Privacy Policy

cuil.si is run by Lokaverse World Private Limited, 149-150, Tower 5, RPS 12th Avenue, Faridabad, Haryana 121003, India. We decide how and why your personal data is used, so under India's Digital Personal Data Protection Act we are the “Data Fiduciary” for it. Our contact details and our Grievance Officer are listed below and on our Contact page.

• Account details: your name, email address, password (stored only in a scrambled form that can't be turned back into your password), profile photo, and your workspaces, team members and their roles. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Things you upload: images, videos, audio, documents, brand kits, logos and character reference photos.
• Things you create: prompts, posts, images, videos, films, voice-overs, captions, automations and the settings you choose for them.
• Connected social and ad accounts: the access keys (tokens) those services give us, stored encrypted, plus basic account details such as a page or channel name. Section 6 lists what we read from each one.
• Payments: what you bought, the amount, the payment status and invoice details. Never your full card number. See section 4.
• Usage and credits: what you created, when, which quality setting you chose and how many credits it cost, plus basic technical logs (IP address, browser type, errors) that keep cuil.si secure and working.
• Sign-ins: each time you sign in, we record the time, how you signed in, your IP address and your browser. Section 10 says how long we keep this.
• Developer tools: API key names and when they were last used (we keep only a scrambled form of the key itself) and the webhook addresses you add.
• Messages to us: what you write when you email support, and our replies.

• To run cuil.si: create what you ask for, save it to your Library, publish and schedule your posts, and run your automations and ads.
• To take payments, add credits and plans to your workspace, and make invoices.
• To keep your account and workspace secure, prevent fraud and abuse, and fix problems.
• To count credits and show you what things cost before they start.
• To send service emails, such as email confirmation and password reset links, invitations, and plan and credit reminders, and the emails your automations send to the addresses you choose.
• To improve cuil.si, using usage patterns and the feedback you give us.
• To meet our legal duties, for example tax records and lawful requests from authorities.

We use your data because you asked for the service and agreed to this policy when you signed up, because the law requires it (for example tax records), or for other uses the law allows, such as keeping the service secure. You can withdraw your agreement at any time by deleting your account (section 12).

We don't sell your personal data, and we don't use your content to advertise to you or to anyone else.

• When you buy credits or a plan, you pay on the secure payment page of NTT DATA Payment Services India (“NTT DATA Pay”: UPI, cards and netbanking, in Indian rupees).
• International card payments in US dollars through Stripe will be added later. When they are, you'll pay those on Stripe's secure page, and this section applies to Stripe too.
• You enter your card, UPI or bank details on the payment company's page, not on cuil.si. We never see or store your full card number, CVV, UPI PIN or netbanking password.
• What we keep: what you bought, the amount and currency, the payment status, the order and transaction IDs the payment company gives us, the date, and the invoice details (invoice number, workspace name and the owner's email address).
• NTT DATA Pay needs your email address and mobile number to process a payment. We pass them on for that payment and don't keep your mobile number.
• The payment companies handle your payment details under their own privacy policies and the rules of the Reserve Bank of India and the card networks. Refunds go back through the same company; see our Refund & Cancellation Policy.

To create images, videos, voices, text and transcripts, cuil.si sends your prompt and any media you choose (for example a product photo or a reference video) to AI service providers. They process it to produce the result and send it back to us.

• DeepInfra is our main AI provider. It writes all the text and makes many of the images, videos, voices and transcripts. DeepInfra says it holds what we send only in memory while it makes the result and deletes it afterwards, doesn't keep the content of requests in its logs, and doesn't use it to train models. Pictures and videos it makes may be kept for a short time so we can download them. DeepInfra's exceptions are for Google and Anthropic models, which cuil.si doesn't use there. See DeepInfra's data privacy page.
• fal, Replicate and ElevenLabs make some of the images, videos and voices: we choose them for you at the higher quality levels (Premium pictures, videos and voices, and Standard videos). Each has its own terms on how long it keeps data and how it uses it.
• Google makes our Premium pictures: that model (Nano Banana Pro) is Google's, so fal passes your prompt and any pictures you add (such as a product or a face) on to Google to make the image.

