Privacy Policy

Version 2026-10-22-draft-5 · 22 October 2026

1. Responsible organisation

ESOTECH LTD determines the purposes and means of personal-information processing under its control for Pupivio. Contact hello@1stdo.com for privacy questions, requests or complaints. This policy concerns Pupivio, not the different data flows of another ESOTECH product.

This is a development-review notice. The registered office, establishment details, any required representatives and final production processor/region schedule must be verified before publication. We do not claim that a public policy alone makes a service compliant.

2. The local and online boundary

Your photo library is not uploaded as a whole. The system picker gives the app access to items you choose. Copies used for local editing and finished local exports are held in private app storage, excluded from automatic cloud backup by the current implementation. Files separately saved to Photos, shared elsewhere, or included in device-level services follow the settings of those services.

Cloud generation is a separate action. It can send the selected pet reference, prompt, project instructions and output settings to our server and the named AI provider. A clip containing a person can still be personal information even if the pet is the subject. Blurring a face does not guarantee anonymity.

3. Accounts, age and sign-in

Where account sign-in is enabled, we process a stable account identifier, provider identity assertions, session/security records, acceptance versions and any email address or other limited fields required by the chosen sign-in method. Apple and Google handle their own sign-in pages; we do not receive their passwords. Apple relay email is handled as a sign-in attribute, not proof that two accounts should be linked.

Pupivio is for adults aged 18 or older. We do not knowingly offer accounts to children or invite children to upload their information. Contact us if a child’s information was provided improperly so we can investigate and take appropriate action. An age attestation is not a representation that we verify everyone’s date of birth.

4. Projects and selected media

Our server can hold the pet profile and life stage you enter, film titles, story ideas, confirmed facts, shot decisions, settings, job records and the particular media you explicitly upload. Pet information can become personal information when linked to an owner, household or location.

For cloud photo input, the app creates a JPEG copy and the server validates/re-encodes supported images to reduce embedded metadata. This does not remove identifying details visible in the image. Human face detection runs locally as a warning aid; detection can miss people and does not establish consent. We do not create a face-recognition identity database or human voiceprint.

Generated result links and recovery

For newly generated video results, the current implementation stores an account-linked task identifier, provider task identifier, status, charge or pass allocation, result URL and expiry metadata. The result URL can function as a temporary bearer link: someone who obtains it may be able to view the video until the provider expires or revokes it. We return it only after account authorization and exclude it from application request logs and monitoring labels.

The API server does not archive generated video bytes. Opening a completed scene downloads a private account-scoped copy on that iPhone, excluded from automatic app-data backup; it can remain playable after the temporary provider link expires. A separately saved copy in Photos or Files follows that destination’s settings. Another device does not automatically receive this local copy. If you never open or save a result before its link expires, the task record alone cannot recover the video. The provider CDN receives network information needed to serve the requested result. Provider retention and deletion follow the applicable provider agreement.

The device saves approved submission identifiers to recover a request after interruption. These records do not contain the provider API key, access token, prompt or video. They are separated by endpoint and account and excluded from automatic app-data backup. The server remains the source of truth for task status and balances.

5. Device permissions

Photos selection is limited to your chosen items. Saving a film requests the appropriate add-to-Photos permission. Camera and microphone permissions are requested when you use capture; you can decline and use existing media instead. Opening the app does not begin continuous recording.

Change permissions in iOS Settings. Withdrawing a device permission stops future permitted access through that permission but does not automatically erase files or requests already processed. The app does not require access to your contacts, health records or precise location for pet-film creation.

6. AI providers and meaningful choices

Online creation is a separate choice from local editing. Before sending media, the app explains which material is sent and the possible processing destinations, and offers Privacy Policy details naming the processors. AI generation is unavailable when its processing mode has not been enabled. Photos are not sent for a text-only writing request.

This internal TestFlight release uses Seedance in mainland China as the primary video processor, with Kling in Singapore as a backup for newly quoted requests when the primary is unavailable. Only your selected pet-only reference and scene instructions are sent. Review the named service and destination before approving each generation. Do not continue if you do not want the selected material processed there. Public launch in another jurisdiction requires separate provider and transfer qualification.

Optional writing and polishing use DeepSeek through OpenRouter. After your separate writing confirmation, we send the scene text, story context, pet species, age group and chosen language through OpenRouter to a DeepSeek-model inference provider. We do not include account identifiers, purchase records, photos or video in this writing payload. Avoid personal information in story text. The server requests providers that disallow data collection under OpenRouter routing controls; this setting is not a promise of zero retention or of processing in a particular country. Processing can take place outside your country, including China. Provider and transfer qualification must be completed before public launch.

We do not use your private originals to train our own general-purpose AI models. An external provider’s retention, human review, training options and deletion mechanisms depend on its applicable agreement and settings; we do not promise zero retention or no training for an unverified provider. Do not upload sensitive human material where the required authority and safeguards are absent.

7. Community and sharing

The current app has no public community publishing interface. Your projects start private. Sharing or saving through iOS sends only the item and destination you choose. A future community feature would require separate visibility, rights, moderation and privacy controls before it is enabled.

Unlisted links can be forwarded. Public posts can be copied outside our service. Deleting a post or blocking an account cannot retrieve every external copy. Sharing through the iOS share sheet sends the selected item to the destination you choose and subjects it to that destination’s policies.

