal obligations, such as tax and accounting (lawful basis: legal obligation).

4. AI processing of your content

To generate your outputs, the content you submit — including uploaded photos, character descriptions and prompts — is sent to third-party AI providers (see “Who we share your data with”). This means your content is processed on their infrastructure, which may be located outside the United Kingdom. Please do not upload photos of other people without their consent, or any sensitive personal data you do not want processed this way.

5. Who we share your data with

We use the following service providers (processors / sub-processors), who act on our instructions:

• Supabase — database, authentication and file storage (data hosted in the EU, Germany).
• Vercel — application hosting and content delivery.
• Google (Gemini API) — AI generation of character descriptions, scripts and images (United States).
• BytePlus / ByteDance — AI video generation. Your character image and prompt are sent to this provider to produce your video. ByteDance is an international group; processing may take place outside the UK.
• Stripe — payment processing.
• FingerprintJS — device-fingerprint signal used strictly for fraud prevention (enforcing the one-per-person free trial).
• Google Analytics — website traffic analytics (only loaded with your consent); processes data in the United States.

We do not sell your personal data. We share only what is necessary for each provider to perform its function. We may also disclose data where required by law.

6. International transfers

Some of our providers are located outside the United Kingdom (for example, in the United States, and the ByteDance group internationally). Where we transfer personal data outside the UK, we rely on appropriate safeguards, such as UK ‘adequacy’ regulations or the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses).

7. How long we keep your data

We keep your account and content data while your account is active and for as long as needed to provide the Service. We keep payment and transaction records for as long as the law requires (UK tax records are generally kept for around six years). Anti-abuse logs are kept for a limited period. When you delete your account, we delete or anonymise your personal data except where we must keep it by law.

8. Your rights

Under UK data protection law you have the right to: access your data; have it corrected; have it erased; restrict or object to its processing; data portability; and to withdraw consent at any time (for example, for analytics cookies) without affecting processing already carried out. You can also object to our legitimate-interest processing, such as the fraud-prevention device check.

To exercise any of these, email hello@papertiger.app. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Security

We use reputable providers and reasonable technical and organisational measures to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the ICO of any breach where required.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a new “last updated” date and, where appropriate, notified to you.

12. Contact

Data controller: Irina Ibragimova (sole trader, United Kingdom), trading as Paper Tiger App. Address: Paper Tiger App, Suite 655, 80A Ruskin Ave, Welling, DA16 3QQ, United Kingdom. Email: hello@papertiger.app. Supervisory authority: the ICO (ico.org.uk).