Please don't put information into a prompt that you wouldn't want a service provider to process, such as passwords, health or payment details.

You decide which accounts to connect. We ask each network only for what we need to publish for you and to show how your posts and campaigns are doing. We don't read your private messages or your followers' personal details. When you connect:

• Facebook Pages: we receive the Pages you manage, with their names and pictures. We publish the posts you choose, and read the number of likes, comments, shares, views, reach and clicks of posts published through cuil.si.
• Instagram (professional accounts linked to a Facebook Page): we receive the account's username, name and picture. We publish the photos, carousels and Reels you choose, and read the number of likes, comments, shares, saves and views, and the reach, of posts published through cuil.si.
• LinkedIn: we receive your name, email address and profile picture. We post what you choose on your behalf and, where LinkedIn allows it, read the number of views, reactions, comments and reshares of those posts, and how many people saw them.
• YouTube: we receive your channel's name, handle and picture. We upload the videos you choose to your channel, with the title and settings you pick, and read the number of views, likes and comments of those videos. Section 7 explains more.
• X (Twitter): we receive your username, name and picture. We post what you choose, with pictures or videos, and read the number of likes, reposts, replies, bookmarks and views of those posts.
• TikTok: we receive your basic profile (your display name and picture). We also ask for permission to post the videos you send from cuil.si and to read your videos' numbers. Before each post we check your TikTok posting options (who can see your videos, whether comments, Duets and Stitches are on, and how long a video can be). We read the number of views, likes, comments and shares of public videos posted through cuil.si.
• Ad accounts (Meta and Google Ads): we receive the ad accounts you can use. We create, change and pause the campaigns you set up in cuil.si, within the spending limits you choose, and read their results (spend, reach, clicks and similar numbers). To explain our suggestions in plain words, we may send campaign names, ad headlines and numbers such as spend and clicks (not your personal details) to DeepInfra, our AI provider (section 5).

We publish only what you or your team ask us to, yourselves or through your automations, API keys and AI assistants. Two networks have extra rules:

• TikTok: cuil.si posts to TikTok only when you or a teammate presses Post or Schedule in cuil.si. Before that you choose who can see the video, whether others can comment, Duet or Stitch, whether it promotes a brand, and whether it's AI-generated. Automations, API keys and AI assistants can't post to TikTok; an automation set up earlier skips TikTok and still posts to its other accounts. Until TikTok reviews cuil.si, TikTok videos are posted as private (Only me).
• YouTube: you make the choices for each video yourself (section 7). Automations use the YouTube choices you set in their “Publish a post” step, and skip YouTube until you set them. AI assistants and apps that use your API keys must pass your choices. When you turn on an automation that posts to YouTube, or let an AI assistant or your own app post there, you agree that it uploads videos to your channel with those choices. You can turn the automation off, change its choices or revoke the API key at any time.

You can disconnect an account at any time in Settings › Social accounts (ad accounts: Ads › Ad settings, after pausing their running campaigns). Anything still scheduled for it is cancelled. For Facebook, Instagram, LinkedIn, X, TikTok and Meta ad accounts, disconnecting deletes that account's access keys (tokens) at once, and cuil.si stops using that account. Some accounts share one key: an Instagram account linked to a Facebook Page uses the Page's key, and Meta ad accounts connected with one Facebook sign-in share one key. A shared key is deleted once every account that uses it is disconnected. Page or account names, pictures and post results we saved stay with your posts, so you can see their history, until you ask us to delete them or delete your account. Disconnecting doesn't remove cuil.si from your account on the network itself: to do that, use that network's app settings. Our Data Deletion Instructions show how. YouTube and Google Ads work differently: see section 7.

Google sign-in

If you sign in with Google, we receive your name, email address and profile picture. We use them for your cuil.si account: to sign you in, show your name and photo to your team, send you service emails and, when you pay for a workspace, put your email address on the invoice.