8. Purchases and service credits

Apple handles App Store payment details. We do not need your full card number. The service processes the identifiers, signed transaction or entitlement information, product, renewal/refund state and credit-ledger entries needed to verify purchases, provide benefits and prevent duplicate grants. RevenueCat, if configured for the relevant release, supports entitlement/billing operations under the published processor schedule.

Credits, actual model usage and internal cost records are used to settle jobs, enforce budgets and investigate billing issues. They are not an advertising profile. A refund or renewal event must be authenticated before it changes an entitlement or balance.

9. Purposes and legal bases

Where a legal basis is required, account services, requested editing/generation, project storage and delivering paid benefits generally rely on performing the contract or steps you request. Reasonably necessary security, abuse prevention and proportionate service diagnostics can rely on legitimate interests after considering your rights. Statutory recordkeeping and responding to binding lawful requests can rely on legal obligations.

Optional analytics, marketing, permissions and sensitive processing require the choice or consent applicable to that feature and law. Accepting User Terms is not consent to unrelated advertising, model training or public sharing. Where consent is the basis, you can withdraw it without affecting the lawfulness of earlier processing.

10. Recipients and international processing

Service recipients currently include AWS for hosting and account infrastructure, Apple and Google for the sign-in method you choose, Apple and RevenueCat for purchase verification, Seedance and Kling for approved video requests, and OpenRouter with DeepSeek-model inference providers for approved writing requests. Access is limited to the function needed. The current internal video configuration can process in China or Singapore; text routing does not impose an EU-only location. Final production contracts, provider list and transfer safeguards require verification before public launch.

Where processing crosses borders, we must assess the applicable transfer restrictions and use a valid mechanism and additional safeguards where required. A customer clicking a generation button is not, by itself, a substitute for those safeguards. Ask us about the safeguards relevant to processing under our control. Independently controlled providers and destinations explain their own handling in their notices.

11. Diagnostics, security and observability

Service diagnostics should use request/job identifiers, fixed route names, timestamps, status, latency, queue depth, aggregate token/cost counts and security-event categories. Routine logs are not intended to contain provider keys, passwords, identity tokens, authorisation codes, request bodies, raw prompts, media or signed download URLs. Access to logs and operations tools is restricted.

We apply appropriate transport protection, session controls, file validation, ownership checks, spending limits and other safeguards. No security method is absolute. If a breach under our responsibility meets an applicable notification threshold, we will notify the appropriate authority and affected people as required.

12. Retention and deletion

Local sources and films remain until you delete them, remove app data, or device cleanup applies. Server projects and selected uploads remain while needed for your requested service, unless you delete them earlier. Job and accounting records are retained as necessary to resolve processing and billing, meet legal requirements or establish legal claims. A legal hold is limited to the records and period needed.

Our production retention schedule must specify the configured lifetimes of logs, pending authorisation records, media, backups and billing records before launch. We do not invent a deletion deadline that the deployed systems cannot meet. Backups and independently held provider copies may be subject to separate documented deletion cycles.

Requesting account deletion immediately deactivates your Pupivio account and revokes its active sessions. Signing in to the same account within 30 days cancels deletion and restores your account, projects and remaining balance. After the recovery period, our scheduled process removes account data and queues uploaded media for deletion, subject to proportionate legal and billing-record retention. Active or uncertain provider jobs must settle before deletion can proceed; contact hello@1stdo.com if this delays an erasure request. Photos saved on your device, external copies and independently held provider records are not erased by deleting a Pupivio account.

13. Your choices and requests

You can choose local editing, decline AI processing, change device permissions, remove a film from My films and undo that removal in the current view, or request account deletion in Privacy & data. Removing a film from the library hides it; it does not erase the underlying account record, purchase ledger, saved Photos or provider-held copy. For a data-access, export or erasure request beyond the in-app controls, contact hello@1stdo.com.

Depending on applicable law, you may request access, correction, erasure, portability, restriction, objection, withdrawal of consent or an appeal of a refused request. Email hello@1stdo.com with "Pupivio privacy" in the subject. We may need proportionate verification of identity or authority; do not send passwords or unnecessary identity documents. We respond within the applicable statutory period and explain lawful exceptions or extensions.

14. Regional rights

Where UK or EEA law applies, you may exercise the relevant data-subject rights and complain to the UK ICO or competent supervisory authority. You do not need our permission to complain. We do not make solely automated decisions about your employment, credit, insurance or similar legal eligibility.

Where California law applies to us and your information, rights may include knowing/accessing, correcting and deleting covered information, applicable limits on sensitive-information use and an authorised-agent request. We do not sell personal information or share it for cross-context behavioural advertising under the current product design, and do not penalise lawful privacy requests. Other US state laws can provide an appeal right.

Where Australian law applies, you may seek access/correction and complain first to us and then, as appropriate, to the OAIC. Canadian users may have access, correction, consent and complaint rights under the applicable federal or provincial law. These descriptions do not reduce mandatory protections or imply that every law applies in every circumstance.

15. Advertising, analytics and tracking

The current app does not include advertising or cross-app tracking SDKs. Optional analytics and notification preferences are separate from required account processing; storing a preference does not mean a delivery or analytics service is already configured. A future materially different use requires updated information and any legally required choice before it begins.

16. Changes and contact

We will update the version/date for material policy changes, explain changes as required and obtain a fresh consent where the law requires it. A new feature does not automatically authorise a new provider, additional media, wider publication or a linked account.

Contact ESOTECH LTD at hello@1stdo.com. Identify Pupivio and the relevant feature, job or request. Please redact credentials and unrelated private material from support messages.