Legal · last updated 2026-08-27

Privacy
policy

Sria Digital B.V. is the controller for personal data processed through yspot.co. This page says what we hold, why, and how to make us delete it.

What we collect

• Account data — email address, a display name, and authentication identifiers.
• Generation data — your prompts, the options you tap, and the images and videos produced.
• Billing data — credit balance, purchase history, and a payment-provider reference. Card numbers are handled by the payment provider and never reach our servers.
• Technical data — IP address, browser and device type, and timestamps, used for security, abuse prevention and rate limiting.
• Analytics — anonymised usage statistics via Google Analytics 4, and only after you accept analytics cookies. Decline and no analytics cookie is set. We also use Ahrefs Web Analytics, which is cookieless: it counts page views without storing anything on your device and without identifying you, so it runs whether or not you accept cookies.
• Contact form — whatever you type into it, plus your email address, handled through Netlify Forms and forwarded to hello@yspot.co. The form is protected by Google reCAPTCHA, which checks your browser and your interaction with the page to tell a person from a script. Google receives your IP address and that signal for this purpose; see Google's privacy policy and terms. It runs on the contact page only, and nowhere else on the site.

Why we are allowed to

• Performance of a contract — running your account, generating what you ask for, and taking payment.
• Legitimate interest — keeping the service secure, preventing fraud and abuse, and enforcing the Content policy.
• Consent — analytics cookies, and any marketing email. Withdrawable at any time.
• Legal obligation — tax records, and responding to lawful requests.

How long we keep it

• Account data: while the account exists, then deleted within 30 days of a deletion request.
• Generated images and videos: until you delete them, or 30 days after account deletion.
• Prompts and moderation logs: 12 months, for abuse investigation and legal defence.
• Billing records: 7 years, as Dutch tax law requires.
• Contact form submissions: 24 months.

Who else sees it

Processors acting on our instructions only: our hosting and forms provider (Netlify), our GPU compute and storage providers, our payment provider, our email provider, Google Analytics, Google reCAPTCHA and Ahrefs Web Analytics. Some of these are outside the EEA; those transfers rely on the European Commission's Standard Contractual Clauses. We do not sell personal data, and we do not share it with advertisers.

Cookies

Strictly necessary cookies keep you logged in and remember that you passed the age gate; these are set without consent because the service cannot work without them. Analytics cookies are set only after you press Allow on the banner. Google Consent Mode is configured to deny everything until you do.

Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Email hello@yspot.co from the address on the account and we answer within one month. You can also complain to the Dutch DPA (Autoriteit Persoonsgegevens).

Security

Transport is encrypted end to end. Generated media is stored in access-controlled object storage. Access to production data is limited to the people who need it. No system is perfect; if a breach affects you we notify you and the regulator as the GDPR requires.

Children

The service is strictly 18+. We do not knowingly process the data of minors. If you believe a minor has an account, write to hello@yspot.co and we will remove it.

Contact