YouTube

cuil.si uses YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy.

• What we ask for: connecting YouTube asks Google only for permission to upload videos to your channel and to see your YouTube account (the channel's name and picture and your videos' statistics). We don't ask for your Google name, email or profile picture when you connect YouTube.
• Uploads: you choose each YouTube video's title, who can see it (Public, Unlisted or Private), whether it's made for kids, and whether it contains realistic AI-made content. cuil.si sends the title and description to YouTube exactly as they are in your post, whether you wrote them or an AI step you set up did, and never adds to or changes them. If you don't write a title, the first line of the post is used. New videos go in YouTube's People & Blogs category; you can change that in YouTube Studio. Until Google reviews cuil.si, YouTube uploads are private.
• Who sees it: the people in the workspace you connect the channel to can see its name and picture and your videos' links and numbers. By connecting it there, you let them see it. If you set up webhooks, automations, API keys or AI assistants, they get the channel's name and your videos' links, and apps that use your API keys can also read the numbers. That happens only because you set them up, and what they do with it is up to you. We don't share data from YouTube with anyone else, except the service providers in section 8 that store it for us, or when the law requires it.
• Numbers: for YouTube we show only the numbers YouTube gives (views, likes, comments) and their simple totals for each channel. YouTube totals are shown per channel: we never add up numbers from different channels, even in the same workspace. We don't work out new numbers from YouTube data or combine it with other networks' numbers. Engagements and engagement rate are worked out by cuil.si for the other networks only, and wherever they appear next to YouTube numbers we say they aren't from YouTube.
• Keeping it up to date: we check every day that cuil.si can still reach each YouTube channel, and refresh its name and picture. We re-read each video's numbers at least every 20 days. If YouTube's limits stop us reading them for a while, we keep them marked as not updated. If we couldn't re-read a video's numbers for 30 days, we delete them and their history, and we do the same when YouTube says a video is deleted or hidden. If we can't confirm access to a channel for 30 days, we disconnect it and delete its YouTube data. Channel names and video links copied into webhook messages about YouTube posts, and into the automation runs those posts started, are removed within 30 days, even while the channel stays connected.
• Disconnecting a channel: when you disconnect a YouTube channel in cuil.si, we immediately ask Google to cancel cuil.si's access. We delete what we got from YouTube for that channel: its name, handle, picture and ID, and your videos' YouTube IDs, links and numbers (views, likes, comments) with their history. We also remove the channel name and video links from our log of webhook messages about those posts and from the automation runs those posts started, including what each step used and made. Your posts stay in cuil.si. If Google can't be reached, we keep trying for up to 7 days (we keep the access key, encrypted and unused, only for this).
• Your videos stay on YouTube. Deleting this data in cuil.si doesn't change anything on YouTube. To delete your videos, use YouTube.
• When Google access stays on: if the same channel is still connected in another cuil.si workspace, or another channel from the same Google sign-in is still connected, Google access stays on until the last of those is disconnected. The disconnected channel's YouTube data is still deleted right away. To cancel cuil.si's Google access everywhere at once, remove cuil.si on the Google security settings page.
• Google Ads on the same Google account: if you connected YouTube and Google Ads with the same Google account, disconnecting YouTube can also cancel that Google Ads connection. The next time cuil.si uses that Google Ads account, it asks you to reconnect it.
• Removing cuil.si at Google: you can also remove cuil.si on the Google security settings page. If you do, we usually notice within a day and ask you to reconnect. If you don't reconnect within 7 days, we delete that channel's YouTube data, always within 30 days of your removing cuil.si.
• Finding this policy: our Privacy Policy and Data Deletion Instructions are linked from the menus inside cuil.si (the side menu, and Help and policies in your account menu) and from the YouTube card in Settings › Social accounts.

Google Ads

Connecting Google Ads asks only for permission to manage your Google Ads accounts. We use it only to create, change, pause, report on and suggest improvements to the campaigns you set up in cuil.si. To explain our suggestions in plain words, we may send campaign names, ad headlines and numbers (such as spend and clicks, not your personal details) to DeepInfra, our AI provider (section 5). Disconnecting a Google Ads account also cancels cuil.si's access at Google, unless another connection still uses the same Google access: another Google Ads account from the same Google sign-in, the same Google Ads account in another workspace, or a YouTube channel you connected through the same Google app. If someone else connected a YouTube channel with the same Google account, disconnecting Google Ads can stop that channel too: it then needs reconnecting within 7 days, or its YouTube data is deleted. If Google can't be reached, we keep trying for up to 7 days (we keep the access key, encrypted and unused, only for this).

How we treat data from Google

• Limited Use: cuil.si's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• We don't sell Google user data, don't use it for advertising, and don't use it to develop, improve or train general AI or machine learning models. People at cuil.si don't look at it unless you ask us to (for example for support), it's needed for security, or the law requires it.
• To remove access: disconnect the account in cuil.si, or remove cuil.si on the Google security settings page. To delete the rest of your data, see section 12. Data we got from YouTube is deleted within 7 days of your request; disconnecting the channel in cuil.si deletes it at once. This doesn't affect your videos or data on YouTube; to delete those, use YouTube.

• Your team: people in your workspace can see its content, according to their role.
• Service providers who help us run cuil.si, only for that purpose: Amazon Web Services (servers, file storage and email), the AI providers above, NTT DATA Pay (payments; Stripe too, once international card payments are added), Google (sign-in, our support mailbox, and Premium pictures through fal), and Cloudflare (points our web address to our servers and, if we switch it on, also delivers our website and protects it from attacks).
• Social networks and ad platforms you connect, when you publish or advertise there. What you publish is then public or shared according to that network's settings.
• Your own apps that you connect with an API key or webhook.
• Authorities, only when the law requires it or to protect people from harm.
• A new owner, if cuil.si or our company is sold or merged. We'll tell you before your data moves, and this policy will keep applying to it. Data we got from Google (Google sign-in, YouTube and Google Ads) moves to a new owner only if you clearly agree to it first.

The live service stores your account, content and files on servers run by Amazon Web Services (AWS) in its Mumbai region, India. Some service providers, such as Cloudflare, the AI providers, Google and the social networks (and Stripe, once it's added), may process data in other countries (for example the United States). We only send data abroad where Indian law allows it, and only what the provider needs to do its job.

• Your account and content: while your account is open. You can delete files from your Library at any time, and a workspace you own in Settings › Team.
• Social and ad account access keys (tokens): deleted as soon as you disconnect the account, with two exceptions. A key that several accounts share (an Instagram account and its Facebook Page, ad accounts from one Facebook or Google sign-in, or YouTube channels from one Google sign-in) is deleted once all of them are disconnected. And if Google can't be reached when you disconnect YouTube or Google Ads, we keep that key, encrypted and unused, for up to 7 days, only to ask Google again to cancel it.
• Data from YouTube: deleted as soon as you disconnect the channel, or within 7 days if you ask us. While the channel is connected, a video's numbers and their history are deleted if we couldn't re-read them for 30 days, and channel names and video links copied into webhook messages about YouTube posts and into the automation runs those posts started are removed within 30 days (section 7).
• Other networks' data: page or account names, pictures and post results stay with your posts, so you can see their history, until you ask us to delete them or delete your account (section 6).
• When you delete your account: you can delete it yourself in Settings › Profile › Delete my account, or email us. It stops working straight away, and we delete your data within minutes, always within 30 days (data we got from YouTube within 7 days), except the records below. That includes your profile (name, email, password, photo and Google sign-in link) and the workspaces only you use, with everything in them: files, posts and their results, brand kits, characters, films, automations, webhooks, credit history, and the access keys for the social and ad accounts connected there. In someone else's workspace you just leave: what you made there stays with that workspace, without your name, but the social and ad accounts you connected there with your own sign-in are disconnected (the people there can connect them again with theirs). For every YouTube and Google Ads account disconnected this way we also ask Google to cancel cuil.si's access, and we delete what we got from YouTube. Unused credits and paid plan time in the deleted workspaces end with them.
• Payment records and invoices: kept for 8 years from the end of the financial year (April to March) in which you paid, as the Companies Act, 2013 and GST law require, also after you delete your account. We keep only what the invoice needs: its number and date, what you bought, the amount, the payment references, and the name and email address it was billed to. If a tax case about a payment is still open, we keep it until the case is closed.
• Sign-in records: when you sign in, we record the time, your IP address and your browser. We keep these records for 180 days, as India's CERT-In rules require, then delete them. If you delete your account, they're no longer linked to you, and they're still deleted at 180 days.
• Other technical logs (such as errors): kept only as long as needed to keep the service secure and as Indian law requires, then deleted.
• Backups: deleted data, including deleted files, can stay in our encrypted backups for about 30 days. We use backups only to recover from a failure or a mistake; if we ever restore one, we delete your data again.

We use only the cookies cuil.si needs to work:

• a sign-in cookie that keeps you logged in (up to 30 days, or until you log out);
• a short cookie during Google sign-in (10 minutes) that protects the sign-in from tampering;
• a cookie that remembers whether you keep the app's side menu open.

We also keep a few small settings in your browser's storage, such as the workspace you used last. We don't use advertising cookies, tracking pixels or third-party analytics. When you pay, NTT DATA Pay's payment page (or Stripe's, once it's added) may use its own cookies to process the payment and prevent fraud. If we switch on Cloudflare's protection for our website, it may set a short security cookie to tell people from automated traffic. If we ever add analytics or advertising cookies, we'll ask you first.

You can:

• see and update your profile in Settings;
• ask for a summary of the personal data we hold about you and who we shared it with;
• ask us to correct, complete or update it;
• delete your whole account yourself in Settings › Profile, or ask us to delete your data (see our Data Deletion Instructions);
• withdraw your agreement to a use of your data, or ask us to stop it;
• name another person to use these rights for you if you die or can't act yourself;
• complain to our Grievance Officer (section 15).

You can delete your whole account yourself in Settings › Profile › Delete my account. It takes effect at once and your data is gone within minutes. For anything else, or if you can't sign in, email support@cuil.si from the address you signed up with, so we know the request is really from you. Most requests are done within 15 days, and we delete a whole account within 30 days. Data we got from YouTube is deleted within 7 days of your request. If you're not happy with our answer, you can complain to the Data Protection Board of India. If you live outside India, you may also have rights under your local law (for example the GDPR in the European Union), including complaining to your local data protection authority.

We store passwords only in scrambled form, encrypt social and ad account access keys and webhook secrets, keep your files in private storage with links that expire, use encrypted connections (HTTPS), and limit who on our team can reach our live systems. No system is perfectly secure, so please use a strong, unique password. If a data breach affects you, we'll tell you and the authorities as the law requires.

cuil.si is for people aged 18 or over, and for businesses. We don't knowingly collect personal data of children (people under 18). If you think a child has given us personal data, email support@cuil.si and we'll delete it.

Under the Information Technology Act, 2000 and its rules, the Digital Personal Data Protection Act, 2023 and the Consumer Protection (E-Commerce) Rules, 2020, you can write to our Grievance Officer about how we handle your data, about content on cuil.si you think breaks the law, or about any other complaint:

We may update this policy as cuil.si grows. The date at the top shows the latest version. If we make a big change, we'll tell you in the app or by email before it applies. If a change affects how we use data we get from Google (Google sign-in, YouTube or Google Ads), we'll ask you to agree in cuil.si before we use that data in the new way.

Lokaverse World Private Limited, 149-150, Tower 5, RPS 12th Avenue, Faridabad, Haryana 121003, India. Email support@cuil.si. More ways to reach us are on our Contact page.